ICSAN Admin Risk cheat sheet

ISO 31000 sequence: scope/context → risk identification → analysis → evaluation → treatment → communication/consultation → monitoring/review; communication and monitoring are continuous, not terminal steps.

COSO ERM 2017 has five components (governance and culture; strategy and objective-setting; performance; review and revision; information, communication and reporting) supported by 20 principles.

Three lines model: first line owns and manages risk; second line provides expertise, oversight and challenge; third line (internal audit) gives independent assurance to the governing body.

Risk appetite is the amount and type of risk an organisation is willing to pursue; risk tolerance is the acceptable variation around a specific objective; risk capacity is the maximum risk it can bear.

Risk governance requires board-approved policy, defined roles and delegated authority limits; a risk owner is accountable for a specific risk and its treatment plan.

Inherent risk is assessed before controls; residual risk after controls; target risk is the desired level. Control effectiveness gap = inherent − residual.

Risk architecture = how risk information flows (roles, reporting lines, systems); risk strategy = the organisation's approach and appetite; risk protocols = the rules, tools and procedures.

Bow-tie analysis separates multiple causes (threats) and consequences from a single top event, with preventive controls on the left and mitigative controls on the right.

An administrative risk committee's terms of reference should state membership, quorum, decision rights, escalation thresholds and reporting frequency to the board.

Risk = likelihood × impact; on a 5×5 matrix scores range 1–25; low 1–4, medium 5–9, high 10–16, extreme 17–25 are common but must be defined in the methodology.

Qualitative assessment uses descriptive scales; semi-quantitative uses numeric scales; quantitative uses monetary or frequency data (e.g. annualised loss = frequency × average severity).

Expected loss = probability of event × financial impact; used to rank administrative process risks and set control priorities.

Risk identification techniques: process mapping, walkthroughs, workshops, checklists, interviews, SWOT, PESTLE, scenario analysis, incident and near-miss logs, loss data.

Risk register minimum fields: ID, description, cause, consequence, owner, inherent score, controls, residual score, treatment action, due date, status.

PESTLE covers Political, Economic, Social, Technological, Legal, Environmental external drivers; SWOT covers Strengths, Weaknesses, Opportunities, Threats.

A risk taxonomy groups risks by category (strategic, operational, financial, compliance, reputational) to prevent gaps and double counting.

Risk criteria must be set before evaluation so that a risk is judged against agreed thresholds rather than after the score is known (avoids anchoring bias).

Common biases in risk workshops: availability, anchoring, groupthink, overconfidence, and optimism bias; mitigations include independent challenge and pre-mortem techniques.

COSO Internal Control framework: five components (control environment, risk assessment, control activities, information and communication, monitoring) and 17 principles.

Control types: preventive (stops before), detective (finds after), corrective (fixes after); also manual vs automated, and entity-level vs transaction-level.

Segregation of duties separates authorisation, custody, recording and reconciliation; where headcount is limited, compensating controls (independent review, exception reports) apply.

Control design effectiveness asks whether the control, as designed, would mitigate the risk; operating effectiveness asks whether it worked consistently over the period tested.

A key control is one that, if it fails, materially increases the risk; only key controls are prioritised for testing.

COSO 17 principles include commitment to integrity and ethical values, board oversight, established structure and authority, competence, and accountability.

The control environment is the tone at the top: ethics, governance structure, assignment of authority, HR policies, and management's commitment to competence.

Control testing sampling: attribute sampling is used for pass/fail controls; a single exception in a sample of 25 may indicate the control is not operating effectively and requires root-cause review.

Operational risk is loss from failed internal processes, people, systems or external events (Basel definition); administrative examples include payment error, data entry error, and missed deadlines.

Process-level risk assessment maps each step, identifies failure points, and rates the impact on cost, time, quality and compliance.

Key Risk Indicators (KRIs) are leading metrics with thresholds; Key Performance Indicators (KPIs) are lagging; a KRI should be measurable, owned and linked to a risk.

Four-eyes principle requires a second authorised person to review before a transaction or decision is finalised.

Maker-checker workflow separates the person who inputs (maker) from the person who approves (checker) in payment and master-data systems.

Common administrative process risks: duplicate payment, wrong vendor master data, unauthorised procurement, lost documents, missed statutory filings, and key-person dependency.

Loss data collection (frequency, severity, root cause, recovery) supports quantification and trend analysis; near misses should be logged alongside actual events.

Business process re-engineering and automation (e.g. workflow systems, robotic process automation) reduce manual error risk but introduce change, access and configuration risks.

Compliance risk is the risk of legal or regulatory sanctions, financial loss or reputational damage from failure to comply with laws, regulations, codes and standards.

A compliance universe catalogues every applicable obligation with its source, owner, control and evidence of compliance.

Regulatory change management: horizon scanning → impact assessment → policy update → training → control update → attestation.

Legal risk includes contract breach, litigation, intellectual property infringement, data protection breach and employment claims.

Data protection principles (e.g. GDPR-style): lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability.

A compliance register records obligation, regulation reference, risk rating, control, monitoring frequency and responsible officer.

Three common defences against regulatory breach: documented policies, evidence of training, and audit trail of monitoring and remediation.

Whistleblowing channels must be independent, confidential and protected against retaliation; retaliation itself is a compliance failure.

Breach reporting timelines (e.g. 72-hour data breach notification under GDPR) should be documented in the incident response procedure.

The fraud triangle: pressure (incentive), opportunity, rationalisation; controls primarily reduce opportunity.

Fraud risk assessment should identify fraud schemes relevant to each process (e.g. fictitious vendor, expense reimbursement abuse, payroll ghost employees, kickbacks).

Red flags: lifestyle changes, refusal to take leave, single-point control of records, unusual journal entries, vendor addresses matching employee addresses.

Mandatory leave and job rotation break the concealment cycle for frauds that require continuous control of records.

Segregation of duties plus independent bank reconciliation plus vendor master change approval are core anti-fraud controls in accounts payable.

Data analytics for fraud detection: duplicate invoice testing, Benford's law analysis, gap analysis on sequential invoice numbers, and after-hours transaction testing.

A fraud response plan should define investigation ownership, evidence preservation, legal privilege, reporting to the board/audit committee, and remediation.

Internal fraud statistics consistently show that tips and hotlines are among the most effective detection methods, ahead of external audit.

Business impact analysis (BIA) identifies critical processes, their dependencies, and the maximum tolerable period of disruption (MTPD).

Recovery time objective (RTO) is the target time to restore a process; recovery point objective (RPO) is the maximum acceptable data loss measured in time.

RTO must be shorter than or equal to MTPD; if RTO > MTPD the continuity strategy is inadequate.

Continuity strategies: hot site (immediate), warm site (hours/days), cold site (weeks); plus manual workarounds and cross-trained staff.

Crisis management team roles: crisis leader, communications lead, operations lead, legal/compliance lead, HR lead, IT lead.

Exercise types in increasing rigour: plan walkthrough, tabletop exercise, simulation, full failover test; each should produce an after-action report with actions.

Continuity plan should be reviewed at least annually and after significant organisational change, and stored in an accessible offline location.

Crisis communication principles: single source of truth, pre-approved holding statements, defined spokesperson, and regular update cadence.

Risk reporting should be decision-useful: concise, comparable period-on-period, with clear thresholds and escalation triggers.

A risk dashboard typically shows top risks, movement since last period, KRI status (green/amber/red), incidents, overdue actions and control test results.

Escalation rule: any risk rated extreme, or any KRI breaching red for two consecutive periods, must be reported to the board risk committee.

Monitoring types: continuous monitoring (automated rules), periodic control testing, and independent assurance (internal audit, external audit, regulators).

The three lines model differentiates management (first), risk/compliance (second) and internal audit (third); assurance mapping shows coverage and gaps.

Internal audit independence requires reporting to the audit committee and no operational responsibility for the areas audited.

Assurance mapping overlays the sources of assurance (management testing, compliance monitoring, internal audit, external audit) against key risks to identify over- or under-assurance.

Risk reporting frequency should match risk velocity: fast-moving operational risks monthly, strategic risks quarterly.

Corporate governance codes typically require board independence, separation of chair and CEO, audit committee of independent directors, and annual evaluation of board effectiveness.

Fiduciary duties: duty of care (act with diligence and skill) and duty of loyalty (act in the best interest of the organisation, avoid conflicts).

Conflicts of interest should be declared in a register, and the conflicted person should be excluded from the relevant decision.

Codes of conduct should cover gifts and hospitality thresholds, anti-bribery, insider information, confidentiality and whistleblowing.

Anti-bribery principles (e.g. UK Bribery Act) include prohibition of bribery, facilitation payments and failure to prevent bribery by associated persons.

Professional bodies' codes typically rest on integrity, objectivity, confidentiality, competence and professional behaviour.

A conflict of interest, undisclosed gift above threshold, or misuse of position is a conduct breach reportable to the audit committee or ethics committee.

Board committees: audit (financial reporting, internal control, external audit), risk (risk appetite, top risks), remuneration (executive pay), nomination (board composition).

Tone at the top is reinforced by tone in the middle: middle managers must model and enforce ethical behaviour for controls to operate.

Risk reporting should be decision-useful: concise, comparable period-on-period, with clear thresholds and escalation triggers.

A risk dashboard typically shows top risks, movement since last period, KRI status (green/amber/red), incidents, overdue actions and control test results.

Escalation rule: any risk rated extreme, or any KRI breaching red for two consecutive periods, must be reported to the board risk committee.

Monitoring types: continuous monitoring (automated rules), periodic control testing, and independent assurance (internal audit, external audit, regulators).

The three lines model differentiates management (first), risk/compliance (second) and internal audit (third); assurance mapping shows coverage and gaps.

Internal audit independence requires reporting to the audit committee and no operational responsibility for the areas audited.

Assurance mapping overlays the sources of assurance (management testing, compliance monitoring, internal audit, external audit) against key risks to identify over- or under-assurance.

Risk reporting frequency should match risk velocity: fast-moving operational risks monthly, strategic risks quarterly.