Today’s quality auditors need to move from detection to analytical auditing.  Quality auditors need to know how to evaluate internal and external controls that manage enterprise risks that result from changing competitive environments, shifting customer requirements, restructuring for growth, and managing the supply chain.

ERM controls or commonly called internal controls are the now the hallmark of good corporate governance because they offer the following benefits:

• Promote operational efficiency and effectiveness.
• Manage surprises.
• Ensure reliability of financial statements.
• Ensure compliance with regulations and laws.

Quality auditors must be able evaluate the effectiveness of an enterprise risk management consisting of the following eight interrelated components:

• Internal environment.
• Objective setting
• Event identification
• Risk assessment.
• Risk response
• Control activities.
• Information and communication.
• Monitoring.[i]

Internal Environment
The control environment is basically the culture of the organization. The environment establishes the ethic of the organization. Senior management sets the ‘tone at the top,’ which permeates the organization; guides, role models, and reinforces behaviors; and influences the control ethic of all stakeholders. The control environment is the foundation of all elements of the control system

The control environment includes:

• Core values.
• Oversight by the board of directors.
• Credibility of the board of directors and senior management.
• Integrity of the organization.
• Ethical values.
• Senior management’s operating style and philosophy.
• Management deployment of authority and responsibility.

Objective Setting
In quality land, we are very familiar with how quality strategies, plans, tactics, and objectives are deployed down the organization. In much the same way, risk strategies, plans, tactics, and objective are developed and deployed.  Mission critical business objectives have associated risks in terms of not being able to identify, mitigate, and manage these risks.  Risk events are occurrences that can prevent deployment of risk strategies, plan, tactics, and objectives.
Event Identification
The second law of thermodynamics says that entropy, chaos, and risk tend to increase.  This is the natural state of physical systems as well as organizational systems.  Senior management and key process stakeholders must be able to separate the ‘critical few’ variables or events from the ‘insignificant many’ variable event.  The critical few variables are those that that have significant risks.

Events can be identified based on:

• Historical analysis.
• Process analysis.
• Interview with critical stakeholders and subject matter experts
• Upper and lower limit real time triggers.

Risk Assessment
Risk is the key filter for senior management decision-making. An organization faces risk from many sources; from within and outside the organization.  How it identifies, monitors, controls, mitigates, and ultimately manages overall risk determines how successful and profitable it will be.

All organizations have mission-critical strategies, objectives, tactics, and plans, which are deployed down the organization and into the supply chain. One definition of risk is the ability to meet these objectives consistently. In other words, the ability to assess and ultimately manage risks reflects on the ability of an organization to meet its business objectives.

Risk assessment includes:

• Determining critical business objectives.
• Identifying risks that impact the ability to meet objectives.
• Developing a system to manage the risks.
• Developing mechanisms for managing change.

Risk Response
The risk response is based on the likelihood and magnitude of the event.  High dollar, health/safety/environment exposure, or few internal controls require higher levels of assurance and control.  A cost-benefit decision is then made based on these and other criteria to bring risk within the tolerance or acceptance range of the organization.

Risk response usually involves one or a mixture of the following:

• Risk reduction
• Risk sharing
• Risk avoidance
• Risk acceptance

Control Activities
All organizations today face uncertainty and risks.  The solution is to develop internal controls that mitigate uncertainty and manage risk.  These controls are:

“…any action taken by management to enhance the likelihood that established objectives and goals will be achieved. Controls may be preventive (to deter undesirable events from occurring), detective (to detect and correct undesirable events which have occurred), or directive (to cause or encourage a desirable event to occur).”[ii]

Controls activities occur through the organization and into the supply chain. There are basically two types of controls: 1. soft controls and 2. hard controls.  Soft controls deal with the messages and reinforcers that the board of directors and senior management want to communicate. This is sometimes called ‘tone at the top.’ Hard controls include policies, procedures, and work instructions that detail how management directives and work is carried out. These help ensure that the necessary actions are anticipated and taken to address the risks of not meeting an organization’s objectives.

Information and Communication
Reliable data and accurate information are required to control processes and activities. Without them, there is no control. So critical control information must be identified, captured, and communicated to the right parties so it’s relevant for informed decision making and external reporting. The information must also be in a form and timeframe so process owners can meet their responsibilities.

Information should be captured based on critical needs of the organization. Risk points are identified throughout the organizational value chain and externally into the supply chain. Communication is also reported externally to customers, suppliers, regulators, and shareholders. Risk points become organizational points of control. Information from these points, nodes, or areas may be communicated up, across and down the organization.

Monitoring
Once processes are stable, capable, and improving, these processes must be monitored.  Monitoring may mean first party assessments; real time monitoring; second party evaluations such as internal auditing; or third party audits such as by regulatory authorities.

Monitoring ensures critical system, process, and product performance improves over time. Management should Pareto (80 – 20 rule) critical risk-control points within the organization.  The scope and frequency of monitoring depends on the evaluation of the control effectiveness to manage critical risks. Then, control deficiencies are reported to process owners, senior management, or the board of directors depending on the risk, materiality, or exposure to the organization.[iii]