RISK MANAGEMENT

Risk management response concepts are simple when one understand that they are limited to only four options: internal controls, risk avoidance strategies, risk transfer (risk sharing) strategies and risk acceptance. In selecting risk management responses, a company defaults to risk acceptance when all other risk management strategies are exhausted or no other risk management strategy is employed. ERM guides a company to ensure that risk acceptance aligns with management's risk tolerance, risk appetite, or both. When participants consider control maturity during the risk assessment workshop, the results of the initial risk assessment provide the participants' view of residual risk. However, any risk assessment will not provide comfort over the effectiveness of internal control or other risk management activities apart from some form of independent assurance. Therefore, it makes sense to have some form of residual risk evaluation.