Many if not most of the items on my wish list are aspirational at best. They cover multiple areas, all coming together around my general theme of better run organizations. They include aspects of governance, risk management, internal audit, information, and performance management.
I welcome your thoughts on these – which do you agree with, which do you dislike, and overall how crazy am I?
- A globally-accepted organizational governance code, encompassing both risk management and internal control – although more detailed codes are required for both (see below). We may also need variations for different types of entities: public for-profits, not-for-profits, private companies, governments, etc. When I say ‘globally-accepted’, I mean accepted by the regulators around the world and mandated by them.
- The convergence of the COSO ERM Framework and the global ISO 31000:2009 risk management standard. The overall product (including related guidance) has to:
- Be simple and easy to understand and use
- Provide guidance for the initial implementation of risk management
- Establish a vision for mature risk management
- Help you progress from initial to mature risk management maturity
- Support an evaluation of the effectiveness of risk management
- Guide the embedding of risk management into daily business processes and decision-making, instead of being a separate process (or more realistically set of processes)
- Emphasize the importance of the organizational culture and attitude towards risk and performance (must be both), and provide guidance on how to measure and them improve the culture as needed
- Explain the relationship between risk management and strategy-setting processes
- Explain the relationship between risk management and performance management, including the ability to show risk-adjusted performance measures, forecasts, etc.
- Guide the oversight of risk management by the governing body (usually the board of directors)
- Explain the relationship between the global governance framework (above) and an internal controls framework (see below)
- Address the management of uncertainty with respect to opportunities – the upside of risk
- Address the need for the evaluation of risk to take into account the opportunity for reward. Many if not most decisions are not one-sided: the alternatives offer both upside and downside potential at the same time. For example, (adverse) risks related to a new product need to be considered together with the potential for revenue and profit. Both negative and positive effects have likelihood and impact. The guidance needs to explain how to consider the total picture, not just the downside
- Discuss how different risk processes around the organization are brought together in an enterprise-wide program. Discuss the need for specialized processes for certain risk areas, such as commodity price and currency fluctuation risk, IT vulnerability, etc, where not only specialized knowledge may be required but sophisticated models as well. Explain how to integrate risk assessment and evaluation when some risk areas are measured using likelihood and others using frequency.
- Be accepted globally by all interested parties: enterprise risk management practitioners, insurance and safety managers, auditors and assurance professionals, governance experts and board members, operational managers, etc.
- An update of the COSO Internal Control Framework that recognizes that internal controls are the organization’s response to uncertainty (i.e., risk), and you need the controls to ensure the likelihood and effects of uncertainty are within organizational tolerances.
- Agreement (maybe as part of #2) on the meaning of ‘risk appetite’, ‘risk tolerance’, ‘risk attitude’, ‘risk criteria’, and related terms. All of this as part of guidance that explains how you can set guidance on risk-taking that works not only for (a) the board and top management (who want to set overall limits), but also for (b) the people on the front lines who are the ones actually making decisions, accepting risks, and taking actions to manage the risks. The guidance also has to explain the need to measure and report on whether the actions taken on the front lines aggregate to levels within organizational tolerances.
- A change to the opinion provided by the external auditors, from one focusing on compliance with GAAP to one focusing on whether the financial reports filed with the regulators provide a true and fair view of the results of operations, the condition of the organization, and the outlook for the future. Note that I don’t expect the auditors to have an opinion on the outlook, only that management has followed a reasonable process, including the identification and evaluation of risks.
- The inclusion in the reports filed with the regulators of:
- An opinion by management on the effectiveness of the enterprise-wide risk management program. This could be based on the assessment of the internal audit function.
- An opinion by the board that the compensation consultants (and other experts whose guidance was relied on during the year) are independent and free of inappropriate influence by management.
- An assessment by the chair of the board, on behalf of the full board, of the effectiveness of organizational governance based on the governance code. A periodic independent assessment should be made (either by a third party or by the internal audit function).
- A change in attitude of investor groups, focusing on longer-term value instead of short-term results. In particular, they should be more active when it comes to director and executive compensation.
- The investors being required to approve, at the annual general meeting, the director and executive compensation programs for the next year.
- The SEC withdrawing the proposal to mandate auditor rotation. If the audit committee is effective, this is not required. I believe it will result in an adverse change to the quality of the external audit and the cost to the organization.
- Changes in the IIA’s standards for the professional practice of internal auditing, including:
- A move to a principles-based set of standards, mandating that audit engagements should be prioritized based on the risk to the organization and the value provided by an internal audit project. The mandate to perform audits of specific areas (such as the code of ethics and IT governance) must be removed, replaced by guidance that these areas be given strong consideration in developing the audit plan
- The clarification that assurance is only effectively provided when there is a formal assessment and opinion provided to the stakeholders. The chief internal auditor (CAE) should provide a formal assessment of governance, risk management, and related internal control processes to the board and top management at least once a year
- Consideration of the need to provide timely assurance. The business can no longer afford to wait weeks or months to obtain internal audit’s assessment
- The need to have a more continuous audit risk assessment and planning process than annual. Internal audit should have a program where it is addressing the risk areas of today and the future, not what used to be a risk area
- An improved understanding by the board and top management of the value of internal audit as a provider of assurance relative to governance, risk management, and related internal control processes. Internal audit should not have to step in and perform management functions (such as the identification of duplicate payments or invalid transactions, the audit of contractors, or fraud detection and investigation) to prove its value.
- Finally, while I would like to see the term ‘GRC’ disappear, I am going to be somewhat realistic and only wish for a shared understanding of what it means – and that meaning is the one used by OCEG, summarized as ‘establishing and reliably achieving objectives, considering risk, and remaining in compliance’.
