IFAC - Risk Management & Internal Control

WHAT DO WE MEAN BY RISK MANAGEMENT & INTERNAL CONTROL? Organizations face a wide range of uncertain internal and external factors that may affect achievement of their objectives—whether they are strategic, operational, or financial. The effect of this uncertainty on their objectives can be a positive risk (opportunities) or a negative risk (threats). Risk management focuses on identifying threats and opportunities, while internal control helps counter threats and take advantage of opportunities. WHY ARE RISK MANAGEMENT AND INTERNAL CONTROL IMPORTANT? Proper risk management and internal control assist organizations in making informed decisions about the level of risk that they want to take and implementing the necessary controls to effectively pursue their objectives. Risk management and internal control are therefore important aspects of an organization’s governance, management, and operations. Successful organizations integrate effective governance structures and processes with performance-focused risk management and internal control at every level of an organization and across all operations. However, risk management and internal control are not objectives in themselves. They should always be considered when setting and achieving organizational objectives and creating, enhancing, and protecting stakeholder value. GLOBAL PERSPECTIVES ON RISK MANAGEMENT AND INTERNAL CONTROL The recent financial crises demonstrated quite clearly that, with increasingly globalized economies and markets, a crisis in one nation or region can affect far more than those living and working in the immediate area. National economic, social, and environmental issues need to be considered in a global context, especially issues related to risk. In addition, risk management and internal control need to encompass a wider perspective, since organizations are affected by many variables, often outside their direct control. According to IFAC’s interviews with 25 key business leaders, summarized in Respondents to IFAC’s  [http://www.ifac.org/publications-resources/integrating-business-reportin...%20the%20Business%20Reporting%20Supply%20Chain%3C/em%3E%3C/a%3E,%20recent%20financial%20crises%20have%20exposed%20flawed%20or%20ineffective%20risk%20management%20and%20internal%20control%20practices%E2%80%94especially%20in%20some%20financial%20institutions.%20Many%20organizations%20were%20overly%20focused%20on%20financial%20reporting%20controls,%20and%20did%20not%20fully%20comprehend%20the%20risks%20to%20which%20they%20were%20exposed.%20In%20fact,%20many,%20if%20not%20most,%20of%20the%20risks%20derived%20from%20other%20areas,%20including%20operations%20and%20external%20circumstances.%3C/li%3E%3Cli%3E%3Cspan%20style=] felt that risk management and internal control guidelines should be combined into one set of integrated guidelines, to increase the understanding that they are both integral parts of an effective governance system. [http://www.ifac.org/news-events/ifac-survey-highlights-need-further-inte...%20Survey%20on%20Risk%20Management%20and%20Internal%20Control%E2%80%94Results,%20Analysis,%20and%20Proposed%20Next%20Steps%3C/em%3E%3C/a%3E%3Cspan%20style=] IFAC facilitates a collaborative global dialogue with the issuers of standards, guidance, and frameworks in the area of governance, risk management, and internal control culminating in greater international alignment. THE ROLE OF ACCOUNTANTS AND THE ACCOUNTANCY PROFESSION Evaluating and improving risk management and internal control is among the core competencies of many professional accountants and, within organizations, many are partnering with other functions to design, plan, implement, execute, and monitor. In addition, professional accountants are often responsible for providing objective, accurate, and timely information and analyses to support all of these activities. They can also organize risk management and internal control training sessions and establishing an understandable, common risk and control language that meets professional and technical standards. Professional accountants play a leading role in ensuring that risk management and internal control form an integral part of an organization’s governance system. With an integrated, organization-wide approach, professional accountants can also encourage treating risks in a more holistic, comprehensive way, ensuring that all business decisions are based on proper risk assessment and management that defines the overall effect of uncertainties on the organization’s objectives.