1. Gambling With or Managing Risks ?
Jim Tholey

2. RISK ASSESSMENT MODEL – 2007
RISKY INC.
RISK ASSESSMENT MODEL – 2007
Risk Factors
Wgt
Fin/ Acct HR
Dept 2
Legal
Compl IT
Purchas-
ing
Admin
Mrktg
Dept B
Dept C PR
Div 1
Sub A
A. Business Environment
1. Management Team
2. Risk Management/Evaluation 3. 4.
B. Financial & Operating Env.
5. Susceptible to misappropriat., fraud, loss
6. Compl./Adequacy of Internal Mgmt Rpt 7. 8. 9. 10 11 12
C. Info Tech Financial Automation
D. Governance, Intrnl Cntrl & Compl
13. Corporate Governance
14. Internal Control Environment
15.
16.
17.
TOTAL – RISK QUANTIFICATION
100
218
163
249
157
166
277
191
145
246
153
174
142
218
186
Impact
Wgt
Fin/ Acct HR
Reg’s
Legal
Compl IT
Purchas-
ing
Admin
Mrktg
Dept B
Dept C PR
Div 1
Sub A
1. Impact
2. Risk
3. Risk –.
TOTAL – IMPACT QUANTIFICATION
100
220
180
300
200
220
260
140
100
240
180
260
180
220
220
Risk Rating: Low (0-130) Medium ( ) High ( )

3. Sample SOX Qualitative Risk Assessment (Heat Map)
Relative weights
15%
10%
20% 5%
100%
ABC Corporation
2007 Business Processes
Complexity/ Volume of Trans-actions
Level of Auto- mation (inverse scoring)
Level of Estimation/ Judgment
Reporting Complexity/ Prior Period Changes
Process Nature/ Inherent Risks
Routine Non-routine
Susceptibility of loss due to errors/ fraud
Related Party Trans- actions
Weighted Average Risk Score
Financial Closing & Reporting
High
Med
Low
Fixed Assets
Purchasing, AP & Disbursements
Treasury/Equity
Revenue, AR & Receipts
Inventory
Record & Monitor Debt
Commitments & Contingencies
Payroll & Benefits
Income Tax
Intangibles and Impairment
Cash Handling
Consolidations
Note: Level of Automation evaluation text relates directly to automation of the process. The risk scoring is inverted (i.e. High = more automation thus less risk, while Low = less automation more risk)

4. Qualitative Assessment of Accounts/Processes
Qualitative Risk Factors (from PCAOB AS2)
Weights
Category 1
Category 2
Category 3
Rate
Score
Estimation 20
Routine/Non-routine 10
Automatic/Manual
Account/Reporting Complexity/Changes from Prior Period
Susceptibility of Loss Due to Errors or Fraud
Complexity/Homogeneity & Volume of Activity
Nature of Accounts (Suspense/Reserve, etc.)
Likelihood of Significant Contingent Liabilities
Existence of Related Party Transactions
TOTAL
100
Risk Factors
are taken directly
from AS2/AS5
Risk Ratings
Rating
No Risk or N/A
Low 1
Medium Low 2
Medium 3
Medium High 4
High 5
Risk Score
Score
Low
0-150
Medium
High

5. Risk & Impact Analysis – Risky Company
HIGH
Information Technology
Supply Chain Management
Finance/Acctg
Compliance
Marketing
Purchasing
BUSINESS UNIT HEAT MAP
MED
Investor Relations
Human Resources
Legal
Administration
RISK
Public Relations
LOW
IMPACT

6. Risk/Impact Corridor – Risky Company
BUSINESS UNIT HEAT MAP
RISK CORRIDOR
Information Technology
HIGH
Supply Chain Mgmt
Finance/Acctg
Compliance
Marketing
Purchasing
Investor Relations
MED
Human Resources
RISK
Legal
Administration
Public Relations
LOW
IMPACT

7. Risk & Impact Analysis – Risky Company
Capacity Planning
Business Continuity Planning
AUDIT
UNIVERSE HEAT MAP
Disaster Recovery
HIGH
Supply Chain
Plant Operations
SOX Compliance
Financial Reporting
Compliance
Revenue Receivables
Cash Receipts
MED
Human Resources
RISK
Marketing
Cash Reimbursements
Accounts Payable
Purchasing
Investments
Public Relations
Legal – Corp Secretary
Physical Security
Fixed Assets
T&E Reporting
Budgeting
LOW
Bank Reconciliations
Facilities
Payroll
Audits are in italics
IMPACT

8. Risk & Impact Corridor – Risky Company
RISK CORRIDOR
Capacity Planning
AUDIT
UNIVERSE HEAT MAP
Business Continuity Planning
HIGH
Disaster Recovery
Plant Operations
Supply Chain
SOX Compliance
Financial Reporting
Compliance
Revenue Receivables
MED
Cash Receipts
RISK
Human Resources
Marketing
Cash Reimbursements
Accounts Payable
Purchasing
Investments
Public Relations
Legal – Corp Secretary
Physical Security
Fixed Assets
T&E Reporting
LOW
Budgeting
Bank Reconciliations
Facilities
Payroll
IMPACT