COSO shows how to put risk assessment into practice

BY KEN TYSIAC
October 26, 2012

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) on Friday released a thought paper, Risk Assessment in Practice, designed to help organizations find the optimal risk-taking zone, which the paper refers to as the “sweet spot.”

“Risk assessment is all about measuring and prioritizing risks so that risk levels are managed within defined tolerance thresholds without being over controlled or forgoing desirable opportunities,” Deloitte & Touche LLP partner and paper co-author Patchin Curtis said in a news release.

The thought paper describes a risk assessment process that should be practical, sustainable and understandable. The enterprise risk management process (ERM) must be structured, disciplined, and correctly scaled to the organization’s size, complexity and geographic reach, according to the paper.

Identifying risks requires casting a wide net at first to understand the possibilities that need to be included in the organization’s risk profile, according to the paper. Prioritization then takes place to focus senior management and board attention on key risks.

The risk assessment process outlined in the paper includes:

  • developing assessment criteria
  • assigning values to each risk and opportunity
  • considering risk interactions because risks, when combined, can cause compounded damage
  • prioritizing risks
  • responding to risks


The authors advocate developing “assessment scales” to measure the impact, likelihood, organizational vulnerability and speed of onset of risks on a scale from 1 (low) to 5 (high). Any two of those factors can be plotted against each other in graphical representations known as “risk maps” or “heat maps” to inform decisions, according to the paper.

Although many organizations begin this ERM process by using simple spreadsheets, the paper says, software and systems that quickly will pay for themselves in saved labor costs are available.

The paper advises that the information learned from the risk management process must feed into the strategic planning process to facilitate the proper actions.

“You’ll know you’re doing risk assessment right,” the paper concludes, “when leaders at every level use the information to make decisions regarding value.”

Ken Tysiac ( ktysiac@aicpa.org ) is a JofA senior editor.

PROFESSIONAL DEVELOPMENT: EARLY CAREER

Making manager: The key to accelerating your career

Being promoted to manager is a key development in a young public accountant’s career. Here’s what CPAs need to learn to land that promotion.

PROFESSIONAL DEVELOPMENT: MIDDLE CAREER

Motivation and preparation can pave the path to CFO

CPAs in business and industry face intense competition to land a coveted CFO job. Learn how to best prepare yourself for the role.

PROFESSIONAL DEVELOPMENT: LATE CAREER

Second act: Consulting

CPAs are using experience to carve out late-career niches. Learn how to successfully make a late-career transition to consulting, from CPAs who have done it.