IAM02 - RISK ASSESSMENT CRITERIA EXAMPLES英文资料.docVIP

About this tool/enabler Objective and benefits This enabler provides examples of likelihood, impact and management and control activity assessment criteria and helps illustrate the format of typical assessment criteria. The examples contained herein can be customized to align with the client’s organization and the engagement objective. These criteria should be used when assessing the client’s current state. How to use this tool/enabler Use the enclosed as templates to help facilitate discussion with the client and provide a basis for customizing client specific assessment criteria. Assessment criteria may need to be defined to assess the impact, likelihood and/or control activities relative to the focus of the engagement. It is important to note that the criteria must be defined and owned by client management; EY facilitates the process. When to use this tool/enabler Diagnose - Understand the current state Document details Last updated: Document version: 08-Feb-09 V1 Risk Terminology Before discussing risk and co-developing assessment criteria with the client, it is important to understand the following terminology: Risk – A risk is any event or circumstance that could affect the achievement of business objectives. Risk is defined in terms of the likelihood of occurrence, and impact in the event that it occurs. Contributing Factors - Contributing factors are the causal drivers of risk that affect either the likelihood of occurrence or the severity of business impact of the event or circumstance. Contributing factors are typically considered as being related to either: People, Process, Technology or External Factors. Risk Management and Control Activities - Risk Management and Control Activities include initiatives, policies, processes and procedures, physical restrictions, guidelines, rules, etc. There are two types of activities: a) preventive - whose purpose it is to prevent, reduce or mitigate risks within the business, area, project