Improving Risk Management

Previously I have written about management and its risks and how best to categorise it through your business to ensure your risk management system is thorough and relevant to requirements of the business. Risk Management is all about what risks the business owner or management will take into the business, which of these will be insured against, and which risks will be managed or eliminated. Underpinning sound risk management systems is the willingness to embrace a positive and open attitude to asking (or being asked) tough and confronting questions. To assist with this process I have put together some ways you can assess or improve your internal systems.

Management risk is a value add
It is not a separate process – Integrate it into your decision making processes
It is a tool to help implement your business strategies
Ask what you need to get right to successfully manage your business and achieve your goals

Establish your business and personal priorities

Set the risk thresholds for your corporate and operational strategies
Clear priorities mould your organisation’s culture and its attitude towards the business stakeholders
Incorporate measurement of the businesses risk profile at regular Director / Senior Management meetings
Decide you your business risk appetite

Establish the type and level of risk your business will carry
Communicate this to the relevant senior management within the business
Reconsider the Company’s risk appetite in conjunction with changes in the business environment
Ask questions constantly

Probe Company management regarding business performance and management in conjunction with each other
Questioning highlights the desire to be proactive towards risk management
Be open minded when asking questions and receiving the responses
Integration of risk management

High business performance and good risk management to have same emphasis
Consider risk management implications to current and new business activities
Management reports to include risk management report as well as all other activity and performance reports
Use all information sources

Get all levels of the workforce to provide information on potential risks
Talk to external stakeholders such as auditors, financiers, key customers and suppliers
Robust risk assessment can also uncover hidden opportunities to improve your business
Allocation priorities to identified risks

Identify major risks and work on these first (e.g. WHSE&T, excess debt)
Accept that you cannot manage all risks facing the business at one time
Understand the risk management processes for each of the major risks and report regularly
Risk benchmarks and indicators

Use the Company audit reports (internal and / or external reports)
Indicator information come from financial data, customer / supplier communication and scanning the business environment
Align the reporting process to the agreed indicators
Use lead and lag indicators
Use software tools to assist in risk identification, management, reporting and review

Risk management structure

Match the structure to business size and complexity
Appoint one person or small group of people to be responsible for structure, operations, effectiveness, reporting and review
Challenge management, management activities and Director activity
Have a clear agenda and policy for risk management.

Still Using Spreadsheets for Managing Risks? – Switch to Risk Management Software

Managing risk is essential in every organization to accomplish its key objectives effectively. Risk management not only requires a reliable process to capture risks, but also needs a mechanism to document and administer the organization’s response.

An appropriate risk management tool always helps the risk managers to identify, assess, and prioritize the risks which can be prevented. Here, we will discuss about spreadsheets – commonly used risk management tools and their true costs. We will also know about the best tool to replace spreadsheets for effective risk management.

Spreadsheets are commonly used management tools because they are
• Convenient to use: Many people believe that spreadsheets are convenient to collect, code, sort and analyze data. Yes, they are better than paper based management systems, but they are risky.

• Flexible to enter data: With some basic encoding, spreadsheets offer flexible arrangements of rows and columns to enter data. They allow the user to configure and enter information in a way that suits his unique needs. But risk management involves analysis of various factors and a spreadsheet may not be helpful.

• Low cost or free option: Spreadsheets are either available as freeware or at low-cost. That is why organizations use them extensively. But they fail to understand the fact that the true cost of a tool should be defined by the operational costs that affect the business on long-run; not by the initial cost of the tool.

Are they really beneficial?
Many business owners and risk managers today are using spreadsheets as risk management tools unaware of the risks involved (however some are aware). Here are the risks involved:

• Inability to process huge amounts of data: Although spreadsheets are a good solution for small volumes of data, the processing and calculation will become complicated with the continual growth.

• Time consuming: Risk management requires collecting great deal of information, which often results in huge number of spreadsheets interlinked to each other. A little change to the data structure becomes a great task. This makes risk managers spend countless hours validating data, double checking formulas, and updating values, which is as a time-consuming process.

• Complex to find mistakes: It is quite difficult to find mistakes in a spreadsheet with lot of data. It is often time consuming process to find where exactly the mistakes have occurred.

• Limits the depth of risk analysis: With each change made to a spreadsheet, links between the information are lost making it difficult to analyze relationships over time. Without these links, it becomes tough to link risks and their controls. Also they offer limited access to past and current data making it difficult to compare data overtime.

• Intensive labor: The process of risk management involves continuous updating of data and it increases day by day. Updating data and using spreadsheets effectively requires lot of time and effort. So intensive labor with good knowledge of using the shortcuts and formulas is compulsory.

• Lacks security: A user can accidentally or intentionally delete vast amounts of critical information. Spreadsheets are highly vulnerable to virus attacks, hard disk crashes, and other unexpected disasters.

Underlying costs of using spreadsheets
In general, people think that spreadsheets are free, but they never calculate the underlying costs that can impact the business. Following are the true costs of using them.

• Labor costs: As discussed earlier, it takes lot of effort to create, maintain, organize, and report using spreadsheets. However, the fact that these things require labor, which in turn results in huge costs to the company, is often ignored.

• Opportunity costs: Spreadsheets consume lot of your time and effort, which you can productively use for adding value to the organization. Many business owners, in fact, lose many opportunities hanging around with spreadsheets.

• Risk and non-compliance costs: Spreadsheets lack in company wide visibility, accountability, security and control which results in increased costs in terms of failed audits, unforeseen events, increased insurance costs and so on.

• Scalability costs: A small company can manage and use one spreadsheet to track all records. But as the business grows, the effort of maintaining and consolidating these records increases exponentially. At one point this process fails and negatively impacts the business.

• Human error costs: Spreadsheets are vulnerable to manipulation, which can dramatically impact the company. Moreover, with the increasing chances of human errors, it is difficult to consider that the data is valid and reliable. These human errors can cost a lot to the company.

Effective tool to replace spreadsheet – Risk Management Software
After seeing all the risks and costs involved with spreadsheets, one would certainly ask for a better tool to manage risks and here is the solution – the Risk Management Software. It can effectively replace spreadsheets in the risk management process. Following are the benefits of using risk management software.

• Effective control over GRC processes: Risk management software helps in the effective control over the GRC (governance, risk management, and compliance) processes with proper documentation and work flow. They also help managers in risk assessment and analysis, visualization and reporting.

• Data security: User can limit the availability of data by creating passwords. He can also give full access to all the data to a particular group of people within the organization. This feature eliminates the risk of manipulation of data.

• Real time recording: Recording and updating information regarding risks is easy using this software. You need not spend hours to update the data.

• Reliable audits: This software offers full protection to all the data in the system with fully automated backups. This allows auditors to extract robust and reliable audit trails without unnecessary effort and thus it helps them in identification of risks, and creation of risk management strategies.

• Automated risk reporting: It provides the user with clear information on their objectives and risks associated. It also informs about the required actions and scheduled dates to implement them to prevent risks.

• Clear and consistent reports: A unique feature of this software is that it provides clear and consistent reports making it easy for managers to view the risks in real-time.

How to choose effective risk management software
With growing demand of the risk management software, many companies offering this software evolved in the market. Therefore it is important to choose the effective one to reap the maximum benefits. Following are some tips to choose a good one.

• Reputed vendor: A well established and experienced vendor definitely offers standard products as he fully understands risk management standards.

• Maximum features: Before buying the product, make sure that it has all features to help you in managing the risks properly.

• Customer service and tech support: As this product is new for the organization, it is important to choose a company that offers 24/7 tech support and timely customer service. Moreover, as risk environment demands a constant change of compliance, make sure that the vendor is offering regular product updates and maintenance releases.

An upgrade in the existing technology never says that the existing product is of no use, instead offers the user with more useful features. Upgrading to latest tools like risk management software enhances the organization’s capabilities in managing risk.

The Benefits of Choosing a Career in Risk Management

What is risk management:
Risk management is the process of identification, assessment and treatment of risks that seeks to minimise, control and monitor the impact of risk occurrence through the cost effective utilisation of resources.

Where does risk management apply
Risks occur in every walk of life, in every industry and in every service delivery enterprise, both private and public sectors. The severity of risks occurring depends upon many factors. In order to quantify such severities most organisations traditionally employ some sort of risk processes to assess the likelihood of risks occurring and their perceived or calculated impact. This enables risks to be prioritised and resources applied to meet the overall best interests of the organisation and its internal and external stakeholders.

Risks, great and small
In today’s connected and integrated world risks and their impacts can and do translate across international boundaries. No longer are they confined to departments and within individual companies. Economic boundaries and geographical structures are such that companies now need to assess risks in a world where a volcano in Iceland can cause the closure of a manufacturing plant in Japan.

Equally at the individual organisation level the importance of undertaking health and safety risk assessments in order to protect the health, safety and welfare of it’s employees is a legal obligation for many companies. Product manufactures will undertake design risk assessments in order to ensure that the ultimate users are protected from any safety related design hazard.

Local authorities are required to ensure that they provide safe highways and passage for the general public. For example, they will need to assess the amount of sand and grit they will need to ensure they can cope with the pressures of harsh winter weather to protect the individual motorists and the unsuspecting pensioner on an icy pavement.

All of the above and in many more private and public sector industries and services there is the basic requirement for someone or some persons to identify a potential risk, to evaluate the likelihood of the risk occurring and to calculate the impact or consequence of the risk in order to best minimise its impact.

Risk management – does it work?
Armed with the knowledge that risk is everywhere but that there are robust systems and processes to manage them is it safe to say that such systems and processes work?

Certainly there are many examples of where risk management has worked. If the available systems and processes didn’t work then they simply wouldn’t be used. Risk departments and risk mangers would be unlikely to exist and an irresponsible attitude to risk would likely be prevalent.

Risk management however does not work in all cases. It’s impossible not to be tempted to assert that the BP oil well catastrophe in the Gulf of Mexico could have been prevented if the risks had been fully evaluated. Similarly the lack of controls to adherence of risk processes that has resulted in global financial problems has been laid at the doors of some of the worlds largest financial institution and banks.

Another dimension to risk management
With the proliferation of risk management tools, the use of highly complex modelling techniques and experts and specialists in their fields of expertise, why is it that risks of the magnitude and scale noted above, to the trip hazard on the local pavement, to the vulnerability of the child in a local authorities occur?

It is simply that risk management is not just about rules and regulations. Successful risk management needs a culture and a set of values that ensures that it becomes part of an organisations DNA. If corporate culture is perceived as resentful towards those who raise risks then any risk process is useless. People will hope that the problems just go away. The culture must allow for honesty and openness that allows for maximum benefits to arise from the tools and modelling techniques.

Why choose a career in risk management?
Risk managers and people whose job it is to minimise the occurrence of risks are experts in their field. Their value contribution to any organisation is immense. Qualifications in risk management for some specialised industries – for example insurance – is sometimes necessary and will certainly add to an individuals self marketing capability. However a large number of active risk management individuals do not consciously set out on a career path of risk management. They some how stumble in to it. At this point there is a choice. Do you stick with the tools and techniques or do you grasp the risk agenda and take it forward? The emergence of enterprise risk management aligned to systems thinking; the inescapable link between successful risk intelligent organisations and culture; the in depth knowledge of an organisation and its independencies are immeasurable assets in a world where some have developed a low tolerance to risk. A career in risk management can be as dull as it can be exciting. The choice is yours.

But remember, risk is about taking the opportunity to grow, expand and compete more effectively. Without risk, there is no reward – for the organisation or for the individual.

Strengthening the CFO’s Role in Strategic Risk Management

Strengthening the CFO’s role in strategic risk management to lead Capital intensive business in market volatility

Capital Intensive Businesses

Capital-intensive business exists with lower margins. Management is always expecting Return on Capital Employed (ROCE) above the cost of capital. The major businesses are Oil & Gas, Infrastructure, Construction, IT etc.

Market Volatility Challenges

Market volatility, ceaseless pressure on margins and demanding stakeholders increase the difficulties of thriving in an increasingly interconnected, interdependent and unpredictable global economy.

Many organizations have yet to adapt to this new state of the economic landscape. Doing nothing is no longer an option – they need to adjust and take action now.

Many organizations are now transforming their businesses to strengthen their organization to save costs, create more client-centricity, restore stakeholder confidence and/or embed new business models.

For many organizations, long-term success depends on the success of these transformation programs. To make it more challenging, the margin for error continues to be small, and the environment in which transformation needs to happen continues to increase in complexity.

Strategic Risk Management

• It’s a process for identifying, assessing, and managing both internal and external events and risks that could impede the achievement of strategy and strategic objectives.

• The ultimate goal is creating and protecting shareholder and stakeholder value.

• It’s a primary component and necessary foundation of the organization’s overall enterprise risk management process.

• It is a component of Enterprises Risk Management (ERM), it is by definition effected by boards of directors, management, and others.

• It requires a strategic view of risk and consideration of how external and internal events or scenarios will affect the ability of the organization to achieve its objectives.

• It’s a continual process that should be embedded in strategy setting, strategy execution, and strategy management.

Identifying concrete steps for CFOs to increase involvement in risk management for investment decisions

Concrete Steps to Increase the CFO’s Involvement in Risk Management

• Build a tight link between risk management and other Business Process

• Lead a corporate-level discussion of Risk Preference, Focusing on Risk Choice and select optimal mix

• Use Risk Analytics to communicate investment and strategic Decisions

Build a tight link between risk management and other Business Process

• Focus on foresee issues which will emerging in the future instead of current issues.

• On the basis of prioritization a guidelines to be issued for which Business performance metrics would be effected.

• Business Planners conduct adhoc analysis of upside versus risk, focusing most, if not all, of other attention on a single “Center Cut” scenario.

• Highlighting exactly where and how risk will affect the Business Plan

• Incorporating systematic stress testing using macro scenarios which will reflects possible impact on financial planning

• Applying probabilistic “financial at risk” modeling for major investment decision these efforts. (Cash in hand vs cash needs)

Lead a corporate-level discussion of Risk Preference, Focusing on Risk Choice and select optimal mix

• It is critical to have clear answers to the following questions before making decisions:

o What is the company’s competence in the market?

o Are the decision makers familiar with the risks involved including the tail risks and understand their potential impact?

o Is the company capable of surviving extreme events?

• Risk appetite articulates the level of risk a company is prepared to accept to achieve its strategic objectives.

• Risk appetite frameworks help management understand a company’s risk profile, find an optimal balance between risk and return, and nurture a healthy risk culture in the organization. It explains the risk tolerance of the company both qualitatively and quantitatively.

• Qualitative measures specify major business strategies and business goals that set up the direction of the business and outline favourable risks.

• Quantitative measures provide concrete levels of risk tolerance and risk limits, critical in implementing effective risk management.

Use Risk Analytics to communicate investment and strategic Decisions

• CFO plays an important role in financial and strategic aspects of investments and the evaluation of major decision. He leads the discussion and rival proposals and solutions and often hold powerful decision rights.

• Major Projects with value at stake comparable to total risk from current company operations are discussed and decided with qualitative list of major risks.

• The CFO is ensuring by defining right set of core financial and risk analytics to run for each option to ensure this value stake is brought to light and debated.

EXAMINING LEADING PRACTICES APPLICABLE TO CFOS THAT CAN AUGMENT A COMPANY’S FINANCIAL HEALTH

Best Practices applicable for Company’s Financial Health

CFO have several options to compete more effectively in the Risk Management decisions. Improving returns starts with rethinking where to play-and with four strategic steps that many companies often overlook when it comes to improving performance.

Where to play: A more profit-focused portfolio

• The most pressing issue for leadership teams in capital intensive industries is whether to stay in businesses in which margins have been relentlessly driven down. Many companies are choosing to exit low-profit businesses that once were considered to be core. As they rebalance their portfolios, they are migrating up the value-added chain, investing in related sectors where new technologies can provide competitive advantages.

• Profit pool mapping is an important tool for assessing whether and where it makes sense to do business. In heavy industries, management teams often are so focused on volumes and tonnage that they overlook where the biggest profit pools are. By understanding the sources and distribution of profits across their industry, companies can gain an inside edge on improving returns.

• The premium end of the business typically represents a very large proportion of the profit pool. The best opportunities often cluster there for companies competing in capital-intensive industries.

• Picking the right place to play in the value chain is also critical to improving returns-and the most profitable spot varies across industries.

Best Practices applicable for Company’s Financial Health How to win: Four strategic steps to improving returns

1. Improve the cost base and review capex continually –

• In capital-intensive industries where low returns have become endemic, reducing costs and improving capex efficiency are important ways to improve performance – New developing market entrants in capital-intensive industries have built a strong competitive advantage by keeping capex relatively low. By contrast, the focus on cutting costs at many established players means they sometimes lose sight of improving capex. One way to get the balance right: Develop a more disciplined approach to managing capex, and benchmark the company’s performance against the industry’s leaders.

• Cost discipline makes a critical difference. One-time efforts usually fail to deliver savings that stick, as our research shows. One explanation is that in tough times, management teams are quick to cut costs, but when the cycle swings up, they tend to take their eye off cost improvement and focus on growth-related priorities.

• Developing a rigorous approach to cost improvement and nurturing the right capabilities to optimize working capital can help capital-intensive companies outperform.

2. Build the lowest-cost position

• Geography is another key factor for improving returns. Investing in geographies that offer the lowest landed cost position can create a strong competitive advantage. It’s particularly important in asset-heavy industries where the one-time cost of closing and moving businesses is high.

• The best-performing firms revisit their geographic footprint regularly, as cost dynamics are constantly evolving.

• Companies that can choose the lowest-cost geography up front gain a competitive edge. Those in mature industries need to weigh the short-term downside against the longer-term benefits of reducing complexity.

3. Use mergers and acquisitions strategically

• Smart acquisitions can help improve performance significantly, but many companies get off to a bad start by investing at the top of the cycle, when prices are at their peak, simply because that’s when cash is available. Leadership teams that take a strategic, disciplined and long-term approach to M&A instead of a tactical and episodic approach can improve returns significantly.

• Companies that nurture M&A as a core competence derive the greatest value from them. Their leadership teams devote time to developing a structured roadmap of the most attractive potential targets, making it easier to acquire assets when the right opportunity comes along-and to target acquisitions at the bottom of the cycle.

• Companies that are most experienced in M&A build their capabilities over time. They search hard for merger or acquisition candidates that will add to their operating profit and fuel balanced growth. They pursue nearly as many scope deals as scale deals, moving into adjacent markets as well as expanding their share of existing markets. Most importantly, they create Repeatable Models for identifying, evaluating and then closing good deals. What they typically find is that there are plenty of good prospects to be pursued and that the risk involved decreases with experience.

4. Service ace

• For traditional capital-intensive industries, service can be a highly profitable business in its own right, generating better and faster return on investment than new production facilities, large-scale R&D programs or acquisitions.

• Indeed, for many industrial manufacturers, investing in service is the only way to sustainably grow profits in a tough economic environment. Investing in a service business also lowers capital intensity.

• Investing in a world-class service business can become a strategic ace, elevating a company above competitors in an environment where differentiation on products and cost is difficult to achieve. The range of service opportunities, some larger than others, will vary by industry and company. Here again, mapping profit pools can help identify the potential size of service businesses and those with the greatest returns.

o There is no question that companies in capital-intensive industries operate in a difficult environment today. But leadership teams that commit to a bold ambition have opportunities to break away from the pack and achieve double-digit returns significantly above the cost of capital.

Best Practices applicable for Company’s Financial Health-Getting there requires a strategic shift toward a more profit-focused portfolio:

• Find the most attractive profit pools in your businesses.

• Adopt a mindset of continual cost improvement and capex optimization.

• Look for opportunities to drive down the company’s landed cost footprint by investing in the right geographies.

• Develop strong in-house M&A expertise and a structured roadmap of potential deals.

• Invest in related service businesses

Leadership teams that take these steps will not only give returns a powerful boost, they also will help to rebuild competitive advantage and position their companies to win in a changed industrial landscape.

Reengineering Strategies to improve the link Between Risk Management and Business Planning Process

• Business process reengineering is one approach for redesigning the way work is done to better support the organization’s mission and reduce costs.

• Reengineering starts with a high-level assessment of the organization’s mission, strategic goals, and customer needs.

• Within the framework of this basic assessment of mission and goals, reengineering focuses on the organization’s business processes–the steps and procedures that govern how resources are used to create products and services that meet the needs of particular customers or markets.

• Reengineering identifies, analyses, and redesigns an organization’s core business processes with the aim of achieving dramatic improvements in critical performance measures, such as cost, quality, service, and speed.

• Reengineering recognizes that an organization’s business processes are usually fragmented into sub processes and tasks that are carried out by several specialized functional areas within the organization.

• The CFO Act focuses on the need to significantly improve the government’s financial management and reporting practices. Having appropriate financial systems with accurate data is critical to measuring performance and reducing the costs of operations

Management & Decision Support Structure

• Investigate suggestion for reducing costs and to make them practical and acceptable

• Obtain definite prices and costs

• Present recommendation in comprehensive report

People & Organization

• Organize around outcomes and not tasks

• Have those who use the output of the process perform the process

• Built control in process systems

• Treat geographically dispersed resources

Policies & Regulations

• Develop policies and procedures

• Comply with compliances

• Environmental compatibility

Information & Technology

• Information should go along with the process

• Link all activities

• Capture information at source

• Create reports and real time online updates

Frame for Assessing Reengineering

• Assessing the Organisation’s Decision to Pursue Reengineering

• Reassessing of Its Mission and Strategic Goals

• Identifying Performance Problems and Set Improvement Goals

• Engagement in Reengineering

• Assessing the New Process’ Development

• Appropriately Managing of Reengineering Project

• Analysis of the Target Process and Developed with Feasible Alternatives

• Completion of Sound Business Case for Implementing the New Process

• Assessing Project Implementation and Results

• Following a Comprehensive Implementation Plan

• Executives Addressing Change Management Issues

• New Process Achieving the Desired Results

FOCUSING ON RISK PREFERENCE AND CHOICES FOR CFOs CONSIDERATION TO DELIVER ECONOMIC PROFIT DURING TOUGH CONDITIONS

CFOs need to develop a stronger focus on the economic and performance drivers of their business and need to understand how the effective allocation of scarce resource will help them achieve financial objectives. The CFO must build a performance management capability that can:

• Provide visibility and analysis of information to support resource allocation

• Support the decision-making process by providing the right information to the right people at the right time

• Demonstrate the financial impacts of different decisions and scenarios to enable the organization to predict and compare outcomes

• Incentivize executives and managers to make decisions that maximize marginal contribution

• Enable a data-driven view on resource allocations across the entire value chain (to include corporate strategy; sales, marketing and customer service; supply chain manufacturing and production; finance, HR, legal and compliance)

• Identify the most critical decision points that drive economic performance

With a unique perspective across the entire business, CFOs can provide valuable insight into the decisions that create or protect marginal contribution across the value chain. Armed with a detailed understanding of how and where growth in sales leads to growth in profits, they can offer an objective assessment of fixed and variable costs, and then identify how a reduction in costs can maintain revenues while improving profit contribution.

• Establish a clear, forward-looking line of sight on relevant data for critical decision points

Finance must have access to a robust data set, built around the decisions that drive most economic value in the organization, including assessment of opportunity cost. This demands accurate, verifiable underlying data and an understanding of how the data relates to value chain decisions. This will enable the CFO to conduct scenario planning around these different decision points.

• Develop aligned performance management processes that drive rational decisions

Finance must be able to translate insights and understanding into the desired end product – rational decisions that maximize the desired economic return. Aligning traditional resource allocation processes with business objectives helps ensure repeatability and the sustainability of the organization.

• Ensure compliance and make sure that finance’s voice is heard

The CFO and finance function must be positioned appropriately within the organization to be able to influence decision-making and action. Additionally, finance professionals must improve communication and influencing skills to ensure that their voice is heard and their advice is valued and acted upon.

Risk Management in Accounting Firms: Overview of The New Australian Standards

INTRODUCTION

At its most basic level, risk is defined as the probability of not achieving, or reaching, certain outcomes (goals). Risk is measured in terms of the effect that an event will have on the degree of uncertainty of reaching stated objectives. Risk is commonly thought of in this context as a negative connotation: the risk of an adverse event occurring.

This article discusses the risks faced by accounting firms in Australia, and gives an overview of the new risk management standard (APES 325) issued by the professional standards board.

WHAT IS RISK IN ACCOUNTING FIRMS?

In the context of the professional Accounting Firm, risk is not a new concept for practitioners: it has been attached to the profession for as long as accountants have offered services in a commercial setting. However, as the number and size of legal claims against professional public accountants has increased over the years, so too has the issue of risk and risk management also increased in importance.

Risk management is the system by which the firm seeks to manage its over-arching (and sometimes, conflicting) public-interest obligations combined with managing its business objectives. An effective risk management system will facilitate business continuity, enabling quality and ethical services to be supplied and delivered to clients, in conjunction with ensuring that the reputation and credibility of the firm is protected.

WHY IS A STANDARD REQUIRED?

The Accounting Professional & Ethical Standards Board (APESB) recognised that public interest and business risks had not been adequately covered in existing APES standards, notably APES 320 (Quality Control for Firms). In releasing the standard, the APESB replaces and extends the focus of a range of risk management documents issued by the various accounting bodies. Accordingly, APES 325 (Risk Management for Firms) was released, with mandatory status from 1 January, 2013.

The intention of APES 325 is not to impose onerous obligations on accounting firms who are already complying with existing requirements addressing engagement risks. All professional firms are currently required to document and implement quality control policies and procedures in accordance with APES 320/ASQC 1. Effective quality control systems, tailored to the activities of the firm, will already be designed to deal with most risk issues that arise in professional public accounting firm. However, APES 325 does expect firms to consider the broader risks that impact the business generally, particularly its continuity.

THE NEW REQUIREMENTS

The process of risk management in the Professional Accounting Firm requires a consideration of the risks around governance, business continuity, human resources, technology, and business, financial and regulatory environments. While this is a useful list of risks to consider, it will be risks that are relevant to the operations of the practice that should be given closest attention.

Objectives

The ultimate objective for compliance with the Risk Management standard is the creation of an effective Risk Management Framework which allows a firm to meet its overarching public interest obligations as well as its business goals. This framework will consist of policies directed towards risk management, and the procedures necessary to implement and monitor compliance with those policies. It is expected that the bulk of the Firm’s quality control policies and procedures, (developed in accordance with APES 320) will be embedded within the Risk Management Framework, thus facilitating integration of the requirements of this standard and that of APES 320, and ensuring consistency across all the Firm’s policies and procedures.

A critical component of the Risk Management Framework is the consideration and integration of the Firm’s overall strategic and operational policies and practices, which also needs to take account of the Firm’s Risk appetite in undertaking potentially risky activities.

Whilst the standard allows for the vast majority of situations that are likely to be encountered by the accounting firm, the owners should also consider if there are particular activities or circumstances that require the Firm to establish policies and procedures in addition to those required by the Standard to meet the stated aims.

Establishing & Maintaining

Ultimately, it is the partners (or owners) of the Accounting Firm that will bear the ultimate responsibility for the Firm’s Risk Management Framework. So it is this group (or person if solely owned) that must take the lead in establishing and maintaining a Risk Management Framework, as with periodic evaluation of its design and effectiveness.

Often times, the establishment and maintenance of the Risk Management Framework is delegated to a single person (sometimes not an owner), so the Firm must ensure that any Personnel assigned responsibility for establishing and maintaining its Risk Management Framework in accordance with this Standard have the necessary skills, experience, commitment and (especially), authority.

When designing the framework, the firm requires policies and procedures to be developed that identify, assess and manage the key organisational risks being faced. These risks generally fall into 8 areas:

Governance risks and management of the firm;
Business continuity risks (including succession planning, and disaster recovery (non-technology related);
Business operational risks;
Financial risks;
Regulatory change risks;
Technology risks (including disaster recovery);
Human resources; and
Stakeholder risks.

The nature and extent of the policies and procedures developed will depend on various factors such as the size and operating characteristics of the Firm and whether it is part of a Network. In addition, if there are any risks that happen to be specific to a particular firm – caused by its particular operating characteristics – these also need to be identified and catered for. At all times, a Firms public interest obligation must be considered.

A key factor in any risk management process is the leadership of the firm, as it is the example that is set and maintained by the Firms leadership that sets the tone for the rest of the firm. Consequently, adopting a risk-aware culture by a Firm is dependent on the clear, consistent and frequent actions and messages from and to all levels within the Firm. These messages and actions need to constantly emphasise the Firm’s Risk Management policies and procedures.

Monitoring

An essential component of the Risk Management process is monitoring the system, to enable the Firm overall to have reasonable confidence that the system works. The system works when risks are properly identified and either eliminated, managed, or mitigated. Most risks cannot be entirely eliminated, so the focus of the system needs to be on managing risks down (preventing occurrences as far as practicable), or mitigating the risk (handling the event should it occur).

As part of the system, a process needs to be installed that constantly ensures that the Framework is – and will continue to be – relevant, adequate and operating effectively, and that any instances of non-compliance with the Firm’s Risk Management policies and procedures are detected and dealt with. This includes bringing such instances to the attention of the Firm’s leadership who are required to take appropriate corrective action.

The Framework needs regular monitoring (at least annually), and by someone from within the Firm’s leadership (either a person or persons) with sufficient and appropriate experience, authority and responsibility for ensuring that such regular reviews of the Firm’s Risk Management Framework occurs when necessary.

Documentation

A Risk Management system needs to be properly and adequately documented, so that all the necessary requirements can be complied with, and referred to (if necessary). The form and content of the documentation is a matter of judgment, and depends on a number of factors, including: the number of people in the firm; the number of offices the Firm operates, and; the nature and complexity of the Firm’s practice and the services it provides.

Proper and adequate documentation enables the Risk Management policies and procedures to be effectively communicated to the Firm’s personnel. A key message that must be included in all such communications is that each individual in the firm has a personal responsibility for Risk Management and are required to comply with all such policies and procedures. In addition, and in recognition of the importance of obtaining feedback, personnel should be encouraged to communicate their views and concerns on Risk Management matters.

In documenting the risk framework, the Firm needs to include and cover following aspects:

The procedures to be followed for identifying potential Risks;
The Firm’s risk appetite;
The actual identification of risks;
Procedures for assessing and managing, and treating the identified risks;
Documentation processes;
Procedures for dealing with non-compliance with the framework;
Training of Staff in relation to Risk Management; and
Procedures for regular review of the Risk Management Framework.

In alignment with the monitoring of the Risk Management system, all instances of non-compliance with the Firm’s Risk Management policies and procedures detected though its Monitoring process need to be documented, as with the actions taken by the Firm’s leadership in respect of the non-compliance.

Finally, all relevant documentation pertinent to the Risk Management process needs to be retained by the Firm for sufficient time to permit those performing the monitoring process to evaluate compliance with the Risk Management Framework, and also to follow applicable legal or regulatory requirements for record retention.

SUMMARY

Risk is an ever-present and growing component of delivering professional accounting services to clients, and is not confined to taking on client work that can put the firm’s reputation into decline. It is the everyday business conditions and decisions made that can weigh heavily on a firm.

The modern accounting firm is in the unique position of having all the operating risks of a main-stream business, with the addition of those imposed by the various regulators and authorities.

A comprehensive and effective Risk Management Framework will assist owners of firm in identifying deficiencies and blind-spots that can impact a firm, as well as placing a commercial assessment on the probability of an occurrence, and putting in place clear plans on what to do and when.

With more than twenty years in the fields of accounting and finance, sales and marketing, and operational activity, Michael (MK) has an extensive understanding how businesses succeed in a holistic manner.

He is also the Director of Insignia Consulting, accounting and business management consultants. Insignia Consulting has particular expertise, and specialises in The Quality Control Manual for Accounting Firms in Australia, with experience with QA Audits and developing customised manuals for public practice firms.