Enterprise Risk MANAGEMENT workshop by Hadeel NASSAr (Facilitator) Based on THE MASTER GUIDE TO CONTROLLERS’ BEST PRACTICES by IMA

Enterprise Risk Management is a process, effected by entity's board of directors, management and other personnel, initiated in strategy setting spread across the entity, to identify the potential risk that may affect the enterprise and control the risk to be within in the entity’s risk appetite and provide reasonable assurance on the achievement of the organizational objectives.

Objectives Learning Risk management in interactive session! To learn and explore: Risk management definition/s Risk main concepts (appetite, residual, inherent…etc.) Risk categories Factors that may create the risk Types of risk Risk management models Considerations

Enterprise Risk management definition/s The Committee of Supporting Organizations of the Treadway Commission (COSO) defines Enterprise Risk Management as follows: Enterprise risk management is a process, effected by an entity’s board of directors, management, and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives.

ERM main concepts Now the BIG FUN Starts Risk assessment Risk response Appetite Residual Inherent

Risk categories The Association of Financial Professionals (AFP) conducted a survey in October 2011. The responses came from 435 finance professionals, across North America. Financial Risk (credit, liquidity, interest rate, currency/FX) 72% Macroeconomic Risk (GDP growth, inflation) 38% Business/Operations Risk (supply chain disruptions, production interruptions, litigation, labor, outsourcing, IT) 36% External Risk (country risk, regulatory, natural disaster) 37% Commodities Risk (power and heat, crude oil & distillates, agricultures, metals) 22%

Factors that may create the risk When developing a risk management plan, a controller should consider factors that may create risk, These factors are: Inadequate management reporting and monitoring Inadequate financial performance metrics Operational issues due to poor internal controls Legal and regulatory violations Incorrect financial reporting due to management overrides or fraudulent activities Excessive bad debt and inventory write-offs Internal and external fraud Breaches in confidentiality Lack of quality control Lack of business continuity plan

Types of risk Operational risk Financial risk Fraud risk Market risk Credit risk Commodity risk Currency risk Project risk Technology and software risk

Risk management models The Deming Cycle

Risk management models ISO 31000:2009

Risk management models The committee of Sponsoring Organizations of the Treadway Commission (COSO) Enterprise Risk Management (ERM) Model

Considerations Internal Environment Information and communication Risk Solutions, LLP has developed the following checklist to be considered when implementing an ERM approach to managing risk. ERM aims to promote informed business decisions by evaluating total returns relative to total risks. Questions that should be asked when assessing as organization’s ERM strategy are as follows: Internal Environment Information and communication Objective Setting monitoring Event Identification Risk Assessment Risk Response Control Activities

Risk management (END) ERM and IMA (CMA) 7 minutes video