Enterprise Risk Management, Internal Audit, and the Other Control Functions in Italian Listed Companies
Total Page:16
File Type:pdf, Size:1020Kb
Department of Business & Management – Chair in Risk Management Enterprise Risk Management, Internal Audit, and the other control functions in Italian listed companies. Supervisor Prof. Vittorio Vecchione Candidate Valeria De Luca 668481 Co-supervisor Prof. Cristiano Cannarsa Academic Year 2015/2016 Enterprise Risk Management, Internal Audit, and the other control functions in Italian listed companies. Valeria De Luca Index Executive summary............................................................................................................................................ 3 1. ERM - research on its level of implementation within Italian entities .......................................................... 8 1.1 Risk ........................................................................................................................................................... 8 1.2 Evolution of risk management................................................................................................................. 9 1.3 Enterprise Risk Management (ERM) ..................................................................................................... 10 1.4 Research to assess the current status of implementation of ERM ....................................................... 13 1.4.1 Research methods .......................................................................................................................... 13 1.4.2 Entities’ sample .............................................................................................................................. 14 1.4.3 Guidelines to develop the research – Data gathering and process description ............................ 17 1.4.4 Research development ................................................................................................................... 18 1.4.5 Comments on the research ............................................................................................................ 26 2. Risk governance – roles involved ................................................................................................................ 35 2.1 Risk governance ..................................................................................................................................... 35 2.2 Main roles & related responsibilities in risk governance ...................................................................... 37 2.3 Three Lines of Defense Model ............................................................................................................... 42 2.3.1 First line of Defense ........................................................................................................................ 44 2.3.2 Second Line of Defense .................................................................................................................. 46 2.3.3 Third Line of Defense ...................................................................................................................... 48 3. Research on the role of Internal Audit in Risk Management & on the coordination of the actors involved in risk governance ............................................................................................................................................ 52 3.1 Independence of the IA function ........................................................................................................... 52 3.2 IA role in risk management.................................................................................................................... 56 3.2.1 IA’s role in risk management – fan of activities.............................................................................. 56 3.2.2 Risk Based Internal Audit ................................................................................................................ 59 3.3 Research on the IA role in risk management ........................................................................................ 64 3.3.1 Introduction .................................................................................................................................... 64 3.3.2 Research development ................................................................................................................... 65 3.3.3 Comments on the research ............................................................................................................ 70 3.4 Coordination between the actors involved in risk governance............................................................. 73 3.5 Research on the coordination between the actors involved in risk governance .................................. 75 3.5.1 Research development ................................................................................................................... 75 3.5.2 Comments on the research ............................................................................................................ 77 Conclusions ...................................................................................................................................................... 79 Appendix .......................................................................................................................................................... 84 References ....................................................................................................................................................... 94 2 Enterprise Risk Management, Internal Audit, and the other control functions in Italian listed companies. Valeria De Luca Executive summary During the last decades, the attention that regulators, entities and stakeholders addressed to risk management changed drastically because of the occurrence of specific events, as financial crises and natural catastrophic events, and because of a new diffuse perception about risk. Indeed, while risk was considered before only as a negative element and the potential positive effects of the upside volatility were not accounted, nowadays entities understand that a risk might represent a resource and an opportunity if well managed. Therefore, even the way in which risks are managed had to change to reflect this different risk perception. Traditional risk management systems were mainly dependent on a historical-data treatment of risk and mainly focused on financial risks (failing to consider the wide range of risk types). Moreover, they were mainly based on a silos-approach in managing risks, and they were not conducting a risk-return analysis able to support decision-making and to ensure the maximization of shareholders’ value. Nowadays, the best practice in risk management is Enterprise Risk Management (ERM). This practice is defined by COSO (2004) as “a process, effected by an entity’s board of directors, management and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives”. Therefore, as emerge by the definition above, this best practice seems to overcome the typical issues of the traditional systems. There is a wide set of guidelines, principles and standards about ERM, and, because of it, it might be believed that this practice is widely implemented by entities. The first chapter of this thesis presents a study on ERM conducted to assess, over a sample of 30 Italian listed companies, if this best practice is actually diffuse or if it remains only a theoretical suggestion. After presenting all the possible methodologies to conduct the analysis, it is described the one chosen. Gathering information directly from the entity through a careful analysis of the Corporate Governance Reports has been considered as the best way to obtain trustful information and to reduce the subjectivity that could otherwise be faced when letting employees discuss and score their risk management system. However, because of this methodology, it has to be kept in mind 3 Enterprise Risk Management, Internal Audit, and the other control functions in Italian listed companies. Valeria De Luca while reading this thesis that any evaluation has been made on the base of what entities declared in their official documents. Each of the three studies conducted in this thesis has used as sample of companies a heterogeneous group of 30 Italian listed companies having different sizes (in terms of market capitalization) and exercising their activities in different sectors. To assess the level of implementation of ERM, a group of key elements of enterprise risk management has been identified in line with COSO’s definition, and a set of scores has been assigned to each of these elements. Whereupon, it has been assessed if and in which measure these elements were declared by entities in their CGRs. Therefore, with the information obtained from the analysis conducted, it has been built a table (table 1.2) containing the partial scores and the sum of the partial scores gathered by each company. The main conclusions obtained by the first study of this thesis are: - Entities seem to understand the relevance of a well implemented ERM, but the majority of them appears more focused on formally comply with the directives rather than on making efforts to actually implement a good risk management system. A formal compliance let arise doubts on the goodness for the entities’ statements implementation. It appears indeed