1. Identifying Risks & Controls in Business Processes By: Lea Sulaiman Saputra D1555

2. Framework for Studying Internal Control: Internal Control Objectives & Components Risk assessment is the identification & analysis of risks that interfere with the accomplishment of internal control objectives. Control activities are the policies & procedures developed by the organization to address the risks to the achievement of the organization’s objectives.

3. Assessment of Execution Risks: Revenue Cycle Execution risks involve the risks of not properly executing transactions. Generic execution risks for each of the two revenue cycle transactions are as follows: Delivering goods & services Collecting cash

4. Five steps are useful in understanding & assessing execution risk: Achieve an understanding of the organization’s processes. Identify the goods or services provided & cash received that are at risk. Restate each generic risk to describe the execution risk more precisely for the particular process under study. Exclude any risks that are irrelevant or obviously immaterial. Assess the significance of the remaining risks. For significant risks, identify factors that contribute to the risk. The events in the process can be used to systematically identify these factors.

5. Assessment of Execution Risks: Acquisition Cycle Generic execution risks for each of the two acquisition cycle transactions are as follows: Receiving goods & services Making payment Five steps are useful in understanding & assessing execution risk: Achieve an understanding of the organization’s processes. Identifying goods or services provided & cash received that are at risk. Restate each generic risk to describe the execution risk more precisely for the particular process under study. Exclude any risks that are irrelevant or obviously immaterial. Assess the significance of the remaining risks. For significant risks, identify factors that contribute to the risk. The events in the process can be used to systematically identify these factors.

6. Five steps are useful in understanding & assessing execution risk: Achieve an understanding of the organization’s processes. Identifying goods or services provided & cash received that are at risk. Restate each generic risk to describe the execution risk more precisely for the particular process under study. Exclude any risks that are irrelevant or obviously immaterial. Assess the significance of the remaining risks. For significant risks, identify factors that contribute to the risk. The events in the process can be used to systematically identify these factors.

7. Assessment of Information Systems Risks Information systems risks or the risk of errors in a company’s information system through the improper recording, updating or reporting of data.

8. Control Activities Types of control activities: Workflow controls Input controls General controls Performance reviews