Active Risk and Process Management推荐.pdf

Chapter 8 Active Risk and Process Management onfi rmation. Don’t fi x it if it ain’t broken. Similar sentiments are often stated in business, government, and other institutions. Most defi ciencies need to be fi xed. A necessary control over a C signifi cant process should always work. Alternatively, one single mistake made while repeating the same task over 1,000 times may not be cause for alarm. Therefore, care must be taken when identifying and evaluating the process impact of risks. This requires verifi cation of the control process and validation of the control defi ciency. Subsequently, benefi ts and costs, both fi nancial and reputation, need to be determined: What is the cost of the risk versus the cost of mitigating the risk? Finally, a decision needs to be made: Mitigate or accept the risk? Trust but verify. This is a sentiment voiced by those who work in the risk profession. To complete the cycle and validate that a process functions as it should, management needs to follow up to ensure that the controls are indeed as agreed. If management agrees to accept a risk, then any changes to the risk must be disclosed. Concurrently, if any mitigation actions are being taken, then they must be completed 145 146 w h e r e w e w a n t t o b e and verifi ed as such. Equally important, after all of the actions are taken, management must verify that the risk was defi nitely and fi nally mitigated. Without verifi cation, there is no confi rmation. Without confi rmation, the process may not be valid. Comply with the Law Founded in 1919, Halliburton Company is one of the world’s largest energy services, engineering, and construction corporations. It was in the news a great deal for the fi rst several years of the twenty-