Risk Management and Internal Control
Risk management asks what could stop the entity achieving its objectives, and internal control asks whether the response is designed and operating. Paper 20A favours applied questions on risk registers, control design and the cost-benefit test.
Frameworks
- COSO ERM (2017): governance and culture; strategy and objective-setting; performance; review and revision; information, communication and reporting.
- COSO internal control (2013): control environment; risk assessment; control activities; information and communication; monitoring.
- Risk appetite is the amount of risk the board will accept; tolerance is the acceptable variation around a specific objective.
- Inherent risk is before controls; residual risk is after controls. Risk responses: avoid, reduce, share, accept.
- Control types: preventive, detective and corrective; manual versus automated; entity-level versus transaction-level.
- The three lines model: management owns risk, risk and compliance functions advise and monitor, internal audit provides independent assurance.
Worked example
A payment-fraud risk has 20% annual likelihood and ₹50 lakh impact, giving expected loss ₹10 lakh. A vendor-master verification control costs ₹6 lakh and lowers likelihood to 5%: expected loss ₹2.5 lakh. Net benefit = (10 − 2.5) − 6 = ₹1.5 lakh, so the control is justified on expected value. Residual risk is 5% × ₹50 lakh = ₹2.5 lakh; the board must still accept that exposure.
Traps
- Reporting residual risk as inherent risk.
- Designing controls without an owner, frequency and evidence trail.
- Assuming internal audit owns risk.
- Ignoring control cost, or ignoring the risk of over-control and delayed processes.
- Treating ERM as downside-only; it also covers upside risk.