1. Chapter5 Risk attitudes and internal environment
ACCA P1

2. Key terms about risk
Risk appetite: the nature and strength of risks that an organization is prepared to bear.
Risk-averse and risk-seeking(two extremes)
Risk appetite and internal environment
Risk attitude: the directors’ views on the level of risk that they consider desirable.
Risk capacity: the nature and strength of risks that an organization is able to bear.

3. Risk appetite-influencing factors
Personal views(leader of an organization)
Shareholder’s demand(return)
Organizational influences
Size of the organization
Structure
Attitudes to risk
National culture

4. Risk and stakeholders
Shareholders: their preference on steady dividends(short-term), or long-term capital gains.
Debt providers and creditors: return the money on time
Employees: their job prospects, job and well-being
Customers and suppliers: long-term relationship
Wider community

5. Internal control environment
The overall attitude, awareness and actions of directors and management regarding internal controls and their importance in the entity. The internal environment encompasses the management style and corporate culture and values shared by all employees. It provides the background against which the various other controls are operated.
An effective control environment can make a big contribution to the quality of financial reporting.
Risk awareness is very critical.

6. Risk awareness
The ability of an individual to recognize and measure the risk associated with something. (June, 2014, 2(a))
Risk awareness should be embedded within an organization’s processes, environment, culture, structure and systems.
Risk awareness should be taken for granted at all levels of the organization, and should be the foundation of all control systems.
Elements of a consistent embedded approach identified by Ernst and Young.

7. Dec, 2009, 4
(a) Describe what ‘embedding’ risk means with reference to Saltoc company. (6 marks)

8. Dec, 2009, 4
Embedding risk
Good IC start with a full risk assessment and this control should be introduced and amended to respond to changes in the risk profile as appropriate on an ongoing basis. To have risk awareness and risk systems embedded implies a number of things. It means that RM is included within the control systems of an organization. （对IC非常重要）
When embedded, risk is interconnected with other systems so that risks must be taken into account before other ICs will work effectively.（与其他系统相关）
In an embedded risk system, risk is not seen as a separate part of IC but is ‘woven in’ to other ICs and is a part of the organization’s culture. This is a part of the taken-for- grantedness of embedded risk systems when woven into culture.（是企业文化的一部分）

9. Dec, 2009, 4
Finally, the management of risk is ‘normal’ behavior at all levels. Behavior concerned with risk management is never seen as ‘odd’ or ‘interfering’ bit as much a part of the normal business activity as trading and adding shareholder value.（已经成为企业的日常行为）

10. Dec, 2010, 4
(b) Define ‘risk embeddedness’ and explain the methods by which risk awareness and management can be embedded in organizations.

11. Culture and risk culture
Culture is the pattern of basic assumptions that a given group has invented, discovered, or developed, in learning to cope with its problems of external adaptation and internal integration, and that have worked well enough to be considered valid, to be taught to new members as the correct way to perceive, think and feel in relation to these problems.
Risk culture: cope with risks

12. Risk culture- about strategy
Defenders(防御型)
- Liking low risks, secure markets, and tried and trusted solutions.
- Doing things right
Prospectors(探索型)
- Focus on results, prospecting risks
- Doing the right things
Analyzers(分析型)
- Balancing risk and profits, following change

13. Types of culture-Deal and Kennedy
Criteria: the risks employees need to take & and how quickly the employees get feedback
Process culture (程序型)
- Low risk and little or no feedback
- Bureaucratic but producing consistent results
Work hard, play hard culture(努力工作，尽情享乐型)
- Few risks with rapid feedback
- Typically in large organization

14. Types of culture-Deal and Kennedy
Bet your company culture (赌一把型)
- High risk and slow feedback
- involving development or exploration projects
Tough-guy macho culture(硬汉型)
- High risks and quick feedback
- A very stressful culture like fast-moving financial activities

15. Changing the risk culture
The strength of the control environment and the commitment of top management.
Embedding risk awareness and effective communication
Necessary training and involving in the RM process.
Performance appraisal and measurement
Changing the existing risk attitudes
Communication and dialogue, job satisfaction, learning experiences, key personnel, infrastructure.

16. Risk management responsibility
Everyone in the company has responsibilities of risk management.
The board: determining RM strategy, monitoring risk, setting policies on IC, seeking assurance for the effectiveness, communicating with employees.
The chief executive: considering risk and control environment, promoting good culture, monitoring other senior management.
Risk committee

17. RM responsibility-risk committee
It is a separate board committee, and sometimes the audit committee shoulder its responsibility.
Differences between RC and AC
It can be staffed by Eds
Having a wider remit
Taking the lead in promoting awareness and driving changes in practice
Can carry out special investigations.
It deals with significant financial market risk.

18. RM responsibility-risk committee
Approving the organization’s RM strategy and policy.
Reviewing reports on key risks
Monitoring over exposure to risks
Assessing the effectiveness of the RM systems
Providing early warning to the board
Reviewing the company’s statement on IC, in conjunction with the audit committee.
Dec, 2008, 2, (a) Describe the typical roles of a risk management committee. (6 marks)

19. Risk management responsibility
Internal and external audit- chapter 8
Line managers: identifying and evaluating risk, designing and operating an appropriate system of IC, having a awareness of the risks, communicating RM policies to staff, carrying out detailed RM functions.
Staff: following RM procedures

20. Special RM personnel- risk manager
Providing the overall leadership, vision and direction of ERM.
Establishing an integrated RM framework.
Promoting an ERM competence throughout the entity.
Developing RM policies.
Establishing a common RM language.
Implementing a set of risk indicators and reports.
Dealing with insurance companies.
Allocating economic capital to business activities based on risks.
Reporting to the CEO on progress and recommending action as needed.
Jun, 2009, 4, (a) Describe the roles of a risk manager

21. Special RM personnel- RM department
Setting policy and strategy for RM
Primary champion of RM at a strategic and operational level
Building a risk aware culture within the organization
Establishing internal risk policy and structures
Designing and reviewing processes for RM
Coordinating the various functional activities
Developing risk response processes
Preparing reports on risks for the board and stakeholders

22. Objective and objective setting
Types of objectives
Mission-general, visionary, unwritten, and open-ended
Corporate objectives-entity level, explicit, quantifiable and capable of being achieved
Subsidiary objectives-lower level
The objective-setting could be supported by environmental analysis: simplicity/complexity & stability/dynamism
Levels of strategy: corporate, business, operational
Well-defined objectives and strategies are important to ERM.
Risk appetite and risk tolerance should be considered.