Risk, Control and Ethics
What you must understand
Risk management: the risk management process (identify, assess, respond, monitor) and the TARA responses - transfer, avoid, reduce, accept. Distinguish strategic, operational, financial and reputational risk, and know that risk appetite is set by the board while risk owners manage exposures. Understand inherent vs residual risk and the role of the risk register.
Internal control: COSO's five components (control environment, risk assessment, control activities, information and communication, monitoring). Know the classic fraud triangle (pressure, opportunity, rationalisation) and the controls that break each leg - segregation of duties, authorisation limits, reconciliations, physical controls, and whistleblowing channels.
Ethics: use the AAA model (are the facts clear? are the principles/values clear? what are the alternatives and consequences?) and Tucker's five-question framework for ethical decisions. Know conflicts of interest, independence, and the professional duty to act in the public interest. Recognise bribery and facilitation payments, and the difference between legal and ethical.
Traps
- Calling a control 'adequate' when it exists on paper but is not monitored.
- Confusing risk avoidance with risk reduction.
- Treating a legal action as automatically ethical.
- Missing the pressure leg of the fraud triangle when the opportunity is well controlled.
Worked rule of thumb
For any control question, ask who, what, when, and evidence. 'The finance director approves payments' is weak; 'payments above $10,000 require dual authorisation by two signatories, reconciled monthly by internal audit' is a control. Always link the control to the specific risk it mitigates.