Accounting Systems

profilese3xy
lecture_06_risk_and_control_analysis_example.doc

Risk Analysis – Risk Matrix

Risk Rating (E, H, M or L) is determined from the combination of Likelihood and Consequence assigned to the risk behind each finding.

1 (Insignificant)

2 (Minor)

3 (Moderate)

4 (Major)

5 (Catastrophic)

5 (Almost Certain)

M

H

H

E

E

4 (Likely)

M

M

H

H

E

3 (Possible)

L

M

H

H

H

2 (Unlikely)

L

L

M

M

H

1 (Rare)

L

L

M

M

M

Legend

E

EXTREME risk – senior or executive management’s immediate attention needed, action plans and management responsibility specified.

H

HIGH risk – senior or executive management’s immediate attention needed, action plans and management responsibility specified.

M

MODERATE risk – manage by specific monitoring or response procedures, with management responsibility specified.

L

LOW risk – manage by routine procedures, unlikely to need specific application of resources.

LIKELIHOOD

CONSEQUENCES

Rating

Descriptor

Description

Rating

Descriptor

Description (examples)

5

Almost certain

Can expect more than one event annually.

Occurs frequently in this industry.

5

Catastrophic

Multiple deaths;

Significant asset/facilities destruction greater than $25m or greater than 6% of operational budget;

National TV news coverage and/or Parliamentary investigation;

Catastrophic, long term environmental harm;

Total cessation of services for more than one week and disruption over subsequent months. Major facility is involved.

4

Likely

Can expect event to occur annually.

4

Major

Single death and/or multiple injuries;

Loss of asset/facilities $10M to $25M or up to 6% of operational budget;

Major state media coverage and/or departmental investigation;

Significant long term environmental harm;

Total cessation of services for up to seven days and subsequent disruption for two/three months.

3

Possible

Can expect event to occur once every three years.

3

Moderate

Individual serious injury;

Loss of asset/facilities $1M to $10M or up to 2% of operational budget;

Regional media story and regional/district enquiry;

Significant release of pollutants with mid-term recovery;

Total cessation of services for up to one day and subsequent disruption for one/two months.

2

Unlikely

Can expect event to occur once every ten years.

Has happened in the industry in Australia.

2

Minor

First Aid;

Loss of asset/facilities $10,000 to $1M or up to 1% of operational budget;

Regional newspaper mention;

Minor/transient environmental harm;

Minor disruption to services for up to one month.

1

Rare

Can expect event to occur only in exceptional circumstances.

Not known to happen in this industry.

1

Insignificant

No injuries;

Loss of asset/facilities up to $10,000 or up to 0.5% of operational budget;

Regional newspaper, not front page;

Brief pollution but no environmental harm;

No disruption to operations.

Academic Activity: 1. Teaching and Learning - Course Design & Implementation

No.

Academic Risk Identification

Analysis

Academic Risk Treatments

Risk No

What can happen

L

C

R

Key controls currently in place

Residual Risks

1

Areas of Risk: Quality of learning facilities and resources

1.1

Unable to attract and retain suitable staff

4

4

H

(a) Strategies to attract and retain quality staff

(b) Academic staff engagement in research/scholarships in their disciplines

(c) Specification in policies on required experience and qualifications, application of policies across departments

(d) Policies to supporting equity and diversity of staff profile

(a) Current economic/RQF environment

Learning facilities inadequate, over-crowded or otherwise inconsistent with student and/or legislative requirements

3

3

H

(a) Design and equipping of teaching spaces e.g. Engaging Learning Spaces Working Party

(b) Provision of resources identified through benchmarking, allocation of resources to priority teaching areas, provision of resources to meet equity obligations

(c) Policies and processes on resource acquisitions, archiving and/or decommissions

(d) Consultation with staff and students on research and teaching needs

(e) Currency and relevance of library collections

(f) Policies and processes on use of the internet

(g) Archiving of course profiles and teaching materials

(h) Disaster recovery plan

(i) Provision of learning technology and network capacity for staff/students

(j) Access to learning resources, compliance with equal opportunity legislation

(k) Physical facilities and time-tabling software

(a) (i) Quality of offshore learning facilities

(ii) Insufficient flexible learning spaces

PAGE

Page 3