Companies are under pressure throughout the world to ensure that their businesses are well controlled so that stakeholders’ interests are safeguarded as much as possible. Audit committees and ethic committees review different aspects of companies’ operations from a semi-independent, or at least objective standpoint. What they tend to lack is a tool that reports to them and to management on the risks facing the business and also the controls that are in place to mitigate those risks. TORRE provides management with the confidence that they are managing the risks, exploiting them where they can, and mitigating them where they need to. UK companies have to state that they have reviewed the controls over their business, that they have done so from a risk management perspective and they have also covered off areas which should not normally result in unforeseen losses but which have the capacity to, eg payroll, accounts payable and other areas that may not come up in an enterprise level risk assessment.

Colleagues get a process of regular risk diagnosis and feedback. They also get a mechanism to understand risk and access the organisation’s database of risks.
Senior management gets a process for regular consideration of the risks to the business and a mechanism to deal with them and track the actions dealing with them.

Click to enlarge

The Audit Committee get to see progress on the treatment of risk and reporting on the state of controls throughout the business. Individual users get comfort on the state of the controls over their bit of the business, they get a reference point to best practice and an input, a say, in how things could be improved. They also get an automatic action plan for areas diagnosed as weak.

The system has four elements:

• Business unit risk feeder and review systems.

• Central database of risks.

• Virtual risk workshops for faster easier risk management process.

• Risk identification, review, allocation and action tracking.

                  
Click to enlarge

Risk identification is facilitated by considering what the organisation is trying to achieve and then thinking about what factors or drivers may impact achievement of those objectives. Once the process is established, you would want to review last quarter's risks - the process is continuous. In a fast-changing world and when you want to launch a discussion of the risk with fellow executives - the process is dynamic. The end process of the module is the input of the risks into CASA for ongoing self assessment to take place.

How does it work?

At business unit level it allows users to...

• Input regular risk diagnosis and indicator feedback.

• Record new risks for central review.

• Access risk workshops.

• Record actions of allocated risk projects.

At risk manager level it allows users to...

•  Review newly recorded risks and incidents.

• Review and set up risk diagnosis feedback.

• Review and set up risk indicator feedback.

• Create and manage the central database of risks.

• Set up and run online risk workshops.

• Allocate risk projects to risk champions.

Overall it...

• Enables risk questionnaires to be automatically produced.

• Focuses on objectives not just risks.

• Allows ongoing risk review.

• Allows risk project creation and allocation.

• Allows historical review.

• Enables the process to be operated and controlled in-house.