Risk assessment helps identify and document critical business processes and the internal controls within each process. Combined with facilitated management meetings, this approach can help gain company-wide consensus by including key process owners in risk and controls analysis.
Here, we’ll present instructions, a sample risk universe from which management can select the 15 most critical business processes (this can be customized for each business and industry), and a sample risk map explaining the concept of plotting risks according to importance to business/financial performance and likelihood of process/control weakness.
Risk Assessment Instructions
Purpose
This step in a risk assessment is to help identify and document your critical business processes and the internal controls within each process. It will help rank and prioritize processes. Combined with facilitated management meetings, this approach will help you gain company-wide consensus by including key process owners throughout corporate processes.
Objective
The objective of this step is to identify and prioritize those processes most critical to a business. To do this, identify what you feel are the 15 most critical processes to the business and rank them against a pre-defined criteria (see below). Several other management team members will do this as well. Your lists will be combined with your peers to create a company-wide list and ranking for discussion purposes. Within the next two weeks, the internal audit group will facilitate a group meeting to review and discuss the results and gain consensus on a final process list and ranking. Over the coming months, the internal audit group will document the processes and controls for each critical process along with opportunities for control enhancements.
Process Universe
Create a list of the primary business processes of the company. This will be your process universe and will serve as a basis for you to select your 15 critical processes. Below is a starting point for your list.
Risk Maps
To rank the critical processes, rank each by 1) importance to business/financial performance and 2) likelihood of process/control weakness, and document your results in a risk map. A sample risk map and ranking are below.
Action Items (Estimated Completion Time = 30 Minutes)
Process Universe
The following is a sample list of the primary business processes that should be identified for prioritizing risk throughout the organization. (This list can be customized for different business lines and industries.)
Sales & Marketing
Human Resources
Manufacturing
Information Systems
Finance & Accounting
Management & Board
Customer Management
Legal
Corporate Development
Infrastructure & Other
Sample List & Risk Map
The following list contains a sample of 15 critical processes. Each process is mapped by importance to business/financial performance and likelihood of a process/control weakness.
This content was taken from KnowledgeLeader’s Risk Assessment Map and Guide.
KnowledgeLeader also has dozens of risk and control matrices by business process. Each contains an extensive list of possible risks and controls to mitigate those risks.
More resources on risk assessment:
Risk Assessment Survey Template - Sample
Risk Assessment Audit Work Program
Risk Assessment Topic on KnowledgeLeader