Risk Response, Internal Control and Enterprise Risk Management
Domain 6 tests risk response, internal control and enterprise risk management as an integrated system. The exam rewards responses that match the risk, controls that are testable and governance that assigns accountability.
Core rules and concepts
- Response options (TARA): tolerate/accept, treat/reduce, transfer/share, terminate/avoid. For upside risk, exploit, enhance, share or accept.
- Control types: preventive (segregation of duties, authorisation), detective (reconciliation, exception reports), corrective (business continuity, incident response) and directive (policies, training). Controls may be manual or automated.
- COSO internal control: control environment, risk assessment, control activities, information and communication, and monitoring activities.
- Three lines model: operational management owns risk (first line); risk and compliance functions advise and challenge (second line); internal audit provides independent assurance (third line). The board and audit committee oversee.
- ERM takes a portfolio view, aligns risk with strategy and appetite, and requires culture, data and reporting - not just a risk register.
Worked example
Purchase fraud is assessed as high risk. The response is to treat it: segregate requisition, approval and payment; enforce a three-way match in the ERP; review changes to the vendor master file; and reconcile supplier statements. These are mainly preventive, with detective reconciliation. Fidelity insurance transfers some loss but leaves deductibles and reputational damage, so it supplements rather than replaces controls. Internal audit then tests design and operating effectiveness; residual risk is reported to the audit committee.
Traps that cost marks
Claiming transfer eliminates risk; designing controls without testing them; placing internal audit in the first line; equating ERM with a risk register; and accepting risk beyond delegated authority.