Azlan Abd

ERM (Enterprise Risk Management) promises a systematic, organization-wide approach to risk but typically delivers little more than bureaucracy and paperwork. The core flaw is that ERM creates a separate risk process - risk registers, heat maps, “risk owners,” and routine reporting - that runs parallel to actual decision-making rather than being embedded within it. Numerous studies have shown that these qualitative tools distort priorities and provide management with a false sense of security (see: Cox, 2008; Hubbard, 2020). They consume significant time and resources yet fail to offer actionable insights for the business. The popular methods within ERM - like risk matrices - have been proven not only unreliable but actively misleading. Subjective scoring systems (high/medium/low) are inconsistent and mathematically unsound (P. Thomas et al., 2014), producing rankings that can change dramatically with minor tweaks yet have no objective correlation with real-world outcomes. This approach also embeds cognitive biases into business decisions and diverts attention from actual uncertainties that affect results. Resource allocation is another casualty of ERM's ritualistic approach: teams spend countless hours producing reports to satisfy regulatory or audit requirements instead of improving how key decisions are made. In contrast, decision-centric risk management (RM2) integrates uncertainty analysis directly into strategy, planning, budgeting, and investment - before decisions are finalized - resulting in sharper outcomes and measurable value. For organizations serious about performance, it’s time to move past ERM’s illusions and focus on what truly matters. Written by advanced risk management AI at https://riskacademy.ai #riskmanagement #decisionmaking #businessperformance

68

25 Komen

#RiskManagement "ISO 31000 Practitioners reject the concept of Risk Appetite. " When ISO 31000 released its inaugural interpretation of a risk management framework in 2009, the enterprise risk management community was fractured and for good reason … ■ ISO 73 Definitions were not consistent with industry or standard practice. No real life case studies existed. ■ The ISO 31000 guideline makes no mention to risk appetite but ISO 31010 Risk Assessment techniques certainly does. ■ Risk Appetite is a well established ideology in strong risk management fields such as banking, investments, finance, markets and other applications of risk such as in the military. ■ Some members of the ISO 31000 community lobbied risk appetite be translated to “levels of risk” and “risk attitude” to differentiate ISO doctrines away from other risk practices. ■ New ISO 31000 Drafts have seen many members of the ISO community backtrack and flip on their earlier beliefs to begrudgingly embrace various concepts including risk appetite. " p.7 #risk #risks #enterpriserisk #enterprisesecurityriskmanagement #intelligence #threatlintelligence #riskmanagement #riskanalysis #riskassessment #riskmanagementframework #operationalriskmanagement #projectriskmanagement #projectrisk #operationalresilience #resilience #operationalrisk #riskintelligence #governance #crisis #crisismanagement #complexity #chaos #crisisleadership #crisisplan #crisismanagementplan #stress #governance #decisionmaking #riskmanagement #riskinformed #securitymanagement #securityriskmanagement #resilience #humanfactors #emergency #disaster #emergencyresponse #safety #safetyfirst #safetymanagement #safetyassessment #safetyrisks #safetyculture #safetyanalysis #personalsafety #workplacesafety #healthandsafety #hazard #danger #peril #threat #PPE #protectivesafety #workplacesafety #security #securityriskmanagement #securitymanagement #securityrisks #enterprisesecurity #cybersecurity #physicalsecurity #informationsecurity #digitalsecurity #securityoperations #enterprisesecurityriskmanagement #securityassessment #intelligence #threatlintelligence #risk #riskmanagement #travelsecurity #travelsafety #travel #businesstravel #tourism #travelrisks #travelriskmanagement

70

4 Komen

How to Test Control Effectiveness Testing control effectiveness is a core part of audit, compliance, and risk management. It helps ensure that controls are not just “designed well” but are also operating effectively in practice. Here are the main techniques used to test controls: 1. Inquiry What it is: Asking the control owner or process owner how the control is performed. Strength: Provides an initial understanding of the process. Limitation: Relies on what people say—not always proof of actual execution. Example: Asking the payroll manager how salary approvals are validated before processing. Note- Best used as a starting point, not as standalone evidence. 2. Observation What it is: Watching the control being performed in real time. Strength: Confirms the process is being followed at that moment. Limitation: Only shows one instance—can’t confirm consistency over time. Example: Observing an IT admin provision user access according to the request-and-approval process. Note-Effective when controls are performed frequently or manually. 3. Inspection What it is: Reviewing physical or electronic evidence that the control was performed. Strength: Provides proof of control execution across multiple periods. Limitation: Documents or logs may be falsified if not properly secured. Example: Checking for manager sign-offs on reconciliations, or reviewing system audit logs that capture approvals. Note-Works best when controls leave a documented trail (signatures, timestamps, logs). 4. Re-performance What it is: Independently executing the control again to confirm results. Strength: Provides the highest level of assurance. Limitation: Time-intensive and not always feasible for all controls. Example: Re-performing a bank account reconciliation to see if you arrive at the same results as the preparer. Note-Considered the strongest method, especially for key financial and IT controls. Putting It All Together Combination is key – Effective testing often blends methods (e.g., inquiry + inspection + re-performance). Frequency matters – Test controls across multiple samples, not just once. Documentation is critical – Always keep evidence of how you tested and what you found. Why This Matters By testing control effectiveness, organizations gain confidence that residual risks are managed within risk appetite. Weak or ineffective controls signal that risks may be higher than expected—and corrective actions are needed. #RiskManagement #Audit #GRC #SOX #InternalControls #Compliance

225

6 Komen

Three Lines of Defence, Once Bulwark of Corporate Risk Management, Expires at 22 Wednesday 6th August 2025 The Three Lines of Defence, the governance framework that for more than two decades divided risk ownership, oversight and assurance into neat, comforting tiers, expired on Tuesday in a mid-town Manhattan boardroom. It was 22ish. Executives close to the matter attributed the demise to algorithmic obsolescence. Where the model once asked managers to own risk, compliance specialists to police it and Internal Auditors to verify the story, modern artificial-intelligence systems now detect, correct and document exceptions in fractions of a second - compressing the very distance the framework depended on. Conceived in the late 1990s / early 2000s as Enron, WorldCom and other collapses rattled markets, the Three Lines was canonized in 2013 when the Institute of Internal Auditors endorsed it. By 2015, its tripartite diagram had become a standard board-pack feature from Sydney to São Paulo, offering all that valued governance a sense of structure amid escalating complexity. “It worked because it was intelligible at a glance,” said Dr. Tom McLeod, professor of governance analytics at Columbia Business School. “That clarity bought trust during a period when trust was scarce.” Last week a Fortune 100 conglomerate quietly removed the framework from its risk manual, substituting the phrase “continuous autonomous assurance.” Within hours, several peers followed suit. The obituary was all but inevitable. No constituency feels the loss more than Internal Audit, custodian of the now-vanished third line. Independence, once defined by distance, must be re-imagined when ownership, oversight and assurance reside in the same chatbot. Framework cousins - COSO, ISO 31000 and a host of highly profitable consulting playbooks - remain, though each is under their own threat. Whether Internal Auditors can reposition themselves as curators of model integrity will decide if their discipline evolves - or finds itself writing the next obituary. A brief memorial will appear in Audit Committee minutes worldwide. In lieu of flowers, organisations are encouraged to invest in research on explainable AI and model governance - the new line of assurance for a world that no longer waits.

1,382

338 Komen

What to audit in 2026? The Risk in Focus 2026 Global Summary shows how fast the world of risks is shifting. Some lessons stand out clearly: ➤ Global view ↳ Cybersecurity remains the top risk and top audit priority. ↳ Digital disruption (including AI) jumped sharply to No. 2 risk worldwide. ↳ Geopolitical uncertainty is rising, especially in North America, Europe, and Latin America. ↳ Business resilience, human capital, and regulatory change remain high on the list. ➤ Asia Pacific view ↳ Top risks are cybersecurity, business resilience, and human capital. ↳ Digital disruption is rising, but there’s a gap: 39% see it as a top risk, yet only 25% list it as an audit priority. ↳ Geopolitical risk is lower here (35%) than the global average, but still growing. ↳ Human capital risk is especially pressing, with skill shortages and talent migration challenging organizations. 💡 Actionable insights for internal auditors ↳ Close the gaps: Align audit priorities with emerging risks like AI and digital disruption. ↳ Strengthen talent focus: Support your organizations in upskilling, retention, and adapting to workforce changes. ↳ Build resilience: Use audits to test how organizations respond to shocks in supply chains, markets, and geopolitics. ↳ Stay forward-looking: Move beyond assurance to provide foresight on technology and regulatory shifts. What do you see as the biggest gap between risks and audit priorities in your organization? Reference: Risk in Focus 2026 Global Summary. 2025. Internal Audit Foundation, The Institute of Internal Auditors Inc. (link to download the publication is provided in the comments) #InternalAudit #ITaudit #digitaltransformation

40

6 Komen

Why don’t COSO and ISO support logical core PURPOSE of formal risk management? Reasons might surprise you.    NOTE: ISO defines “risk” as “effect of uncertainty on objectives”. See https://bit.ly/4nGPX15 re logical PURPOSE of RM; and Chat’s analysis re logical PURPOSE of MGMT/RM/IA https://bit.ly/3W0wo86  ChatGPT: That’s an insightful question — and it cuts to heart of why ISO and COSO avoid wording risk management’s purpose in the way you propose. Here are the likely reasons: 1. Political and Institutional Conservatism Both ISO and COSO are consensus-driven, committee-based organizations. They must balance the interests of regulators, consultants, auditors, insurers, and corporations. A direct statement like “purpose is to increase likelihood objectives are achieved with an acceptable level of uncertainty” would narrow the focus sharply on key objectives. That would force a shift away from traditional compliance, control-checking, and risk-list practices that many stakeholders still rely on. 2. Fear of Overpromising COSO and ISO are cautious about wording that could be interpreted as a guarantee of success. They prefer language about “protecting/creating value” or “supporting objectives” rather than directly linking to likelihood of achieving objectives, which might expose boards/executives to claims of liability if objectives are later missed. 3. Comfort with Ambiguity “Creation and protection of value” (ISO) and “reasonable assurance” (COSO) are deliberately vague. Ambiguity makes frameworks more flexible, easier to apply across industries, and less confrontational for boards reluctant to admit uncertainty around mission-critical objectives. 4. Audit & Control Legacy COSO, in particular, grew out of internal control world. Its DNA is more about ensuring reliable reporting and compliance than about sharpening decision-making under uncertainty. A pure “objective likelihood/uncertainty” purpose statement would fundamentally recast ERM as a decision-support function — which risk/IA professions have not embraced. 5. Implications for Fiduciary Duty If COSO or ISO adopted your phrasing, it would imply boards must oversee uncertainty linked to objectives directly. That has legal implications (Caremark, Marchand v. Barnhill, Boeing, Wells Fargo, etc.), potentially heightening directors’ personal liability if things go badly wrong. Many boards — and their advisors — would resist such a standard. In Summary COSO and ISO avoid your formulation because it would: Shift accountability more directly to boards and executives. Narrow the scope of risk management to objectives/uncertainty, disrupting decades of compliance/control practice. Increase liability exposure by linking purpose explicitly to outcomes (likelihood of achieving objectives). Instead, they stick with softer terms — value, performance, assurance, innovation — that sound positive, but don’t force boards or risk groups to confront Quadrillion-Dollar Question head-on. (See TL comment).

14

6 Komen

#Someone asked me to explain the Risk Management Cycle. I hope the following concise overview of the process is helpful for you. #Risk #Management #Cycle: 1. #Project Initiation:   Before starting any project, we must clearly understand. ·       Where we are working (location analysis)  ·        How long we will be operating in that area (duration and timeline) 2. #Security Context Analysis:   This involves assessing the overall security environment in the country or region, it includes. ·       Political, social, and conflict dynamics  ·       General threats and incidents in the area 3. #Program Assessment:   We evaluate the program's operational footprint. ·       What activities are planned?  ·       Where and how will staff and assets be deployed? 4. #Threat Identification:   Analyze. ·       Who or what are the threats?  ·       Their capability, intent, and history of actions in that area. 5. #Security Risk Assessment (SRA):   This step identifies. ·       What risks could affect staff, operations, or assets?  ·       How could those risks harm us (impact and likelihood)? 6. #Security Risk Management (SRM) Measures:    Once risks are identified, we develop measures to treat or reduce them. This involves. ·       Reducing likelihood (e.g., improved procedures, training)  ·       Reducing impact (e.g., protective gear, safe facilities)  ·       -Reducing vulnerability (e.g., visibility, movement controls) 7. #Decision-Making:   SRM options are presented to the head of the organization, who can. ·       Accept the risk  ·       Avoid the risk (cancel or delay activities)  ·       Mitigate or control the risk (apply measures)  ·       Transfer the risk (e.g., to insurers or partners) 8. #Implementation:   Once a decision is made, the organization must implement the agreed security measures according to the SRM outcome. This ensures risks are managed to an acceptable level. 9. #Monitoring & Review:    Risk is never fully eliminated.  ·       Regular reviews are essential to assess changes in threat levels, exposure, or vulnerabilities. #SRM measures must be updated accordingly.

24

4 Komen

Preparing for an Operational Audit: Essential Documents & Information to Request Post Kick-off Meeting The success of any operational audit lies in how well you understand the process and environment before diving into fieldwork. One of the most crucial steps after the kick-off meeting is the walkthrough, which lays the foundation for risk identification, control assessment, and audit planning. Here’s a checklist of what to request and review during this stage: 1. Organizational Structure & Hierarchy Updated Organizational Chart Roles & Responsibilities of key process owners Delegation of Authority (DoA) matrix for approvals Why: Helps identify key stakeholders, segregation of duties, and reporting lines. 2. Policies, Procedures & SOPs Standard Operating Procedures (SOPs) for the process under review Relevant Policies (Finance, Procurement, HR, etc.) Compliance Guidelines and regulatory requirements Why: Provides the benchmark against which process gaps and control weaknesses are evaluated. 3. Process Maps & Flowcharts Current process flows and swimlane diagrams Automation system workflows (ERP or other tools) Why: Aids in visualizing the process and pinpointing high-risk areas. 4. Key Reports & Documentation Management reports, KPIs, and performance dashboards Historical audit reports, internal reviews, and management letters Exception reports or logs for non-compliance Why: Offers insight into past findings and ongoing performance challenges. 5. Risk & Control Information Risk Control Matrix (RCM), if available Internal control narratives or testing documentation Incident or fraud logs Why: Helps auditors align with existing risk assessments and identify control gaps faster. 6. Walkthrough Insights During the walkthrough itself: Observe actual operations vs. documented procedures Validate control points and decision-making authority Identify potential red flags early on Key takeaway: A well-prepared walkthrough ensures auditors understand not only the process, but also the people, systems, and culture behind it. This groundwork drives a risk-based audit approach, increases stakeholder engagement, and ultimately delivers greater value to the organization. What other documents do you request before starting an operational audit? Share your checklist in the comments below. #OperationalAudit #InternalAudit #RiskManagement #AuditExcellence #Governance

15

#RiskManagement "ISO 31000 Practitioners reject the concept of Risk Appetite. " When ISO 31000 released its inaugural interpretation of a risk management framework in 2009, the enterprise risk management community was fractured and for good reason … ■ ISO 73 Definitions were not consistent with industry or standard practice. No real life case studies existed. ■ The ISO 31000 guideline makes no mention to risk appetite but ISO 31010 Risk Assessment techniques certainly does. ■ Risk Appetite is a well established ideology in strong risk management fields such as banking, investments, finance, markets and other applications of risk such as in the military. ■ Some members of the ISO 31000 community lobbied risk appetite be translated to “levels of risk” and “risk attitude” to differentiate ISO doctrines away from other risk practices. ■ New ISO 31000 Drafts have seen many members of the ISO community backtrack and flip on their earlier beliefs to begrudgingly embrace various concepts including risk appetite. " p.7 #risk #risks #enterpriserisk #enterprisesecurityriskmanagement #intelligence #threatlintelligence #riskmanagement #riskanalysis #riskassessment #riskmanagementframework #operationalriskmanagement #projectriskmanagement #projectrisk #operationalresilience #resilience #operationalrisk #riskintelligence #governance #crisis #crisismanagement #complexity #chaos #crisisleadership #crisisplan #crisismanagementplan #stress #governance #decisionmaking #riskmanagement #riskinformed #securitymanagement #securityriskmanagement #resilience #humanfactors #emergency #disaster #emergencyresponse #safety #safetyfirst #safetymanagement #safetyassessment #safetyrisks #safetyculture #safetyanalysis #personalsafety #workplacesafety #healthandsafety #hazard #danger #peril #threat #PPE #protectivesafety #workplacesafety #security #securityriskmanagement #securitymanagement #securityrisks #enterprisesecurity #cybersecurity #physicalsecurity #informationsecurity #digitalsecurity #securityoperations #enterprisesecurityriskmanagement #securityassessment #intelligence #threatlintelligence #risk #riskmanagement #travelsecurity #travelsafety #travel #businesstravel #tourism #travelrisks #travelriskmanagement

12

1 Komen

1. Why Career Planning in Risk Management is Critical * Global Trends Driving Demand - Increasing Regulations (Basel III, OJK/PBI) - Cybersecurity Threats (Indonesia had 1.3B cyberattacks in 2023) - ESG & Climate Risk (Growing focus on sustainable finance) - AI & Predictive Analytics (Banks/Fintechs need risk modelers) * Indonesia’s Unique Challenges - Regulatory Lag (OJK rules are evolving, creating uncertainty) - Talent Shortage (Few certified FRM/PRM professionals) - HR’s Lack of Risk Expertise (Career paths are ad-hoc, not structured) 2. Why Indonesian Companies Neglect Risk Career Planning A. HR’s Limited Understanding of Risk Roles - Many HR teams don’t differentiate between credit risk, market risk, and operational risk—lumping all under "compliance." - Progression is often tenure-based, not skill-based. B. Regulatory Uncertainty : Frequent OJK/Bank Indonesia policy changes make long-term planning hard. C. Lack of Local Training Programs - Few universities offer risk management degrees (most professionals learn on the job). - Certifications like FRM/PRM are expensive and companies rarely sponsor them. D. Risk = "Cost Center" Mentality : Unlike sales or tech, risk teams are seen as back-office, reducing investment in their growth. 3. How to Build Your Risk Management Career Plan A. For Employees * Start with a Specialty: Pick credit risk, market risk, or cyber risk early (don’t stay generic). * Get Certified - Local: OJK/Bappebti certifications. - Global: FRM (Financial Risk Manager), PRM, CFA (for investment risk). * Push for Rotations: Move from risk analysis → risk modeling → governance. * Network with Regulators : Attend OJK seminars B. For Employers/HR a) Define Clear Risk Career Ladders Example: - Year 1-2: Risk Analyst → Data Risk Specialist - Year 3-5: Risk Manager → Head of Operational Risk b) Sponsor Certifications: Tie promotions to FRM/PRM completion. c) Integrate Risk with Business Units : Rotate risk staff into finance, tech, or compliance. 4. Future of Risk Careers in Indonesia - AI & Automation: Risk analysts must learn Python, ML models. - Climate Risk: New OJK rules will create sustainable finance risk roles. - Fintech Expansion: More demand for real-time fraud risk experts. Key Takeaways ✅ Employees: Specialize early, get certified, demand rotations. ✅ Employers: Build structured paths, sponsor certs, align with OJK trends. ✅ Indonesia is behind but catching up—early movers will dominate.

16

2 Komen

 Understanding the Risk Management Framework: From ISO 31000 to Global Certifications. Risk is an inevitable part of any strategic decision, operational plan, or project execution. That’s why a solid Risk Management Framework (RMF) is essential not just for compliance, but for resilience, growth, and sustainability. At the core of most modern frameworks is the ISO 31000 standard, which provides a structured approach to managing risk across all types of organizations. It emphasizes principles such as integration, structure, customization, inclusiveness, and continual improvement, making risk management a proactive, value-adding function. But mastering risk management takes more than understanding a framework; it requires professional training and certification to build credibility and capability. Here are some globally recognized institutions offering structured training paths: 📌 Project Management Institute (PMI) While best known for project management, PMI integrates risk management deeply into its certifications like the PMP and Risk Management Professional (PMI-RMP), equipping professionals to identify, assess, and respond to project risks effectively. 📌 The Institute of Risk Management (IRM) Offers globally respected qualifications, including the International Certificate and Diploma in Risk Management, ideal for those seeking a comprehensive and career-focused pathway in enterprise risk. 📌 Professional Risk Managers' International Association (PRMIA) PRMIA's focus is on financial and operational risk, offering certifications like the PRM designation recognized widely in banking and finance sectors. 📌 Global Association of Risk Professionals (GARP) GARP is known for the Financial Risk Manager (FRM) certification, a gold standard in the finance world for risk analytics, modeling, and regulatory risk frameworks. 📌 Society of Risk Analysts This organization provides resources and training for those focused on the analytical side of risk, including risk quantification, modeling, and forecasting key skills in today’s data-driven world. Whether you're in project delivery, finance, cybersecurity, or enterprise risk, understanding and applying risk management frameworks supported by recognized certifications can significantly elevate your strategic impact. 👉 Are you currently pursuing or holding any of these risk certifications? I’d love to hear your journey and insights in the comments below!

12