COSO categorizes risks into four areas:
financial, strategic, operational, and compliance.
A financial risk to the organization
might be inadequate capital, whereas a compliance
risk may be inaccurate local sales tax
reporting. After identifying the risk, it is measured
by estimating its significance (exposure
in dollars) and likelihood (probability
of occurrence). Next, the organization prioritizes
the identified risks; looks for risk
interactions that might magnify the risk
effects; and develops a risk response, whether
that is to reduce, accept, share, or avoid.