Risk Management and Internal Control
Frameworks and responsibilities
The board sets risk appetite; management operates the risk management system; internal audit provides independent assurance. Understand the three lines model (operational management, risk and compliance functions, internal audit) and why independence of the third line matters. Know the components of internal control: control environment, risk assessment, control activities, information and communication, and monitoring.
Identifying and treating risk
Be able to distinguish inherent, residual and target risk, and the treatment options: avoid, reduce, transfer, accept. A frequent trap is confusing risk likelihood with impact, or treating a risk register as evidence that risk is managed - it is only a tool. Another trap is assuming internal audit designs controls; it evaluates them.
Assurance and reporting
Understand the difference between reasonable and limited assurance, the role of the audit committee in overseeing internal and external audit, and how material weaknesses are reported. Recognise that no system of internal control provides absolute assurance.
Worked example
A company's key supplier fails. The risk register listed supplier failure as high likelihood, high impact, with a mitigation of dual sourcing. No second supplier was contracted. The control failed not in identification but in operation - the residual risk was never reduced. Rule of thumb: a documented mitigation that is not implemented is not a control.