80 likes | 372 Views
Risk/Controls. Risk Definition: Potential threat to the company (what could happen?), likelihood threat will occur (will it happen?), exposure to company if threat occurs (materiality of risk result?)
E N D
Risk/Controls Risk Definition: Potential threat to the company (what could happen?), likelihood threat will occur (will it happen?), exposure to company if threat occurs (materiality of risk result?) Risks need context – the company, what it stands for, what level of risk management is willing to tolerate, industry risks involved, etc.
Risk Assessment - COSO • General • Determine threats to the company • Estimate probability of threat occurring • Estimate exposure from each threat • Specifics • Segregation of Duties Matrix • Financial Statement Matrix • Accounting Cycle Matrix • Access Matrix (IT – discuss next week)
Segregation of Duties Matrix • Examples: • FCRP SOD Matrix.xls • Revenues SOD Matrix.xls
Financial Statement Matrix • Example: • Risk Assessment BS.xls • Risk Assessment IS.xls
Accounting Cycles • Revenue • Expenditures (may separate out Fixed Assets) • Production/Operation • Payroll/Human Resources • Treasury/Finance • Financial Close & Reporting
Accounting Cycles – general risks Discussion: • Revenue • Expenditures (may separate out Fixed Assets) • Production/Operation • Payroll/Human Resources • Treasury/Finance • Financial Close & Reporting
Accounting Cycle Matrix • Example: • Risk Assessment_example.xls • Suggested template
Stacey’s Risks determination method by Cycle • Give / Get Exchange • Major Transactions Types (Activity/Forms) • SOD (who/how): • Approval • Custody • Recording • Monitoring • Control objectives to determine risks: • valid, accurate, timely, complete, compliant, safeguard assets