1. 2011 Governance, Risk, and Compliance Conference August 29 – 31, 2011 / Orlando, FL, USA The Top Four Essential Objectives to Auditing ERM Stephen E. McBride, CIA

2. Agenda Definition of key terms Risk management principles & process Recent financial events Risk governance roles Key areas of focus in establishing audit objectives

3. Risk The possibility of an event occurring that will have an impact on the achievement of objectives. Measured in terms of likelihood and impact

4. Risk Management A process to identify, assess, manage, and control potential events or situations to provide reasonable assurance regarding the achievement of the organization’s objectives

5. Why Manage Risk? Decrease the cost of financial distress Reduce earnings volatility Facilitate optimal investments Incorporate portfolio theory

6. Enterprise Risk Management The application of risk management principles to all significant risks facing an organization

7. Risk Governance Roles Board of Directors Management Internal Auditors

8. Financial Events Enron Washington Mutual Bank AIG MF Global Were these events: – risk management process failures, – implementation failures, or – both?

9. Where to Begin Failures? – Financial: Credit, Market, Liquidity – Operational – Strategic Review models, assumptions, derivatives, strategies, black swan? Top 4 objectives

10. 1. Business Strategies and Risk Appetite Determine approval of risk appetite Determine understanding of business model

11. Audit Objectives –Risk Appetite 1.Risk appetite – the entity’s risk appetite defines acceptable and undesirable risks. 2.Parameters for risk 1.Strategic – new products or initiatives 2.Financial – max acceptable loss or performance variations 3.Operating – capacity management, quality targets, environmental requirements.

12. 2. Internal Environment The Board of active and possesses an appropriate degree of expertise Chief Risk Officer communication Management risk council reporting to the Board Management’s risk appetite is aligned throughout the organization

13. Ethics Determine methods for ensuring the Code of Conduct is communicated and complied with across the organization Ensure results are properly communicated Determine whether executives comply with discretionary expenditures policies

14. Follow the Money Determine how management is rewarded for performance

15. 3. Event identification Management identifies potential events Techniques are used to look at both the past and the future Event identification is robust Management understands how events relate to one another

16. 4. Control Activities Management indentifies control activities need to ensure risk responses are carried out properly Policies are implemented consistently Conditions are investigated and appropriate corrective action taken General and application controls are implemented

17. Volume of Exceptions Determine the volume of policy or internal control exceptions Determine steps taken for corrective action

18. Conclusion Determining the control framework and management practices in these areas will help determine risk culture Risk culture is the primary indicator of an organization’s risk management oversight and its likelihood of continued long term success