Risk Assessment and Risk Response
The fourth and fifth components of COSO's ERM model are risk assessment and risk response. COSO indicates that there are two types of risk. The risk that exists before management takes any steps to control the likelihood or impact of a risk is inherent risk. The risk that remains after management implements internal controls, or some other response to risk. is residual risk. Companies should assess inherent risk develop a response, and then assess residual risk. The ERM model indicates that there are four ways to respond to risk:
• Reduce. The most effective way to reduce the likelihood and impact of risk is to implement an effective system of internal controls.
• Accept. Accept the likelihood and impact of the risk by not acting to prevent or mitigate it.
• Share. Share some of the risk or transfer it to someone else. For example, buy insurance, outsource an activity, or enter into hedging transactions.
• Avoid. Risk is avoided by not engaging in the activity that produces the risk.
This may require the company to sell a division, exit a product line, or not expand as anticipated.
Accountants play an important role in helping management design effective control systems to reduce inherent risk. They also evaluate internal control systems to ensure that they are operating effectively. Accountants can assess and reduce inherent risk using the risk assessment and response strategy shown in Figure 6-2. We will walk through the major steps in this strategy. The first step, event identification, has already been discussed
Estimate Likelihood and Impact
Some events pose a greater risk because the probability of their occurrence is more likely. For example, a company is more likely to be the victim of a fraud than of an earthquake, and employees are more likely to make unintentional errors than they are to commit fraud. The likelihood of an earthquake may be small, but the impact can be enormous. It could completely destroy a company and force it into bankruptcy. The impact from a fraud is usually not as great, as most frauds do not threaten a company's existence. The impact from unintentional errors has a broad range of effects, depending on the nature of the error and how long it persists. Likelihood and impact