COSO shows how to put risk assessment into practice

BY KEN TYSIAC

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) on Friday released a thought paper, Risk Assessment in Practice, designed to help organizations find the optimal risk-taking zone, which the paper refers to as the “sweet spot.”

“Risk assessment is all about measuring and prioritizing risks so that risk levels are managed within defined tolerance thresholds without being over controlled or forgoing desirable opportunities,” Deloitte & Touche LLP partner and paper co-author Patchin Curtis said in a news release.

The thought paper describes a risk assessment process that should be practical, sustainable and understandable. The enterprise risk management process (ERM) must be structured, disciplined, and correctly scaled to the organization’s size, complexity and geographic reach, according to the paper.

Identifying risks requires casting a wide net at first to understand the possibilities that need to be included in the organization’s risk profile, according to the paper. Prioritization then takes place to focus senior management and board attention on key risks.

The risk assessment process outlined in the paper includes:

  • developing assessment criteria
  • assigning values to each risk and opportunity
  • considering risk interactions because risks, when combined, can cause compounded damage
  • prioritizing risks
  • responding to risks


The authors advocate developing “assessment scales” to measure the impact, likelihood, organizational vulnerability and speed of onset of risks on a scale from 1 (low) to 5 (high). Any two of those factors can be plotted against each other in graphical representations known as “risk maps” or “heat maps” to inform decisions, according to the paper.

Although many organizations begin this ERM process by using simple spreadsheets, the paper says, software and systems that quickly will pay for themselves in saved labor costs are available.

The paper advises that the information learned from the risk management process must feed into the strategic planning process to facilitate the proper actions.

“You’ll know you’re doing risk assessment right,” the paper concludes, “when leaders at every level use the information to make decisions regarding value.”

Ken Tysiac ( ktysiac@aicpa.org ) is a JofA senior editor.

SPONSORED REPORT

8 accounting and auditing issues you can’t afford to ignore

Download this sponsored report for an overview of some of the most important developments accountants and auditors are facing today.

DOWNLOAD

Filing season quick guide — Tax year 2014

Tax season started Jan. 20. Download our “quick guide,” a printable card that contains dollar thresholds, tax tables, standard amounts, credits, and deductions to keep at your fingertips during tax season.

TAX NEWS

Expired tax provisions extended for 2014

President Barack Obama signed legislation that retroactively extended more than 50 expired tax provisions for 2014, allowing taxpayers to take advantage of a host of tax incentives during this filing season.