Establish a Firm Risk Management Program
Risk management is critical for all firms, including small- and medium-sized practices (SMPs).
This is both in terms of protecting the assets, finances and operations of the firm and contributing
to satisfactory legal compliance, corporate governance and due diligence. Effective risk
management will protect the reputation, credibility and status of the firm.
It is important to establish a risk management “culture” in the firm. This emphasizes the
importance of managing risk as part of each staff member’s daily activities at all levels of the
firm. The goal of creating a risk management culture is to create a situation where partners and
staff instinctively look for risks and consider their impacts when making effective operational
decisions.
This article is part of a risk management series covering the benefits and steps of establishing
risk management program. The second article will highlight 10 steps for successful risk
management and the third focuses on business continuity planning and risk mitigation strategies.
The articles are a result of discussions at recent IFAC SMP Committee meetings, which involves
practitioners from around the world sharing their perspectives and insights and material included
in the Guide to Practice Management for Small- and Medium-Sized Practices, which includes a
whole module on risk management, including professionalism and ethics, client engagement,
quality control and business continuity planning and disaster recovery.
Implementing a risk management program provides many benefits, including:
• More effective strategic planning;
• Better cost control through enhanced workflows, client evaluation and engagement
processes;
• Increased profitability through better client and job controls;
• Reduced risks of litigation as a consequence of processes and contingency plans;
• Increased knowledge and understanding of exposure to risk;
• A systematic, well-informed and thorough method of decision-making;
• Less disruption and less rework through better understanding of process by all staff in the
firm; and
• Setting the scene for continual improvement within the firm.
Establishing a Risk Management Program
Eight steps to establishing a risk management program are:
1. Implement a Risk Management Framework based on the Risk Policy
When developing the firm’s risk management framework, consideration should be given
to the services offered, marketing and communication, staff and human resources issues,
information and resource management, regulatory obligations, IT issues and security,
succession planning, acceptance and continuance of clients and cash flow management.
2. Establish the Context
Consider the goals and objectives of the firm and the environment in which it operates
(e.g. cultural, legal and operational). Identify internal and external stakeholders (e.g.
clients, personnel, consultants, agents, internal systems, third parties, suppliers, etc.).
3. Identify Risks
Identify existing and potential risks as well as existing controls. The potential risks can be
categorized as services performed, contract risk, acceptance or continuance risk and
performance risk.
4. Analyze and Evaluate Risks
Analyze and evaluate the risks on a continuing basis. This involves a comparison of
exposure levels against a predetermined tolerance level, the degree of control, potential or
actual losses and benefits and opportunities presented by the risk. One of the simplest
models to identify the cost of the controls and their adequacy is to consider the likelihood
of occurrence of an event and the consequences of that event e.g. Risk = Likelihood x
Consequence.
In assessing the level of the risk and identifying high and low risks, the process should
include the firm’s existing and anticipated areas of practice; the composition, experience
and expertise of the firm; the management and internal control procedures; the likelihood
of being sued and the process to assess new and existing clients.
When assessing the kind of risks the firm is exposed to, it is important to consider both
the internal risks and the external risks. Internal risks may include staff, the business
premises and location, threats to goodwill and reputation and information technology.
External risks may include clients and both current and potential competitors.
5. Treat and Manage Risks
Develop strategies to manage the identified risk. Options can include accepting, avoiding,
transfer (in part or full), reducing the likelihood and/or consequence and retaining the
risk. Action plans can be developed based on the current levels of risk exposure, benefits
from actions/ controls, the duration of time to implement actions and the available
budget.
In areas identified as high risk, actions may include reconsidering that area and its
development, retraining staff and reviewing the engagement with clients. Risk
management procedures can include:
Clarity on the terms of the engagement;
Obtaining adequate insurance and controlling claims once they have
occurred;
Maintaining accurate documentation;
Ensuring timeliness of action and diary systems;
Only practicing in those areas where there is sufficient expertise; and
Implementing strict selection criteria for clients and consultants or agents
used.
6. Communicate and Consult
Communicate and consult with all parts of the firm, as well as outside parties, to ensure
that all are kept well informed. For example, to avoid having to assume responsibility for
the client’s risk-taking, advise the client in writing of relevant dates and consequences in
the event of failure by the client to act. This will transfer the risk of noncompliance back
to the client to act and/or follow-up.
7. Monitor and Review
Monitor and review the risk management strategies on an ongoing basis. Over time, new
risks are created, existing risks are increased or decreased, risks no longer exist, the
priority of risk may change or the risk treatment strategies may no longer be effective.
Monitoring should comprise: monitoring existing risks, identifying new risks, identifying
any trouble spots and evaluating the effectiveness of current risk treatment strategies.
Monitoring ensures that new measures are introduced to control new risks as these
emerge. Ongoing review is required to ensure that strategies remain relevant, and that the
overall risk control position is relative to the potential costs of the risk.
8. Record
Keep a written record of all policies and procedures, including documentation of the
assessment process, major risks identified and the measures designed to reduce the
impact of these major risks. Failure to document policies can lead to breaches in
performance due to misunderstanding or misinterpretation. A written set of policy
statements supplied by documented procedures provides a constant reference, a guide to
action and a framework for checking that the operations are conducted in the manner
intended by the firm.
Risk management is a crucial process that encompasses the identification, assessment, and
mitigation of potential risks within an organization. While often associated with large
corporations, risk management is equally important for small- and medium-sized practices
(SMPs). In fact, due to their size and resource limitations, SMPs face unique challenges and
vulnerabilities that necessitate effective risk management. This essay elaborates on the
significance of risk management for SMPs, highlighting its benefits and providing insights into
key strategies and considerations for implementing an effective risk management framework.
1. Understanding Risks for SMPs: SMPs encounter a wide range of risks that can affect
their operations, financial stability, reputation, and client relationships. These risks can
include economic downturns, regulatory compliance, cybersecurity threats, professional
liability, human resource issues, and technological disruptions, among others.
Recognizing and understanding these risks is essential for SMPs to develop tailored risk
management strategies that address their specific needs and circumstances.
2. Benefits of Risk Management for SMPs: Implementing a robust risk management
framework offers several benefits for SMPs:
a) Enhanced Decision-Making: Risk management helps SMPs make informed decisions by
providing a systematic approach to assess potential risks and evaluate their potential impacts.
This enables management to allocate resources effectively, prioritize initiatives, and seize
opportunities.
b) Improved Financial Stability: Effective risk management minimizes the likelihood of
financial losses resulting from unexpected events. By identifying and mitigating potential
financial risks, SMPs can protect their bottom line, safeguard their assets, and ensure long-term
financial stability.
c) Protection of Reputation and Client Relationships: Reputational risks can significantly
impact the success of SMPs. By proactively managing risks associated with service quality,
compliance, and data security, SMPs can protect their reputation, maintain client trust, and foster
long-lasting relationships.
d) Regulatory Compliance: SMPs operate in a complex regulatory environment. A robust risk
management framework helps ensure compliance with applicable laws, regulations, and
professional standards, minimizing the risk of penalties, legal disputes, and reputational damage.
e) Increased Resilience: By identifying and addressing risks in advance, SMPs can enhance
their resilience in the face of unforeseen events. Effective risk management enables SMPs to
respond swiftly and adapt to changing circumstances, mitigating potential disruptions to their
operations.
3. Key Strategies for Implementing Risk Management in SMPs:
a) Risk Assessment: Conduct a comprehensive risk assessment to identify and evaluate potential
risks specific to the SMP's operations and industry. Engage key stakeholders, such as partners,
employees, and clients, to gather insights and diverse perspectives.
b) Risk Mitigation: Develop and implement risk mitigation strategies tailored to the identified
risks. This may include implementing internal controls, adopting cybersecurity measures,
obtaining appropriate insurance coverage, and ensuring compliance with professional standards.
c) Proactive Planning: Create contingency plans and business continuity strategies to address
potential risks and minimize their impact on operations. This involves developing response
procedures, establishing communication channels, and identifying alternative resources and
suppliers.
d) Training and Awareness: Educate employees on risk management principles and provide
training on relevant topics, such as cybersecurity, compliance, and ethical practices. Promote a
risk-aware culture within the SMP to encourage active participation in risk management
initiatives.
e) Monitoring and Review: Regularly monitor identified risks, review the effectiveness of risk
mitigation strategies, and update risk assessments as necessary. Maintain accurate documentation
of risk management activities, including risk registers, incident reports, and lessons learned.
4. Considerations for SMPs:
a) Resource Constraints: SMPs often operate with limited resources. Therefore, it is essential
to prioritize risks based on their potential impact and allocate resources accordingly. Seek cost-
effective solutions, leverage technology, and consider outsourcing certain risk management
functions if necessary.
b) Collaboration and Networking: SMPs can benefit from collaborating with industry
associations, professional networks, and regulatory bodies. These partnerships provide access to
resources, best practices, and industry-specific guidance to enhance risk management
capabilities.
c) Evolving Risks: Keep abreast of emerging risks and changing industry trends. Regularly
assess the external environment and adjust risk management strategies accordingly. Stay
informed about regulatory changes, technological advancements, and emerging threats that may
impact the SMP's risk profile.
Conclusion:
Risk management is crucial for all organizations, including small- and medium-sized practices
(SMPs). By implementing an effective risk management framework, SMPs can protect their
financial stability, reputation, and client relationships. The benefits of risk management include
enhanced decision-making, improved financial stability, compliance with regulatory
requirements, and increased resilience. By following key strategies and considering the unique
challenges faced by SMPs, organizations can successfully manage risks and position themselves
for long-term success in an ever-changing business environment.
