Seminar 3 ERM And Auditing Section B

LECTURE 7: ENTERPRISE-WISE RISK MANAGEMENT (“ERM”) AND AUDITING

by Hamza Benidir (6405151)
Jesse Dunn (6349846)
Brenda Lim (6408283)

Report submitted to Professor Chris Liboiron for the course
Advanced Auditing
(ADM 4341 B)

University of Ottawa
November 4, 2014

TABLE OF CONTENTS
Introduction 3
Content 3
1. Enterprise-Wide Risk Management: A Comprehensive Definition 3
a. What is Enterprise-Wide Risk Management? 3
b. ERM Criteria 4
c. Objectives of ERM 5
2. Practical Application of ERM 6
a. Considerations in Adopting an ERM Framework 6
b. ERM Frameworks: COSO and RIMS 6
c. RIMS 8
d. Standard ERM Process 8
e. Benefits of ERM Systems 9
3. Stakeholders’ Responsibilities with Regards to ERM 9
a. Corporate Governance’s Responsibilities with Regards to ERM 9
b. Management’s Responsibilities with Regards to ERM 11
c. Internal Auditor’s Responsibilities with Regards to ERM 11
d. External Auditor’s Responsibilities with Regards to ERM 12
4. ERM, Now and In the Future 13
a. Current State of ERM 13
b. Future Perspectives on ERM 14
Case 1.11, New Century Financial Corporation 16
1. Case Overview 16
2. The Suspects: Where Did They Fail? 17
3. Recommendations 18
Bibliography 20

INTRODUCTION

The global economic recession of 2008 (or the Great Recession) has mainly been a subject omitted from classroom discussion:

The focus has been on the rulings leading up to (and stemming from) the Sarbanes-Oxley Act of 2002 (“SOX”)
The stories depicted in the First Securities Company of Chicago and Fred Stern & Company, Inc. cases highlighted some of the initial limitations of the Securities Act of 1933 and the Securities Exchange Act of 1934
Enron and WorldCom were among the cases that ultimately prompted federal regulators adopt a sweeping set of new requirements in SOX.

Ironically, SOX was hailed as the most important set of accounting-related policies to be implemented since the Securities Act of 1933 and the Securities Exchange Act of

Bibliography: A company-wide approach, used to identify, assess, manage, and control risks present at all levels of an organization (Caldwell, 2012) ERM may also be described as a risk-based approach to managing an enterprise that integrates strategic planning, operations management, and internal control (Caldwell, 2012). Traditionally, businesses are exposed to similar risks, including credit risk, physical security, loss prevention, fraud prevention, information security, information security, business continuity, safety, compliance and audit (Brandel and Slater, 2013). Transferring risk (by means of insurance policies, for instance); and/or Accepting risk (which differs from ignoring risk, in that the organization acknowledges the presence of the risk) (Brandel and Slater, 2013). 5. Aggregates metrics: an ERM system must aggregate its metrics (Segal, 2011). 6