Enterprise Risk Management Best Practices

ANNE M. MARCHETTI has twenty-five years of finance and accounting experience in both private industry and public accounting. She is a Sarbanes-Oxley subject matter expert focused on the design, implementation, analysis, and optimization of internal control systems and corporate governance programs. Ms. Marchetti has worked globally with both public and private entities in most industries as well as organizations of all sizes. She regularly interacts with Big Four, middle market, and local external audit firms as a liaison on behalf of these organizations. She is a member of the AICPA faculty and is the author of Beyond Sarbanes-Oxley Compliance: Effective Enterprise Risk Management and Sarbanes-Oxley Ongoing Compliance Guide, both published by Wiley.

• Preface xiChapter 1: Overview of Enterprise Risk Management 1ERM Introduction 1Guidance:  History and Relationship 3Organization View 5ERM Today 7Increased Pressure to Manage Risk 9Additional evidence 10Perceived Barriers to Risk Management 11Building the Business Case for ERM: Value and Benefi ts 11Keys to Success 13Summary 15Notes 16Chapter 2: Corporate Governance and Roles and Responsibilities 17Board Behavior 18Corporate Culture 19Roles and Responsibilities 20Summary 23Chapter 3: ERM Defined 25Definitions and Concepts 28Risk Categories 30Internal Environment 31Summary 34note 34Chapter 4: The ERM Process Step by Step 35Step 1 Strategy and Objective Definition 36Step 2 Event Identification 38Step 3 Risk Assessment 40Step 4 Risk Response 41Step 5 Communication 45Step 6 Monitoring 46Oversight 47Summary 47Notes 48Chapter 5: COSO Framework and Financial Controls 49Focus on Financial Controls 49Control Environment 52Integrity and Ethical Values 53Board of Directors 55Management’s Philosophy and Operating Style 57Organizational Structure 57Financial Reporting Competencies 58Authority and Responsibility 59Human Resources 60Summary 61Notes 62Appendix 5A: Excerpt from a Code of Ethics Policy 63Our Guiding Principles and Values 64Conflicts of Interest 64Confidential Information; Intellectual Property 65Appendix 5B: Whistleblower Program 67Reports Regarding Accounting Matters 67Investigation of Suspected Violations 68Discipline for Violations 68Appendix 5C: Approval Policy and Procedures 69Policy 69Purpose 69Scope 69Approvals/Documentation 70Chapter 6: Financial Controls and Risk Assessment 74Risk Assessment 74Financial Reporting Objectives 75Financial Reporting Risks 76Fraud Risk 77Entity-Level Controls 83Example: Risk Assessment and Financial Controls 84Evaluating Deficiencies 86Summary 87Notes 87Appendix 6A: Entity-Level Control Assessment 88Control Assessment Overview 88Control Environment 90Overall Evaluation of Control Environment 95Risk Assessment 96Overall Evaluation of Risk Assessment 98Control Activities 99Overall Evaluation of Control Activities 100Information and Communication 101Overall Evaluation of Information and Communication 104Monitoring 105Overall Evaluation of Monitoring 108Summary Assessment 109Overall Assessment of Internal Controls 110Appendix 6B: Accounts Payable Preliminary ControlsAssessment Questionnaire 111Purchasing Controls Questionnaire 111Internal Control Assessment 112Appendix 6C: Fraud Risk Factors: AU Section 316 114Risk Factors Relating to Misstatements Arising from FraudulentFinancial Reporting 114Chapter 7: Ongoing Compliance Overview 120Origin of the Sarbanes-Oxley Act 120Generating Value from Compliance 121Moving Beyond Initial Compliance 123Reevaluating the Compliance Program 125Summary 131Chapter 8: Ongoing Compliance Challenges 132Future State Opportunity: Compliance Optimization 133Issues to Consider When Optimizing Compliance 136Ongoing Compliance Plan 138Role of Internal Audit: Balancing the Compliance andAudit Functions 143Evolving Role of the Audit Committee 145Summary 148Chapter 9: Addressing Compliance and Risk ManagementChallenges through Automation 149Software Can Add Value Beyond Compliance 151Monitoring Software 152Utilization of Continuous Monitoring: Control Testing and ControlAutomation 153Benefits of Continuous Monitoring 154Continuous Monitoring Tool Considerations 155Continuous Monitoring Process 155Risk Management Software 157Unifying Financial Statements, Close Tasks, and SOX Controls 159Determining the Right Solution 159Summary 161Note 161Chapter 10: Ongoing Compliance and IFRS 162International Financial Reporting Standards 162Communicating the Impact 164Preparing for IFRS 166Comprehensive IFRS Transition Approach 167Key Elements of an Effective IFRS Implementation 170Summary 172About the Author 173Index 175