ACCT5919 Chap.9 Risk Analysis, Controls and Treatment
Risk Analysis, Controls and Treatment
Risk analysis distinguishes inherent exposure from the residual exposure remaining after relevant and effective controls operate. Likelihood and consequence criteria support a rating, but the judgement must reflect the organisation's objectives, data and appetite.
This chapter classifies directive, preventive, detective and corrective controls, evaluates design and operation, chooses among accept, treat and avoid, and closes the loop through monitoring, registers and focused reporting.
What this chapter covers
- 01
Inherent exposure before controls and residual exposure after effective controls
- 02
Likelihood and consequence criteria fitted to organisational activity and appetite
- 03
Risk matrices as prioritisation aids rather than substitutes for evidence and judgement
- 04
Directive, preventive, detective and corrective controls across the causal pathway
- 05
Accept, treat and avoid decisions after comparing residual exposure with appetite
- 06
Monitoring, risk registers and reporting focused on out-of-appetite action
Worked example · free
Analyse controls before choosing treatment
- +1The marks shown for this analysis exercise are not a published university assessment scheme. Describe inherent exposure from access opportunities and patient, service, compliance and reputation consequences.
- +1Classify enforced access restrictions as preventive, alerts as detective and restoration and response plans as corrective.
- +1Test operating evidence such as access review completion, alert investigation and restoration exercises before lowering the rating.
- +1Compare supported residual exposure with appetite and assign treatment, ownership, reporting and a review trigger.
Key terms
- Inherent risk
- The exposure assessed before considering the effect of controls.
- Residual risk
- The exposure remaining after relevant and effective controls operate.
- Preventive control
- An action designed to reduce the likelihood that an undesirable event occurs.
- Detective control
- An action designed to reveal an event or exception after it occurs.
- Corrective control
- An action designed to reduce impact, disruption or recovery time after an event.
- Risk treatment
- A selected action to accept, reduce or avoid residual exposure in relation to appetite.
- Control reliance
- A conclusion that a control can support a lower residual assessment because its design addresses the causal pathway and evidence shows reliable operation. Reliance considers frequency, ownership, retained records, exceptions, follow-up and shared dependencies rather than assuming that a policy or control name proves effectiveness.
Risk Analysis, Controls and Treatment FAQ
What is the difference between inherent and residual risk?
Inherent risk is exposure without controls. Residual risk is the exposure remaining after relevant controls are shown to be effective. The difference must follow evidence about design and operation; a policy name or intended control does not automatically justify a lower residual rating.
Does a risk matrix make the treatment decision?
No. A matrix combines likelihood and consequence under defined criteria and helps prioritise exposures. Appetite determines whether action is required, while data quality, assumptions and credible alternative ratings remain important. The coloured cell supports judgement but does not replace it.
What does accepting a risk mean?
Acceptance is a conscious decision not to add treatment at present, usually because supported residual exposure sits within appetite or a temporary exception is authorised. It still requires ownership, monitoring, rationale and a trigger for reassessment; it does not mean deleting the risk from the register.
Assessment move
Use one causal diagram for every analysis. Place sources before the event and consequences after it, then locate each control on the pathway. Label whether the control is directive, preventive, detective or corrective and explain whether it changes likelihood, consequence or detection speed. Assess inherent exposure first, test design and operating evidence, and only then estimate residual exposure.
Compare the result with appetite before selecting accept, treat or avoid. Practise writing treatments with a specific action, owner, expected effect, evidence and due point. Finish by updating the register and stating what context or control evidence triggers review. This sequence prevents a matrix colour from replacing analysis and keeps reporting focused on decisions.
Build a control evidence table with columns for causal target, design, frequency, owner, retained record, exceptions and follow-up. Check dependencies so several listed controls are not all relying on the same person or data source. Support likelihood and consequence ratings separately, record credible alternative ratings and explain why uncertainty matters to the appetite decision.
When proposing treatment, compare effectiveness, feasibility, timing, cost and new risks. Close an action only after effectiveness is tested; completion evidence shows that work occurred, whereas control testing and outcome indicators show whether exposure changed.
Working through Risk Analysis, Controls and Treatment in ACCT5919? Sia is AskSia’s AI Accounting tutor — ask any ACCT5919 Risk Analysis, Controls and Treatment question and get a clear, step-by-step explanation grounded in how ACCT5919 is taught and assessed. Read this chapter free, then take your hardest questions to Sia.
