Arm 54 Chapter 2

Front 1

Risk management standard

Back 1

A document published by a recognized authority that includes principles, criteria, and best practices for risk management.

Front 2

Framework

Back 2

A structure, including elements such as concepts, methods, procedures, and metrics, that supports the risk management process.

Front 3

Common purpose of risk management standards

Back 3

All of the standards share a common purpose of helping organizations assess and manage risk.

Front 4

Similarities of risk management standards and frameworks

Back 4

• Structured process steps
•Understanding of and accountability for defining risk appetite
•Formal documentation of risks in risk assessment activities
•Establishment and communication of risk management process goals and activities
•Monitored treatment plans

Front 5

Select risk management standard(s) based on these criteria

Back 5

• Adherence to controls
• Need to meet regulatory requirements (compliance)
• Risk governance

Front 6

Risk governance

Back 6

Integration of the management principles governing the organization with the risk management process

Front 7

RIMS Risk Maturity Model (RMM)’s 7 essential attributes

Back 7

• ERM process management
• Risk appetite management
• Root cause discipline
• Uncovering risks
• Performance management
• Business resiliency and sustainability

Front 8

How the RIMS Risk Maturity Model (RMM) works

Back 8

Key drivers of each attribute are analyzed and measured to establish the maturity level. The organization bases its self-assessment on its performance in these attributes along a maturity continuum ranging from nonexistent at level 0 to leadership at level 5.

Front 9

ISO 31000: 2009 risk management standard description

Back 9

•Consists of three major parts:
–Principles: Rooted in risk management and designed to generate value and continuously scan and react to the environment
–Framework: Elements based on program design, implementation, and monitoring
–Processes: Emphasis on deliberative communication, context, risk assessment and treatment, and follow-up

Front 10

COSO ERM risk management standard description

Back 10

• Focuses on threats to the organization and application of controls.
• Does not delve into details of risk management approaches and processes.

Front 11

Basel II description

Back 11

• Issued by the Basel Committee on Banking Supervision to provide recommendations on banking laws and regulations.
• Basel II is a regulation rather than a standard.
• Establishes risk and capital management rules.

Front 12

Solvency II

Back 12

• Developed by the European Commission to provide regulatory requirements for insurance firms that operate in the European Union.
• Solvency II is a regulation rather than a standard.

Front 13

ISO 31000 scope

Back 13

Although the standard is universally applicable, it is not intended to produce uniformity. On the contrary, its emphasis is on tailoring its process and framework to each organization.

Front 14

Risk criteria

Back 14

Reference standards, measures, or expectations used in judging the significance of a given risk in context with strategic goals.

Front 15

What an organization’s risk management policy should do

Back 15

This policy should address how the organization will identify risks and how it will measure, review, and communicate its risk management efforts.

Front 16

ISO 31000 definition of risk assessment

Back 16

The ISO 31000 definition of risk assessment includes• Risk identification
• Risk analysis
• Risk evaluation

Front 17

Risk treatment

Back 17

Risk treatment is the ongoing process of deciding on an option for modifying risk and whether the residual level of risk is acceptable, selecting a new risk treatment if the current one is not effective, and then repeating this assessment.

Front 18

Elements of risk monitoring

Back 18

• Monitoring and reviewing both internal and external changes and how these changes affect risks and their treatment should be a planned part of the risk management process.
•Monitoring should also include recording the assessments and reporting them internally and externally, as needed; determining the frequency, distribution, and method of reporting is an integral part of developing the risk management process.

Front 19

The COSO Enterprise Risk Management-Integrated Framework is designed to help an organization achieve its objectives in four categories:

Back 19

• Strategic- high-level goals, aligned with and supporting its mission
• Operations-effective and efficient use of its resources
• Reporting- reliability of reporting
• Compliance--compliance with applicable laws and regulation

Front 20

The eight elements of the COSO Enterprise Risk Management-Integrated Framework

Back 20

• Internal environment
• Objective setting
• Event identification
• Risk assessment
• Risk response
• Control activities
• Information and communication
• Monitoring

Front 21

Inherent risk

Back 21

Risk to an entity apart from any action to alter either the likelihood or impact of the risk

Front 22

Residual risk

Back 22

Risk remaining after actions to alter the risk’s likelihood or impact

Front 23

Internal environment component of COSO

Back 23

Determine risk management philosophy and risk appetite, integrity and ethical values, and the operating environment. A board of directors is an important part of the internal environment with influence on the other aspects of the environment. In this component of the risk management process, senior management aligns the people, processes, and infrastructure to make it possible for the organization to stay within its risk appetite.

Front 24

Objective setting component of COSO

Back 24

Align risk management objectives with the organization’s mission and risk appetite. Objectives must be determined before management can identify the events that might affect their achievement.

Front 25

Event identification component of COSO

Back 25

Identify internal and external events that affect achievement of objectives, and distinguish between negative risk and opportunity risk. External events include economic, political, social, and technological elements. Internal factors include management decisions, people, infrastructure, processes, and technology.

Front 26

Risk assessment component of COSO

Back 26

Analyze risks, considering likelihood and impact. Likelihood is the possibility that a given event will occur. Impact is the effect of an event if it does occur. Risk assessment is first applied to inherent risk. After the development of risk responses, residual risk is determined.

Front 27

Risk response component of COSO

Back 27

Select how to respond to the risks identified, for example, by avoidance, reduction, or transfer.

Front 28

Control activities component of COSO

Back 28

Establish policies and procedures to carry out effective risk responses. Control activities are the policies and procedures to determine that risk responses are performed correctly.

Front 29

Information and communication component of COSO

Back 29

Use effective communication that flows down, across, and up the organization. An organization should use both historical and current data to have an effective risk management program.

Front 30

Monitoring component of COSO

Back 30

Make modifications through ongoing monitoring of the risk management process. An organization may use both internal and independent evaluations to monitor its risk management.

Front 31

According to COSO, is risk management a serial process?

Back 31

According to COSO, “risk management is not strictly a serial process, where one component affects only the next. It is a multidirectional… process in which almost any component can and does influence another.”

Front 32

According to COSO, at what level should the risk management process be applied?

Back 32

According to COSO, the risk management process should be applied across all four levels of an organization: entity, division, business unit, and subsidiary.

Front 33

Why are control activities a key feature of the COSO standard in comparison with other risk management standards?

Back 33

Because COSO 2004 historically focused on financial controls and developed its risk management framework in the context of internal audits related to compliance with Sarbanes-Oxley, control activities are a key feature of this standard in comparison with other risk management standards.

Front 34

What are control activities according to COSO?

Back 34

Control activities are policies and procedures applied to each of the four categories of objectives—strategic, operations, reporting, and compliance.

Front 35

According to COSO, what is the most important function of a control?

Back 35

According to COSO, the most important function of a control is its role in achieving the objective.

Front 36

What are the two parts of a control activity?

Back 36

The first part is the policy that states what should be done, and the second part is the procedure to accomplish the policy.

Front 37

What are the two types of monitoring?

Back 37

The first type is ongoing regular monitoring by an organization’s management. The second type is period evaluations, often by internal auditors. Internal auditors can identify areas where control activities are deficient and make recommendations to improve them.

Front 38

In what areas does Solvency II aim to achieve consistency across Europe?

Back 38

Solvency II aims to achieve consistency across Europe in these areas:
• Market-consistent balance sheets
• Risk-based capital
• Own risk and solvency assessment (ORSA)
• Senior management accountability
• Supervisory assessment

Front 39

What are the three supporting pillars of Solvency II?

Back 39

Pillar 1-This pillar covers all the financial requirements and aims to ensure firms are adequately capitalized with risk-based capital. It includes the use of internal models that, subject to stringent standards and prior supervisory approval, enable a firm to calculate its regulatory capital requirements using its own internal modeling.
Pillar 2-This pillar imposes higher standards of risk management and governance within an organization and gives supervisors greater powers to challenge their firms on risk management issues. The ORSA requires a firm to undertake its own forward-looking self-assessment of its risks, corresponding capital requirements, and adequacy of capital resources.
Pillar 3-This pillar aims for greater levels of transparency for supervisors and the public. There is a private annual report by insurers to supervisors and a public solvency and financial condition report that increases the required level of disclosure.

Front 40

Risk-based capital (RBC)

Back 40

Amount of capital an insurer needs to support its operations, given the insurer’s risk characteristics

Front 41

Modeling

Back 41

In data analysis, a system of calculating known outcomes based on current data and then applying these calculations to new data to predict future outcomes.

Front 42

What are the three pillars of the 1999 revised Capital Adequacy Framework?

Back 42

• Minimum capital requirements—refinement of the standardized rules in the 1988 Accord that set out specific weights for different types of credit risk, such as government bonds and mortgages. Basel II offered more sophisticated alternatives for evaluating credit risk, such as evaluations of a borrower’s credit rating. The minimum capital standard, however, remained at 8 percent.
• Supervisory—Review of an institution's internal assessment process and capital adequacy.
• Disclosure—Effective use of disclosure to strengthen market discipline and complement supervisory efforts. The Basel Committee states that "Market discipline imposes strong incentives on banks to conduct their business in a safe, sound and efficient manner, including an incentive to maintain a strong capital base as a cushion against potential future losses arising from risk exposures."

Front 43

What are the goals of Basel III?

Back 43

• Improve the banking sector's ability to absorb shocks arising from financial and economic stress, whatever the source
• Improve risk management and governance
• Strengthen banks’ transparency and disclosures

Front 44

The Basel Committee states that risk management encompasses these processes:

Back 44

The Basel Committee states that risk management encompasses these processes:
• Identifying risks to a bank
• Measuring exposures to those risks where possible
• Ensuring that an effective capital planning and monitoring program is in place
• Monitoring risk exposures and corresponding capital needs on an ongoing basis
• Taking steps to control or mitigate risk exposures, and reporting to senior management and the board on the bank's risk exposures and capital positions.