Risk Management and PMO

1

• Risk Management and PMO
• A Facilitated Discussion of Topics of Interest
• Bob Reed
• Fin-Tech Consulting

2
Risk Management and PMO

• Overview of Potential Discussion Topics
• SOX Requirements
• Compliance Approach
• A Business Risk Model
• SOX and Operational Risk
• Risk Assessment Impact

3
Sarbanes-Oxley Requirements

• Section 302, effective in 2002, requires
  quarterly certification of effectiveness of
  disclosure controls and procedures
• Section 404, effective in 2004, requires
  Companys 10K annual report contain
• Managements statement of responsibility for
  establishing and maintaining an adequate internal
  control structure and procedures for financial
  reporting
• Managements assessment of the effectiveness of
  the internal control structure and procedures for
  financial reporting
• External auditors attestation to managements
  assessment

Biggest difference As a result of Section 404,
information about internal controls must be
documented in order for external auditors to be
able to validate managements assertions
regarding effectiveness
4
An Approach to Compliance
Inventory of significant processes
Process Risk Self Assessment
Risk Filters

• Financial Statements
• PL, B/S
• Notes

Map and cross validate agree with external
auditors
Inventory of significant accounts
Risk Filters
Key question how to determine which business
processes are critical.
5
A Business Risk Model
6
Integration of Sarbanes-Oxley and Operational Risk
Although Sarbanes-Oxley only requires an
evaluation of internal controls for financial
reporting, many companies have expanded the scope
of their reviews to address all internal control
objectives, as depicted in the generally accepted
internal control model shown at the right.
7
COSO Internal Control Framework Overview

• Risk Assessment identification and analysis of
  risks relevant to achievement of objectives,
  forming a basis for how the risks should be
  managed. Because conditions will continuously
  change, mechanisms are needed to identify and
  deal with risks associated with change.

8
Focus on Inherent Risk

• Risk The risk is any condition, event, or
  factor that might prevent the organization from
  achieving its objectives.
• Inherent Risk Risk of an occurrence before the
  effect of any control that exists
• Residual Risk Risk remaining after the
  application of controls
• Internal Controls Internal controls are a
  process - effected by an entitys board of
  directors, management and other personnel -
  designed to provide reasonable assurance
  regarding the achievement of objectives in the
  following categories
• Reliability of financial reporting
• Effectiveness and efficiency of operations and
• Compliance with applicable laws and regulations

9
Risk Impact Categories