1. © 2007 KPMG, the Malaysian member firm of KPMG International, a Swiss cooperative. All rights reserved. 1 Differing Roles of Internal Auditor and Risk Management in ERM Advisory Lee Min On, Partner 10 April 2007 Lee Min On, Partner 10 April 2007

2. © 2007 KPMG, the Malaysian member firm of KPMG International, a Swiss cooperative. All rights reserved. 2 Overview Risk and risk management defined Responsibility for risk management What internal audit is and role of internal auditor Can the internal auditor take on the role of a risk manager? Questions and comments

3. © 2007 KPMG, the Malaysian member firm of KPMG International, a Swiss cooperative. All rights reserved. 3 Risk “Anything that has the potential to prevent an organisation from achieving its objectives” Risk Risk Management “The identification, measurement & control of risks that impact the assets and earnings or essential services of an organisation” Risk Management “The identification, measurement & control of risks that impact the assets and earnings or essential services of an organisation”

4. © 2007 KPMG, the Malaysian member firm of KPMG International, a Swiss cooperative. All rights reserved. 4 Risk management - paraphrased Paraphrased from ERM integrated framework - COSO Appropriate balance between opportunities for gain while minimizing loss arising from risk identified Achievement of corporate objectives through strategy setting A process effected by the Board

5. © 2007 KPMG, the Malaysian member firm of KPMG International, a Swiss cooperative. All rights reserved. 5 Risk management philosophy Assurance to stakeholders Stakeholders Board Management Employees Risk profile Issues to emerge Current risk profile Action plans Establish structured risk management system Ensure accountability Risk aware culture Risk management -Policy -Philosophy Responsibility for risk management

6. © 2007 KPMG, the Malaysian member firm of KPMG International, a Swiss cooperative. All rights reserved. 6 Internal audit as defined assuranceconsulting Activity that provides independent, objective assurance & consulting services Designed to add value & improve an organization’s operations Helps organization accomplish its objectives by: - bringing a systematic & disciplined approach - to evaluate & improve - effectiveness of risk management, control & governance process International Standards for the Professional Practice of Internal Auditing, IIA

7. © 2007 KPMG, the Malaysian member firm of KPMG International, a Swiss cooperative. All rights reserved. 7 Role of internal auditor Risk management? Control process Governance process Assurance services Consulting services

8. © 2007 KPMG, the Malaysian member firm of KPMG International, a Swiss cooperative. All rights reserved. 8 Involvement of IA in risk management Assurance role: Assurance role: Examining, evaluating, reporting and recommending improvements on: adequacy and effectiveness of Management’s risk processes; and control measures that can be considered by Management to address risks as identified Consulting role: I Consulting role: Identifying, evaluating & implementing risk management methodologies and controls to address those risks

9. © 2007 KPMG, the Malaysian member firm of KPMG International, a Swiss cooperative. All rights reserved. 9 Drawing the “boundary” Assurance role - compliance Consulting role - advisory Risk owner – management of the risk identified (deployment of specific controls to treat the risk) The Great Divide

10. © 2007 KPMG, the Malaysian member firm of KPMG International, a Swiss cooperative. All rights reserved. 10 Drawing the boundary (cont’d) Some pertinent thoughts Does organization size matter? What about cost/benefit consideration? Threat of self review? Role of Risk Officer

11. © 2007 KPMG, the Malaysian member firm of KPMG International, a Swiss cooperative. All rights reserved. 11 In conclusion Ideally, the risk management function should be separate from the internal audit function If internal auditor is roped in for risk management, a clear line has to be drawn between advisory and ownership of risk Avoid self-review threat that mars objectivity! Can the internal auditor take on the role of a risk manager?

12. The information contained herein is of a general nature and is not intended to address the circumstances of any particular individual or entity. Although we endeavour to provide accurate and timely information, there can be no guarantee that such information is accurate as of the date it is received or that it will continue to be accurate in the future. No one should act on such information without appropriate professional advice after a thorough examination of the particular situation. © 2007 KPMG, the Malaysian member firm of KPMG International, a Swiss cooperative. All rights reserved. Presenter’s contact details Lee Min On KPMG +60(3) 20953388 (Ext 8401) minonlee@kpmg.com.my www.kpmg.com.my Presenter’s contact details Lee Min On KPMG +60(3) 20953388 (Ext 8401) minonlee@kpmg.com.my www.kpmg.com.my