1. Session 9 & 10

2. Definition of risk assessment and pre condition for risk assessment Establishment of clear, consistent agency objectives. Risk assessment is the identification and analysis of relevant risks associated with achieving the objectives and forming a basis for determining how risk should be managed. 3.1

3. Risk Identification may include: Qualitative and quantitative ranking activities. Management conferences For casting and strategic planning Consideration of findings from audits and other assessment 3.2

4. Risk identification also implied: Related to the objectives of the entity Comprehensive Includes risks due to external factors, at both the entity and the activity levels. 3.3

5. Development of responses: Four types of responses to risk must be considered : –Transfer –Tolerance –Treatment & –Termination Of these, risk treatment is the most relevant to these guidelines because effective internal control is the major mechanism to treat the risk. 3.5

6. 3.5 Contd… The appropriate controls involved can be either detective or preventive. 3.5

7. Risk identification A strategic approach to risk assessment depends on identifying risk against key organizational objectives. Risks relevant to those objectives are then considered and evaluated. It helps in: –Allocation of resources –Allocation of responsibility for management of these risk 3.6

8. Risk identification tools applied in I. T. management and other organisations are as fallows: –Risk assessment in I.T System System characterization Threat identification Vulnerability identification Control analysis 3.7

9. 3.7 Contd… Likelihood determination Impact analysis Risk determination Control recommendations Result documentation 3.7

10. Risk identification in other organizations Commissioning a risk review: It involves reviewing activity of the organization at all levels and build a risk profile for whole range of activities identifying the policy fields activities and functions which may be particularly vulnerable to risk 3.8

11. Risk self assessment This is a bottom up approach. Each level and part of organization is invited to review its activities and feed diagnosis of the risk faced upwards. 3.9.

12. Operation Research - Linear programming. This method is applied to find out for what values of the variables the function takes maximum values when a fixed set of restrictions are imposed on the variables. 3.10

13. In Capital budgeting, when project is viewed in isolation, following methods of risk analysis are helpful: i) Measures of risk: It consists of range, mean absolute deviation, standards deviation, Co- efficient of variation and semi-variance. Standards deviations is the most commonly used measure of risk in finance. 3.11

14. ii) Analytical deviation or simple estimation: Net present value and standard deviation of net present value may be obtained through analytical deviation or simple estimation. 3.12

15. iii) Sensitivity analysis: It consists of following steps: Set-up the relationship between the basic underlying factors and net present value Estimate the range of variation and most likely value of each of the basic underlying factors. Study the effect on net present value of variation in the basic variables. 3.13

16. Scenario Analysis Evaluated with reference to where demand is high but the price is low and where demand is low but the price is high. 3.14

17. Monte Carlo Simulation Important issues considered –Out put –Project variability –How extreme value be used –How results of simulation be used 3.15

18. Decision Tree Analysis Important points considered are: –Identifying the problems and alternatives –Delineating the decision tree –Specifying probabilities –Monitory out comes –Evaluating various decision alternatives 3.16

19. Selection of a Project:- Given the information about the expected return and variability of return, the acceptance of project and rejection thereof is decided. 3.17

20. Risk Analysis in Practice:- Expected revenue from a project are conservatively estimated to ensure that the viability of proposed project is not easily threatened by unfavorable circumstances. 3.18

21. Risk Evaluation Key purpose of risk evaluation is to inform management about the areas of risk where the action needs to be taken and their relative priority i.e. those with a major potential impact and a high likelihood of the risks occurring. 3.19

22. Assessment of risk appetite Risk appetite is the amount of risk to which the entity is prepared to be exposed before it judges action to be necessary. Decision about responses to risk have to be taken in conjunction with an identification of the amount of risk that can be tolerated. 3.20

23. Development of responses. Responses to risk can be divided into four categories. In some instances, risk can be transferred, tolerated or terminated. However, in most instances the risk will have to be treated and the entity will need to implement and maintain an effective internal control system to keep risk at an acceptable level. 3.21