Lines of Defense Model for Effective Risk Management
Internal controls play a crucial role in ensuring operational, financial reporting, and compliance goals are met. The Lines of Defense Model outlines the key components of a robust risk management framework, involving different levels of oversight and assurance. Board of Trustees, Audit Committees, Executive Management, Internal Audit, and other functions all contribute to managing risks effectively and ensuring the organization operates in line with its goals and objectives.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
2017 ADMINISTRATION AND FINANCE CONFERENCE Lines of Defense Model Scott Lawlor, Senior Internal Auditor, Office of University Audit
Understanding the Lines of Defense Model Internal controls are a set of systems and processes that help to ensure that the University achieves its: Operational goals Internal and external financial reporting goals Legal and regulatory compliance goals In order to achieve these goals, we need to have in place an effective model across the institution and this is the Lines of Defense Model 2
Lines of Defense Model Board of Trustees/Audit Committees Perform Oversight Executive Management Monitor Performance 3rdLine of Defense (Independent and Objective Assurance) Internal Audit 1stLine of Defense (Business Operations) 2ndLine of Defense (Oversight Functions) Departmental, Operational and Functional Management Risk Assurance Functions (Academic and Medical) Responsible for operating business processes and practices (controls) to manage risk. Responsible for defining policy and for monitoring the effectiveness of business operation controls to mitigate risk. Responsible for providing objective and independent assurance (to the Board) on the effectiveness of first and second line processes and controls to mitigate risk. Identify, assess, control and mitigate risks Process and internal control design, implementation and effectiveness Maintain and execute risk and control procedures day-to-day Guide the development and implementation of internal policies and procedures Ensure activities are consistent with goals and objectives Compliance with laws, regulations and policies Risk Management Responsible for identifying risks and maintaining a framework to assist with risk prioritization and reporting. Ensure controls are properly designed, in place and operating as intended Provide guidance and training on the risk management process Services (in accordance with recognized audit standards) include: Assurance Advisory / Consultative Governance Support Data Analysis / Business Intelligence Ethics, Investigations, Whistleblower, etc. Compliance also has Line of Defense responsibilities (e.g., provides assurance to the Board that management practices promote compliance with laws, regulations, and policies) Compliance Responsible for providing oversight, support and monitoring of management s compliance with legal, policy, or business standards. 3
Lines of Defense Model Board of Trustees, Audit and Risk Committees & Executive Management Perform an essential role in the Lines of Defense model Ensures model is reflected in the University s risk management and control processes Responsible and accountable for: Setting objectives Defining strategies to achieve those objectives Establishing governance structures and processes to best manage the risks in accomplishing those objectives Implementing an Enterprise Risk Management function Provides active support and guidance when implementing the model 4
Lines of Defense Model 1st Line of Defense - Business Operations: Departmental, Operational and Functional Management Maintain effective internal controls within a defined area; risks are owned Execute risk and control procedures on a day-to-day basis Identify, assess, control and mitigate risks Guide the development and implementation of internal policies and procedures Ensure activities are consistent with goals and objectives Managerial and Supervisory review 5
Lines of Defense Model 2nd Line of Defense - Oversight Functions: Risk Assurance Functions (Academic and Medical) Ensure Business Operation controls are properly designed, in place and operating as intended. Typically include: Internal Control Assurance Processes Controllership for financial risks and reporting Provide guidance and training on the risk management process Monitor the adequacy and effectiveness of internal control, accuracy of reporting, compliance and timely remediation of deficiencies Program Audits of grants and contributions Management oversight committees (IT, HR, Program) Report risk-related information organization-wide 6
Lines of Defense Model 3rd Line of Defense - Independent and Objective Assurance: Internal Audit Act in accordance with recognized audit standards Perform duties independently and objectively Active and effective reporting line to the Governing Body Ethics, Investigations, Whistleblower, etc. Key is independence and reporting lines Must report internally to the Governing Body Utilize best practices approach based on assessing risks to focus audits Flexible process to adapt to the specific of each engagement 7
Lines of Defense Model Key Takeaways Not a standalone solution to effective risk management, but rather a component of the overall process. Enhances the University s risk management strategy with greater efficiency and effectiveness Model needs to be supported by an active, ongoing initiative and an appropriate organizational mandate Appropriate leadership, accountability, clearly articulated objectives and active performance measures Oversight by both Executive Management, the Board of Trustees and Audit/Risk Committees Continuous fine tuning and improvements must be implemented 8
