Tolulope Adigun. CAMS, CRCMP,CISRCP, CC(GRC)P, DCP’s Post

Is compliance really a Risk management function? Compliance is a reactive measure because organizations often need to respond to changes in laws and regulations as they occur. Risk management, on the other hand, is a proactive initiative that helps organizations prepare for and respond to potential risks before they occur. Compliance often requires organizations to follow a "check-the-box" approach to determine whether the business is acting in accordance with the risks. the law Risk management is more strategic and focuses on minimizing the potential damage of a crisis.: Compliance is about ethical business practices and ensuring that an organization does what it is supposed to do, while risk management focuses on minimizing the potential effects of a crisis. There is no doubt that compliance and risk management are closely related. Both processes are an important part of business strategy. However, there are striking differences between them.

Implementing risk management with the COSO Framework involves utilizing its components to identify,assess, and mitigate risks effectively. Here's a breakdown:1.Control Environment: Establish a culture thatemphasizes the importance of risk management andinternal control. This includes setting the tone at the top,defining roles and responsibilities, and promoting ethicalbehavior throughout the organization. 2. Risk Assessment: Identify and prioritize risks that couldaffect the achievement of organizational objectives. Thisinvolves assessing both internal and external factors thatmay impact the organization's ability to succeed.3. Control Activities: Develop and implement controlactivities to mitigate identified risks. These can includepolicies, procedures, and other mechanisms designed toprevent or detect errors and irregularities. 4. Information and Communication: Ensure that relevantinformation is identified, captured, and communicated in atimely manner. This involves establishing effectivechannels of communication both internally and externally,and providing accurate and reliable information to supportdecision-making. 5. Monitoring Activities: Continuously monitor and assessthe effectiveness of internal controls. This includesongoing evaluation of control activities, as well as periodicassessments to identify new risks and ensure thatcontrols remain relevant and up-to-date. By integrating these components into their riskmanagement processes, organizations can enhance theirability to identify and address risks, ultimately improvingtheir overall performance and resilience.

The success of real-time risk management depends on the following: 1. The ability of the risk management personnel to identify early warning signals which could impact the business and scuttle business objectives, by continuously scouring the Internal and external business environment . These early warning signals should not be ignored but should be studied and developed into risk statements. They should also be measurable to enable analysis of trends in the same. These could be prioritized based on how fast and how strongly they could impact business. The popular proverb 'a stitch in time saves nine' is very much applicable to risk management. 2. A regular and transparent system of communication of risk assessment findings to relevant stakeholders and obtaining their feedback. 3. Well defined risk mitigation measures with responsibility and deadlines 4. Regular review and updating of the risks to ensure their relevance, as new risks may emerge and existing risks may evolve. 5. Conducting risk management workshops across the organization at regular intervals to enable employees to understand and apply risk based thinking in their activities. In summary continuous monitoring of risks is key to effective risk management.

I have often been asked on how an organisation can improve it's risk management processes. Here are my three suggestions: 💥   Establish a Risk Management Framework: Developing a formal risk management framework will help ensure that risks are identified, assessed, and managed consistently across the organisation. This framework should outline the company's risk appetite, define roles and responsibilities for risk management, and establish a process for reporting and monitoring risks. 💥  Conduct Regular Risk Assessments: Risk assessments should be conducted on a regular basis to identify new risks, monitor existing risks, and evaluate the effectiveness of risk mitigation strategies. This will help keep risk management up-to-date and enable prompt action when needed. 💥  Implement a Culture of Risk Awareness: Encouraging open communication about risks and fostering a culture of risk awareness can help ensure that everyone in the organisation understands their role in managing risks. Providing training and resources on risk management can also support this effort. By creating a culture where risks are discussed and addressed proactively, organisations can improve their overall risk management capabilities.

I have often been asked on how an organisation can improve it's risk management processes. Here are my three suggestions: 💥   Establish a Risk Management Framework: Developing a formal risk management framework will help ensure that risks are identified, assessed, and managed consistently across the organisation. This framework should outline the company's risk appetite, define roles and responsibilities for risk management, and establish a process for reporting and monitoring risks. 💥  Conduct Regular Risk Assessments: Risk assessments should be conducted on a regular basis to identify new risks, monitor existing risks, and evaluate the effectiveness of risk mitigation strategies. This will help keep risk management up-to-date and enable prompt action when needed. 💥  Implement a Culture of Risk Awareness: Encouraging open communication about risks and fostering a culture of risk awareness can help ensure that everyone in the organisation understands their role in managing risks. Providing training and resources on risk management can also support this effort. By creating a culture where risks are discussed and addressed proactively, organisations can improve their overall risk management capabilities.

The “three lines of defense” in compliance refer to a model that organizations use to manage risk and ensure effective governance: 1. First Line of Defense: Operational Management This line involves the business units or operational management, which own and manage risks. They are responsible for identifying, assessing, controlling, and mitigating risks within their operations on a day- to day basis 2. Second Line of Defense: Risk Management and Compliance Functions This line includes risk management, compliance, and control functions that oversee and monitor the risk management practices of the first line. They provide guidance, develop policies, and ensure that the first line’s risk management practices are effective. 3. Third Line of Defense: Internal Audit The internal audit function provides independent assurance on the effectiveness of governance, risk management, and internal controls. It evaluates the processes of the first and second lines and reports directly to the board or audit committee. Overall, adhering to the three lines of defense model helps organizations maintain a robust control environment, protect against potential risks, and ensure compliance with regulatory and internal standards.

Highlights on how IT governance manages risk effectively: -Establishes a Risk Management Framework: Provides structured policies, procedures, and controls for comprehensive risk management. -Defines Clear Roles and Responsibilities: Ensures shared responsibility for risk management across IT, operations, and leadership. -Implements Continuous Risk Assessment and Monitoring: Encourages ongoing risk evaluations to identify and mitigate emerging threats. -Integrates Risk Management with Business Processes: Aligns risk management with strategic business objectives and operations. -Establishes Strong Internal Controls and Policies: Implements controls like access management, encryption, and incident response to minimize risks. -Facilitates Effective Communication and Reporting: Promotes regular risk reporting to keep stakeholders informed and enable informed decision-making. -Supports Compliance and Regulatory Requirements: Ensures adherence to industry regulations, avoiding penalties and reputational damage. -Promotes a Risk-Aware Culture: Encourages awareness and proactive risk management practices among employees at all levels.

Managing risk in supply chains is more important than ever due to rapid changes and increased use of technology. Streamlining supply chains for efficiency can increase risk, making it crucial for managers to understand risk management basics and practices. The Supply Chain Risk Management Consortium is a helpful resource. Risk management involves identifying, assessing, and classifying risks. This helps managers find key risks, prioritise them, create cost-effective response strategies, and keep plans up to date. Key steps in managing supply chain risk are: 1- Identifying Risks: Brainstorm possible risks and list them. 2-Assessing Risks: Prioritise risks by talking to experts. 3-Developing a Response Plan: Create actions for each risk, assign responsibilities, and secure approval. 4-Executing the Plan: Implement actions, monitor results, update plans, and add new risks as needed. Effective risk management requires understanding the company’s risk tolerance and having a solid plan. Regular reviews and updates help keep the supply chain resilient and adaptable to both threats and opportunities.

Different organizations will have different attitudes to risk. However, risk attitude is the organization’s approach to assess, pursue, retain or avoid risks. Some organizations may be considered to be risk averse, whilst others will be risk aggressive. The attitude of the organization to risk will depend on the attitude of the board, the nature of the sector and the marketplace within which it operates. Risks need to be considered inside the context that gave rise to them. An organization may appear to be risk aggressive about an opportunity the board has decided should not be missed. The particular opportunity needs to have been fully considered for the organization to evaluate that risk correctly. One of the major contributions from successful risk management is to ensure that strategic decisions that appear to be high risk are taken on an informed basis. Improvement in the robustness of decision-making activities is one of the key benefits of risk management. Attitude to risk is a complex subject and is closely related to the risk appetite of the organization, but they are not the same. Risk attitude indicates the way the organization perceives the likelihood and impact of uncertainty (including what it can do about the uncertainty). Risk appetite indicates the amount of risk an organization is willing to seek or accept in pursuit of its long-term objectives. Source: Fundamentals of Risk Management. Understanding, evaluating and implementing effective enterprise risk management. By Paul Hopkin and Clive Thompson. 6th edition

ISO 31000:2018 Risk Management Principles The purpose of risk management is the creation and protection of value. It improves performance, encourages innovation, and supports the achievement of objectives. The principles provide guidance on the characteristics of effective and efficient risk management, communicating its value, and explaining its intention and purpose. The principles are the foundation for managing risk and should be considered when establishing the organization’s risk management framework and processes. These principles should enable an organization to manage the effects of uncertainty on its objectives.