Getting the Most Out of ERM

The Committee of Sponsoring Organizations of the Treadway Commission, or more commonly known as COSO, released a report this month on how companies can derive the most benefit from their Enterprise Risk Management (ERM) programs.  Authored by two professors and risk practitioners from DePaul University, the report provides approaches and action steps for companies to follow as they embark on their ERM journey.  Here is a summary list of key activities to bolster the ongoing implementation of an effective ERM program.

1. A program of continuing ERM education for directors and executives


2. ERM education and training for business-unit management


3. Policies and action plans to embed ERM processes into the organization’s functional units such as procurement, IT,or supply chain units


4. Continuing communications across the organization on risk and risk management processes and expectations


5. Development and communication of a risk management philosophy for the organization


6. Identification of targeted benefits to be achieved by the next step of ERM deployment


7. Development of board and corporate policies and practices for ERM


8. Further discussion and articulation of a risk appetite for the organization and /or significant business units, including quantification


9. Establishment of clear linkage between strategic planning and risk management


10. Integration of risk management processes into an organization’s annual planning and budgeting processes


11. Expansion of the risk assessment process to include assessments of both inherent and residual levels of risk


12. Exploration of  the need for a dedicated Chief Risk Officer or ERM functional unit

Wheelhouse Advisors is fully equipped to help companies with activities such as these.  For more information, please visit www.WheelhouseAdvisors.com.

Common Sense Prevails

This week, the Committee of Sponsoring Organizations of the Treadway Commission ("COSO") released its highly anticipated guidance for monitoring internal controls (see graphical overview below).  This guidance will prove very useful in helping companies improve the effectiveness of their internal controls and also increase the efficiency of their internal control evaluation efforts.  Many companies have struggled with their external auditors and regulators to find ways to lower the cost of their evaluation efforts by leveraging activities that are performed in the normal course of business.  This guidance will provide a solid basis for management to utilize in determining the best way to evaluate internal controls.  Here is a sample of activities that are specified within the guidance.

1. Periodic evaluation and testing of controls by internal audit,


2. Continuous monitoring programs built into information systems, 


3. Analysis of, and appropriate follow-up on, operating reports or metrics that might identify anomalies indicative of a control failure,


4. Supervisory reviews of controls, such as reconciliation reviews as a normal part of processing,


5. Self-assessments by boards and management regarding the tone they set in the organization and the effectiveness of their oversight functions,


6. Audit committee inquiries of internal and external auditors, and 


7. Quality assurance reviews of the internal audit department.

Much of the guidance is really common sense applied to an exercise that for years has defied common sense. To learn more about how you can streamline your control evaluation process, visit www.WheelhouseAdvisors.com.