ACCT3031 Chap.7 Risk Management and Internal Governance Mechanisms
Risk Management and Internal Governance Mechanisms
Boards are expected to manage risk, not minimise it.
This chapter covers the board's risk duties and the choice between a risk committee and other structures, the five-phase risk management process, the impact and likelihood map with the four responses of avoid, mitigate, transfer and retain, internal control under the Treadway and Turnbull frameworks, mandatory climate reporting under AASB S2 with its three size groups, and the Enron lesson that formal systems can miss the risks that matter.
Climate reporting is treated as part of risk governance, so the chapter asks how disclosure under the new standard relates to whether a company actually manages climate risk.
What this chapter covers
- 01
Risk management, not risk minimisation
- 02
Risk committees and the Chief Risk Officer
- 03
The five-phase risk process
- 04
Risk map and four responses
- 05
Internal control and its limits
- 06
Climate reporting under AASB S2
- 07
Enron and formal risk systems
Worked example · free
Choose a response for a high-impact, low-likelihood risk
- +1Placement: the chance is small but the consequence severe, so the risk sits in the high-impact, low-likelihood quadrant.
- +1Options in that quadrant: reduce the impact, accept the risk or buy insurance.
- +1Recommendation: mitigate with security controls and recovery plans, and transfer part of the financial loss through insurance, with the board confirming the residual risk fits its appetite.
Key terms
- Risk committee
- A forward-looking standing committee of mainly independent directors that oversees the company's risk framework for the board.
- Operational risk
- Risk of loss, direct or indirect, caused by internal processes, people or systems that are inadequate or fail, or by events outside the firm.
- Enterprise risk management system
- A centralised system that gathers risk information for executive decisions, board monitoring and external reporting.
- Detective control
- A control that flags an error or anomaly after it occurs, such as a reconciliation or independent review.
- Transition risk
- Climate-related risk arising from the move to a lower-carbon economy through policy, technology, markets or preferences.
- Physical risk
- Climate-related risk from acute events such as floods and bushfires or from long-term shifts in climate patterns.
Risk Management and Internal Governance Mechanisms FAQ
Why does the unit say risk management rather than risk minimisation?
Boards create value by taking risks, so the aim is to understand the company's exposure and decide how each risk is faced, balancing risk against acceptable reward. A board that tried only to minimise risk would forgo opportunities, and the Module 7 quiz treats minimising risk as the main purpose of board attention as false.
Which companies must report under AASB S2?
Entities reporting under the Corporations Act that meet at least two of three size thresholds for their group. Group 1 applies from 1 January 2025 at $500m revenue, $1bn gross assets or 500 employees; Group 2 from 1 July 2026 at $200m, $500m or 250; Group 3 from 1 July 2027 at $50m, $25m or 100.
Does a risk committee take responsibility for risk away from the board?
No. The ASX commentary places ultimate responsibility for the risk management framework with the full board. A stand-alone risk committee, an audit committee that also covers risk, or several committees can be an efficient way to oversee risk, but they recommend and monitor on the board's behalf rather than replacing its responsibility.
What is the difference between preventive, detective and corrective controls?
Preventive controls stop an error before it happens, such as password access. Detective controls reveal an error or anomaly after it occurs, such as reconciliations and independent reviews. Corrective controls repair the damage afterwards, such as a disaster recovery plan. A sound system uses all three because none gives absolute assurance.
What are the four responses to a risk?
A board can avoid a risk by not taking the action, mitigate it through investment or ongoing spending, transfer it through insurance or derivatives, or retain it, for example by self-insuring. The choice to retain risk reflects the company's risk appetite and must be made at board level, after weighing the cost of control against the outcome it protects.
Assessment move
Learn the five phases and four responses as sequences you can write from memory, then practise placing scenarios on the risk map. Work the climate size test until it is quick, and prepare one paragraph on why formal risk systems at Enron did not produce effective oversight. Finish each risk answer by naming what the risk system might miss, because that turns a description into an evaluation.
Working through Risk Management and Internal Governance Mechanisms in ACCT3031? Sia is AskSia’s AI Accounting tutor — ask any ACCT3031 Risk Management and Internal Governance Mechanisms question and get a clear, step-by-step explanation grounded in how ACCT3031 is taught and assessed. Read this chapter free, then take your hardest questions to Sia.
