Risk Assessment Under COSO: Turning Objectives into Effective Internal Controls
Risk assessment is at the heart of an effective system of internal control.
Under the COSO Internal Control—Integrated Framework, Risk Assessment is one of five integrated components:
Risk Assessment
Control Environment
Control Activities
Information and Communication
Monitoring Activities
The concept sounds straightforward: identify the risks facing the organization and determine how they should be managed.
In practice, however, effective risk assessment requires much more than maintaining an annual list of risks.
COSO expects organizations to establish objectives, identify risks that could prevent those objectives from being achieved, consider fraud, and evaluate significant changes that could affect the system of internal control.
The basic relationship is:
Objective → Risk → Control → Monitoring
If management does not properly identify its risks, it becomes difficult to determine whether the organization has the right internal controls.
Risk Assessment Starts with Objectives
COSO is an objectives-based framework.
Before management can assess risk, it needs to understand what the organization is trying to accomplish.
COSO recognizes objectives within three broad categories:
Operations — effectiveness and efficiency of operations.
Reporting — reliability, timeliness, and transparency of financial and nonfinancial reporting.
Compliance — compliance with applicable laws and regulations.
Once objectives are established, management can ask the critical question:
What could prevent us from achieving this objective?
Those potential events and conditions become the starting point for risk identification.
COSO's Four Risk Assessment Principles
The COSO Framework contains 17 principles, four of which relate specifically to Risk Assessment.
Principle 6 — Specify Suitable Objectives
The organization specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to those objectives.
Vague objectives produce vague risk assessments.
For example, "Improve cybersecurity" is difficult to assess.
A more specific objective might address protecting confidential customer information from unauthorized access and maintaining the availability of critical information systems.
The clearer the objective, the easier it becomes to identify the risks threatening it.
Principle 7 — Identify and Analyze Risk
The organization identifies risks to the achievement of its objectives and analyzes those risks to determine how they should be managed.
Management should consider risks throughout the organization—not simply financial risks.
Examples can include:
Cybersecurity
Fraud
Regulatory compliance
Financial reporting
Third-party vendors
Artificial intelligence
Business continuity
Supply chains
Human resources
Technology
Reputation
Operations
Management then needs to evaluate the significance of those risks.
A common approach considers:
Likelihood × Impact
More sophisticated organizations may also consider factors such as velocity, persistence, interconnectedness, and the effectiveness of existing controls.
The objective is not to create a colorful risk heat map.
The objective is to determine which risks require management attention and what should be done about them.
Principle 8 — Assess Fraud Risk
COSO specifically requires organizations to consider the potential for fraud when assessing risks to achieving objectives.
This deserves separate attention.
Fraud risk is not simply another line on the organization's general risk register.
Management should consider potential:
Fraudulent financial reporting
Misappropriation of assets
Corruption
Conflicts of interest
Vendor fraud
Payroll fraud
Management override
Cyber-enabled fraud
Business Email Compromise
Unauthorized transactions
Management should also consider incentives and pressures, opportunities, attitudes and rationalizations that could contribute to fraudulent activity.
One of the most important issues is management override of controls.
Even a well-designed control system can be defeated when individuals with sufficient authority intentionally circumvent established controls.
Principle 9 — Identify and Analyze Significant Change
Risk assessment cannot be performed once and then placed on a shelf.
Organizations change.
Technology changes.
Regulations change.
People change.
Markets change.
Threats change.
COSO therefore requires organizations to identify and assess changes that could significantly affect the system of internal control.
Examples include:
New technology. Cloud computing, automation and artificial intelligence can create both opportunities and new control risks.
Leadership changes. A new CEO, CFO, CIO, Chief Audit Executive, or other senior executive can significantly change the organization's control environment.
Acquisitions and reorganizations. Existing controls may not operate effectively within a new organizational structure.
New regulations. Regulatory changes may create new compliance obligations.
Economic conditions. Financial pressure can affect both operating risks and fraud risks.
New vendors. Outsourcing a critical process does not outsource management's responsibility for managing the associated risk.
Risk assessment therefore needs to be continuous enough to respond to meaningful change.
Inherent Risk vs. Residual Risk
An effective risk assessment should distinguish between inherent risk and residual risk.
Inherent risk is the level of risk before considering management's controls and other risk responses.
Residual risk is the risk remaining after considering those responses.
This distinction matters.
A high-risk activity may have excellent controls and therefore have an acceptable level of residual risk.
Conversely, a moderate inherent risk with ineffective controls could leave the organization with an unacceptable residual exposure.
Management needs to understand both.
Risk Assessment Should Drive Control Activities
One of the most important COSO relationships is between Risk Assessment and Control Activities.
Controls should exist for a reason.
That reason should be a risk.
A useful sequence is:
Objective → Risk → Risk Response → Control Activity
Consider an objective to ensure that only legitimate vendors receive company payments.
Risks might include fictitious vendors, unauthorized changes to vendor banking information, duplicate payments, employee conflicts of interest, or Business Email Compromise.
Control activities could then include:
Independent vendor setup approval
Segregation of duties
Verification of bank-account changes
Duplicate-payment detection
Conflict-of-interest disclosures
Payment authorization controls
Vendor master-file monitoring
The controls become much easier to justify when they are directly connected to identified risks.
Risk Assessment Is Management's Responsibility
This point is particularly important.
Management owns the organization's system of internal control.
Internal Audit can evaluate the risk assessment process, challenge management's assumptions, provide assurance, and use organizational risks when developing the risk-based audit plan.
But Internal Audit should not become the owner of management's risk assessment.
Management needs to identify and evaluate the risks associated with achieving organizational objectives and establish appropriate responses.
The Board provides oversight.
Internal Audit provides independent assurance.
Those roles should remain distinct.
Common Risk Assessment Failures
Organizations frequently have formal risk assessment processes that look impressive but provide limited management value.
Common weaknesses include:
Risks that are not linked to objectives
Generic risks that could apply to almost any organization
Risk assessments updated only once a year
Failure to separately evaluate fraud risk
Failure to consider significant organizational changes
No distinction between inherent and residual risk
Risk ratings unsupported by defined criteria
Controls that cannot be linked to identified risks
No accountable risk owner
Risks reported to management but not the Board
Risk registers that are maintained but rarely used for decision-making
A risk register is not evidence of effective risk management simply because it exists.
The real question is:
Does management use the risk assessment
to make decisions and improve internal control?
What Should Internal Auditors Look For?
Internal auditors evaluating the COSO Risk Assessment component should go beyond determining whether management has completed a risk assessment.
They should examine whether:
Objectives are sufficiently clear.
Significant risks have been identified.
Risk ratings have reasonable support.
Fraud risk has been separately considered.
Significant changes are incorporated promptly.
Risk responses are appropriate.
Controls address identified risks.
Residual risks are understood and accepted at the appropriate level.
Significant risks are communicated to senior management and the Board.
This moves the audit from reviewing a document to evaluating the quality of the risk-management process.
The Risk Assessment Should Be a Living Process
COSO should not become an annual compliance exercise.
Organizations operate in environments where cybersecurity, artificial intelligence, regulatory requirements, economic conditions, fraud schemes, third-party relationships, and technology can change rapidly.
A risk assessment performed twelve months ago may no longer describe today's risk environment.
Effective organizations continually ask:
What has changed?
What new risks have emerged?
Have existing risks increased or decreased?
Are our controls still appropriate?
Are we accepting more residual risk than management or the Board realizes?
Those questions turn COSO Risk Assessment from documentation into a management tool.
Learn COSO with Corporate Compliance Seminars
Corporate Compliance Seminars provides CPE training designed to help auditors, management, compliance professionals, and risk professionals understand and apply the COSO Internal Control—Integrated Framework.
CCS COSO programs address topics including:
The five COSO components
The 17 COSO principles
Risk assessment
Fraud risk
Entity-level controls
Control activities
Design and operating effectiveness
Internal control deficiencies
Monitoring
SOX compliance
Using COSO in internal auditing
CCS programs include Understanding COSO Framework Compliance, Effective Use of the COSO Framework, and Using the COSO Framework for Compliance and SOX.
The objective is not simply to memorize the COSO Cube or the 17 principles.
The real objective is to understand how to use COSO to build and evaluate an effective system of internal control.
And that begins with a basic question:
What are we trying to accomplish—and what could prevent us from getting there?
That is the foundation of effective risk assessment.
Comments