), consideration of prior audits, and interviews with a variety of senior management. Itis designed for identifying audit projects, not to identify, prioritize, and manage risks directly for the enterprise. Current issues in ERMThe risk management processes of corporations worldwide are under increasing regulatory and private scrutiny. Risk is an essential part of any business. Properly managed, it drives growth and opportunity. Executives struggle with business pressures that may be partly or completely beyond their immediate control, such as distressed financial markets; mergers, acquisitions and restructurings; disruptive technologychange; geopolitical instabilities; and the rising price of energy. Sarbanes-Oxley Act requirementsSection 404of the Sarbanes-Oxley Actof 2002 required U.S. publicly traded corporations to utilize a control framework in their internal control assessments. Many opted for the COSOInternal ControlFramework, which includes a risk assessment element. In addition, new guidance issued by the Securities and Exchange Commission(SEC) and PCAOBin 2007 placed increasing scrutiny on top-down risk assessmentand included a specific requirement to perform a fraudrisk assessment.Fraud risk assessments typically involve identifying scenariosof potential (or experienced) fraud, related exposure to the organization, related controls, and anyaction taken as a result. NYSE corporate governance rulesThe New York Stock Exchangerequires the Audit Committees of its listed companies to "discuss policies with respect to risk assessmentand risk management." The related commentary continues: "While it is the job of the CEO and senior management to assess and manage the company’s exposure to risk, the audit committee must discuss guidelines and policies to govern the process by which this is handled. The audit committee should discuss the company’s major financial risk exposures and the steps management has taken to monitor and control such exposures. The audit committee is not required to be the sole body responsible for risk assessment and management, but, as stated above, the committee must discuss guidelines and policies to govern the process by which risk assessment and management is undertaken. Many
companies, particularly financial companies, manage and assess their risk through mechanisms other than the audit committee. The processes these companies have in place should be reviewed in a general manner by the audit committee, but they need not be replaced by the audit committee."ERM and corporate debt ratingsStandard & Poor's (S&P), the debt rating agency, plans to include a series of questions about risk management in its company evaluation process. This will rollout to financial companies in 2007.The results of this inquiry is one of the many factors considered in debt rating, which has a corresponding impact on the interest rates lenders charge companies for loansor bonds.On May 7, 2008, S&P also announced that it would begin including an ERM assessment in its ratings for non-financial companies starting in 2009,with initial comments inits reports during Q4 2008.