Accounting: Public Sector Auditing

Assessing Risk What is the significance of assessing risk in the internal control process? Please explain in own words. (See paragraphs below to get an idea and answer the question.)

Assessing Risk

Risk assessment requires an organization to identify and analyze the significant risks inherent in achieving its goals and objectives. Risks may arise both from internal and external sources. Risk assessment goes hand-in-hand with internal control because it influences the nature and extent of the controls and strategies adopted to manage the risks. For example, the trustees of a government pension fund may want to invest in a certain type of security because the potential for income is high. But the potential for loss of principal may also be high. Based on the assessment, the trustees may decide to avoid the risk of loss by not making any investment in that type of security, or they may decide to accept some risk and manage it by limiting the amount that can be invested in that type of security and requiring biweekly reporting of each investments value. Because governments exist to protect the health, safety and welfare of its citizens, some of its activities are subject to significant risk, both internal and external to the agency responsible for administering the function. Identifying the risks and assessing their relative significance helps managers use their limited resources in the most effective manner. Without understanding those risks, there is increased likelihood that management will misallocate resources or fail to meet their objectives. Managers also need to recognize that risks and opportunities are related, because not identifying opportunities to improve operations can affect meeting an entitys objectives as much as failing to identify risks.

To visualize and manage the risks affecting their functions, managers must: Clearly identify their goals and objectives, because the risks that need to be addressed are those affect the efficient and effective accomplishment of goals and objectives. Understand the economic, social, and political environments within which they operate, because significant risks stem from those environments. Recognize that risks result from the choices they make about how they function including their operating decisions and their business practices and systems. Recognize that risks extend to their financial and physical resources, the clients they serve, the people they employ, and the information they use.

The Risk Assessment Process

Risk assessment requires a systematic and disciplined approach. This is not to suggest that managers must use complex mathematical models, although that would certainly be useful in some situations. Rather, managers can apply a qualitative and judgmental yet systematic approach to assessing risk. Further, the actual process for identifying risks may vary. For example, risks can be identified during a strategic planning session, in internal brainstorming conferences specifically devoted to risk identification, or in meetings with other jurisdictions performing similar functions. The catalog of risks may be updated as a result of new regulations issued by a higher-level government or as a result of findings appearing in audit reports or other assessments of the agency. To perform a risk assessment of the identified risks, the manager needs to focus on two things: The likelihood that something will go wrong The impact (expressed in terms of cost or program results) of something going wrong Obviously, if the potential for something going wrong is high and the potential impact is high, you will want to devote a proportionately larger share of your resources to that subject. If the likelihood is low and the impact is negligible, the area warrants a relatively smaller share of resources. Managers need to exercise judgment in reviewing the factors that increase or decrease likelihood and impact, and in knowing what constitutes impact in the public sector.

Managers need to develop a heightened awareness of how the public may perceive spending decisions and service breakdowns. At the same time, a government manager should not manage for the media. One way to help avoid this is to have a systematic process for assessing risk and to document the decisions made. To do this, the manager must clearly define the organizations mission, establish goals and objectives, and list what can go wrong, both from internal and external causes, in meeting its goals and objectives.

Qualitative Approach to Assessing Risk

Management should evaluate each risk they identify in terms of its impact if some negative event were to occur and the likelihood the negative event will occur. Impact is a measure of the magnitude of the effect on an organization and the people it serves if an unfavorable event were to occur. When determining the significance of each risk, management should consider the effect of the risk. The effect is the ultimate harm that may be done or the opportunity that may be lost. Managers should quantify this if possible, or at least state the effect in specific terms to help define the significance of the risk. Likelihood is the probability that an unfavorable event would occur if there were no control activities to prevent or reduce the risk from occurring. Management should estimate the likelihood for each identified risk.

Significance of Judgment in Assessing Risk Assessing risk depends partly on managements experience and judgment. If you assess risks and develop appropriate courses of action, then when negative events occur, you will be able to avoid the reactive, crisis mode in which many managers often find themselves. Judgment is a critical element in defining the likelihood and impact of a negative event. Judgment, however, is an elusive concept. A person with good judgment has the following characteristics: Discernment the ability to grasp and comprehend what is not obvious Reasoning and rationality the skill of distinguishing what is true or appropriate Perception a quick understanding of the issues and the potential implications Penetrating mind a searching mind that goes beyond what is obvious Insight an intuitive understanding of how things work Of course, people may judge things differently. Normally, we defer to the person with more knowledge and experience. Nevertheless, sometimes the knowledge and experience gained can limit a persons ability to see new possibilities.