Internal Audit Agency 3RD Annual Internal Audit Forum Theme: Risk Management in the Public Sector: The Role of Internal Auditing Outline of Presentation: y Introduction y Risk Register y Why Develop a Risk Register? y Risk Register Template y Risk Measurement y y Likelihood Measurement Impact/ Consequence Measurement y Combined Effect of Likelihood and Impact y Conclusion 2 Introduction: y For effective management of risk, each step of the RM Process should be supported with appropriate tools and the output well documented. y A system for reporting risk helps to ensure the consistency, completeness, and timeliness of risk control decisions. y Database management systems are the most effective way to document and communicate risk information. y The primary database for documenting risk is the Risk Register. 3 The Risk Register y The Risk Register is a management tool that enables an organization to understand its comprehensive risk profile. y It is simply a repository for all risk information. y The Risk Register records details of all the risks identified for an organization, a budget centre or project. 4 The Risk Register (ctd) The RR is described as “a log of risks of all kinds that threaten an organization’s success in achieving its declared aims and objectives. It is a dynamic living document, which is populated through the organization’s risk assessment and evaluation process. This enables risk to be quantified and ranked. It provides a structure for collating information about risks that helps both in analysis of risks and in decisions about whether or how those risks should be treated.” – [The Risk Register Working Group of the UK NHS (2002) ] 5 The Risk Register (ctd) y The RR is the hub of the internal control system, given that it contains the objectives, risks and controls for the organization or operation. y Risks associated with activities and strategies are identified then graded in terms of likelihood of occurrence and seriousness of impact. y It is an important component of an organization’s risk management framework. y The Risk Register can be put together by members of the organizations, but must be owned and agreed by the Senior Management Team or the ARIC. 6 Why develop a Risk Register? y Analysis contained in a risk register can be used to document and improve workplace practices. y Can be used to notify senior managers of emerging risk exposures that warrant immediate attention. y encourage a high level of ownership of, and commitment to, the organization’s processes and activities when all staff are involved in the process of compiling a risk register y Gives assurance to Management on the status of risks they face. 7 The Risk Register Template y The Risk Register is a template to work through the risk management process. y Working from left to right across the template, one is prompted to consider all elements of the risk management process. y The risk register template consists of some headings in a table that reflects the nature of the risk that is to be addressed. y These headings are shown in the following table: (Click) 8 The Risk Register Template y The advantage of using a single template as a record of risk analysis, evaluation, treatment and monitoring actions is the clear presentation of the logic which supports the decision making process. y The completed risk register should be brief and to the point, so it quickly conveys the essential information. y It should be updated on a regular basis. 9 RISK MEASUREMENT As a guide, a brief description of the objectives and scope of the activities to be included in the Risk Register are as follows: i) Likehood Rankings: Likelihood Likelihood rankings should be calibrated, Rankings where necessary to ensure compliance with applicable regulations, safety standards and other tolerances that have been agreed with key activity sponsors. 1 Low Probability less than 5% (Has not/unlikely to occur) 2 Medium Probability less than 25% (Any history of occurrence?) 3 High Probability of over 25% (has occurred recently) 10 RISK MEASUREMENT Impact Rankings Impact rankings should be calibrated to reflect the severity of consequence, should a risk crystallize. Low impact on the organization’s strategy 1 Minor or operational activities. Low stakeholder concern Moderate impact on the organization’s 2 Moderate strategy or operational activities. Moderate stakeholder concern High impact on the organization’s strategy 3 Significant or operational activities. Significant stakeholder concern 11 Grade: Combined effect of Likelihood/Impact Likelihood High (3) B. Medium (2) C. Low (1) A. 1. Minor 2. Moderate 3. Significant M H H L M H L L M Consequence/ Impact Rating A guide of actions to Manage Risks (E.g.) An Example of a Risk Register is: (RR) 12 Conclusion: y Using the Risk Register to document risk provides a clear understanding of the risk management process and helps in the identification of inherent risk as well as appropriate strategies to mitigate these risks. 13 THANK YOU 14