Risk Management
Risk Management Essentials
Risk management is the process of identifying, assessing, and controlling threats to an organisation's capital and earnings. The GIA Cert Governance Practice exam expects familiarity with frameworks such as COSO ERM and ISO 31000. Key concepts include risk appetite (the amount of risk an organisation is willing to accept), risk tolerance (the acceptable variation), and risk capacity (the maximum risk it can bear). You must understand the difference between inherent risk (before controls) and residual risk (after controls).
Key Concepts and Traps
A frequent trap is mixing up risk appetite and risk tolerance. Appetite is the high-level statement; tolerance is the operational boundaries. Another trap is assuming risk management is solely the risk manager's job; it is everyone's responsibility, with the board providing oversight. Questions may ask about the three lines model: first line (operational management), second line (risk and compliance functions), third line (internal audit). Know that internal audit provides independent assurance.
Worked Example
A company sets a risk appetite of 'low' for regulatory compliance. A business unit proposes a new product that carries moderate regulatory risk. The risk manager should assess whether the residual risk after controls falls within tolerance. If not, the product should be rejected or modified. Rule of thumb: risk appetite should be approved by the board and embedded in strategy.
Exam Focus
Be prepared to identify components of ERM frameworks, distinguish between risk types (strategic, operational, financial, reputational), and explain the three lines model.