1. The Strategic Management Process, which defines the company’s mission and objectives, as well as the risks that threaten the objectives, and estabilishes processes to monitor and manage those risks and achieve the objectives;
2. Core Business Processes, which develop, produce, sell and distribute the company’s products;
3. Resource Management Processes, which support the other processes. These include functions such as human resources, information technology, accounting and other.
Included in the overall consumer products business model are lists of the company’s Alliances, Core Services/Products, and Potential Customers.
As part of this risk assessment methodology, the CAE reviews the strategic plans of the company
and all the business units. The department’s efforts are then targeted toward the key areas and objectives upon which the company and each of the business units are focusing. To accomplish this objective, the auditors meet with executives at the various business units and walk through a questionnaire that they have developed as part of the risk-based assessment approach (see Exhibit5 for the questionnaire and the particular business risks and factors discussed).
EXHIBIT 5
Business Risk Assessment Interview Topics
The following questions and topics are intended as an overview of the type of discussion we would like to foster through ore risk assessment interview process. Please use this information as a guide for our discussion. It does not have to be filled out in advance.
Overview
1) Discuss business strategies for your area of responsibility.
2) Discuss key business processes performed within your area of responsibility.
3) Discuss key business initiatives: current, upcoming, and/or ongoing.
Risk
1) What business risks do you see within your area? (See attached list of potential business risk factors.)
2) Can you estimate the likelihood of these risks occurring? (Example: high-very likely this will happen: medium: low)
3) Can you estimate the impact of these risks? (Example : high impact: medium: low)
4) Do you have a process for measuring and identifying these risks?
Controls
1) Briefly describe what controls are in place to protect against these risks.
Other Items
1) Do you have other areas of concern outside your immediate responsibilities?
EXHIBIT 5 (continued)
Business Risk Categories and Risk Factors (for discussion)
Risk Category Risk Factors
External Environment - competition - industry
- financial markets - owner relations
- political - business interruption
- regulatory
Control Environment - support - legal
- measurements - strategic
Infrastructure - leadership - information management
- human resources
Marketing & Selling - product branding - product development
- satisfaction - product
- services - marketing
- competition - distribution channels
Supply Chain - purchasing - raw material management
- Cost - vendor management
Liquidity - cash flow - exchange rates
- Assets - taxation
- Cost of capital - funding requirements
Operations - processes - finished product management
- Production cycle - contingency planning
- Capacity - incentives
Next, the CAE weighs and prioritizes potential projects across all the business units, while giving consideration to the volume of their activities and their importance to the company’s overall strategic plan (see Exhibit 6 for a graphical representation of an overview of the risk assessment objectives, process, and results).
RISK- BASED METHODOLOGY
The risk assessment framework closely incorporates the concepts of risk and control. The Schwan Food Company establishes business objectives at all levels of the company, from the corporate level down through each business unit. To achieve these objectives, the company puts in place core business processes, which are groupings of related business activities (e.g., procure materials, manufacture products, distribute produces, sell products, service customers). The core business practices are upheld by support processes that provide resources and services to the core business processes. Risks threaten the achievement of business objectives at all levels, while
EXHIBIT6
Risk Assessment Overview
Objectives Identify business risks and controls (operational, financial reporting, and
compliance)
Measure and prioritize the identified risks
Obtain management consensus
Process Focused interviews with multiple levels of management
Review of business plan
Analysis of financial and operational reports and other company information
Review of audit reports, management letters, industry information and other
Items
Results Risk profile: A profile of key business risks by business unit, key business
Objectives, and core business processes – ranked
Risk Treatments: An initial set of recommendations for management
Consideration arising from the risk assessment process
Internal Audit Plan: A proposed set of audits for the coming year, focusing
On areas of risk most appropriate for internal audit to address and key
Controls that should be tested
Controls are the activities Schwan puts into place to manage or mitigate the risks. Controls are often built into the core business processes and support processes (see Exhibit 7 for a graphical representation of the risk assessment framework.)
Within each process, the internal audit personnel assess gross risk (threats of impediments to the accomplishment of corporate of process objectives), the strength of relevant controls and of management’s response to the identified risks, and residual risk (a re-evaluation of risk in light of gross risks for reasonableness. See Exhibit8 for a graphical representation of this risk assessment.
The risks are rated based on the magnitude of the impact to the organization of the risk occurring, as well as on the probability of occurrence. Residual risk assessments are conducted of financial and operational reports, and a review of miscellaneous information (e.g., industry information, process documentation, etc.). For validation, the assessment results are discussed with the appropriate levels of management.
EXHIBIT 7
Risk Assessment Framework
Business Objectives
RISK RISK
Support Processes Core Business Processes Support Processes
RISK RISK
For example, at The Schwan Food Company food quality and food safety are two areas of continual vigilance. The internal audit personnel will assess a gross risk of raw materials contamination at a certain level, but to control this very serious risk, every single batch of raw materials of product that comes into The Schwan Food Company’s factories is tested for contamination. As a result of these very stringent controls that are in place, the residual risk is assessed as extremely low. For additional examples of residual risk ratings, see Exhibit 9.
Those business functions or processes with residual risk above a certain level are considered candidates for potential internal audit projects. The first question, however, is what expertise or resources are needed to best address the residual risk. Can management address the risk directly process can be directly addressed by management. In other cases, either the legal department, the compliance department, or the external auditors, may be the most appropriate resource. Those functions or processes most appropriately addressed by the IAD are entered into the internal audit plan. That plan is reviewed with senior and business unit management and must be approved by the audit committee.
ASSESSMENT OF EFFECTIVENESS
The CAE reviews the status of the overall internal auditing plan with the auditing committee five times a year, on average. The success of the IAD is primarily measured against the criteria of whether the internal auditors are adding value to The Schwan Food Company. For Example, are the major internal audit projects being completed? Is the IAD receiving requests from the business units for other projects? The CAE budgets approximately 80 percent of the internal audit staff time for projects identified through the risk assessment process, leaving 20 percent of their time open for