Risk Management Case Study - Applied Concepts
1 like1,421 views
This document discusses risk management and auditing processes. It emphasizes the importance of planning over plans alone. Key points addressed include linking risks to corporate objectives, ensuring compliance and other risks are captured, assessing control strengths, and having timely and documented response and remediation processes. Continuous improvement is emphasized through regular risk assessment updates, control self-assessments, analyzing incidents, and using findings to support future prevention.
Risk Management Case Study - Applied Concepts
- 1. Case Study
- 2. I have always found that plans are useless, but planning is indispensable. - 34th President of the United States, Dwight D. Eisenhower
- 3. Risk & Regulation Audit Improve Policy & Control Response Incident Report Investigate Analyze ImproveMonitor
- 5. Each group should consider the inputs and outputs that can help to minimize the impact and/or frequency of risk events
- 7. Are the company’s risks linked to the key objectives? Are compliance, regulatory, reputational, etc. risks captured? For the key risks identified, do you feel like the controls are strong enough? If and when things occur, can they be addressed timely and properly recorded? Do remediation efforts align with budget and strategy?
- 10. ▪ Risks linked to corporate objectives ▪ Risk register includes compliance, IT/InfoSec, physical security, etc. ▪ Audit plan based on key areas of risk ▪ Link transactional data to risks to provid full picture
- 11. ▪ Map audit findings back to key enterprise risks to enable full transparency and prioritization ▪ Setup key risk indicators that align with enterprise risks (can this be automated?) ▪ Revisit audit plan every 6 months ▪ Push out control self-assessments
- 12. ▪ Use risk assessment to determine appropriate responsive action ▪ Setup, implement and track SOPs and SLAs (saves, near misses, etc.) ▪ Formalize electronic incident capture, investigation and case management ▪ Root cause analysis ▪ Site audits
- 13. ▪ Is there a link back to overall strategy? ▪ Is this information available to audit and risk? ▪ Do actions result in risk going down, control strength increasing, etc.? ▪ How does this information help to support possible future prevention or limit impact?