Risk Management and Internal Control
Risk concepts
Risk is the combination of likelihood and impact of an event affecting objectives; uncertainty is broader. Distinguish strategic, operational, financial and compliance (and reputational) risk. Inherent risk is before controls; residual risk is after controls. The trap: reporting inherent risk when asked for residual, or vice versa.
The risk management process
Identify → assess (likelihood × impact) → treat → monitor → report. Treatment options: avoid, reduce (mitigate), transfer (insurance, hedging, outsourcing), accept (with tolerance). Risk appetite is the amount of risk the organisation is willing to accept; risk tolerance is the acceptable variation around it. A frequent error is treating 'transfer' as eliminating risk - residual risk often remains.
Internal control
Use the COSO-style components: control environment, risk assessment, control activities, information and communication, monitoring. Distinguish preventive from detective controls, and manual from automated. Segregation of duties, authorisation limits, reconciliations and physical safeguards are core control activities. Trap: assuming more controls are always better - controls have costs and can create bureaucracy or false comfort.
Three lines model
First line: operational management owns risk. Second line: risk and compliance functions oversee. Third line: internal audit provides independent assurance. Confusing the second and third lines is a classic distractor.
Worked rule of thumb
For any control question, name the risk, the control, whether it is preventive or detective, and the residual risk after the control - then state who monitors it.