Risk and control are what makes auditors of all persuasions tick (just like cartoon bombs).
The independent eye can often see risks in a situation that those intimately involved with it either cannot see or cannot face. With training and experience, auditors come to appreciate that risk is not a purely theoretical concept – bad things really do happen sometimes. This is what gives auditors a bad name. If an auditor sees a boy taking his first tentative ride on a new bicycle, he sees the potential for grazed knees. His father sees a supreme athlete. His mother sees her little boy leaving home.
Risk control has a wider ambit than risk management. The latter is often defined as hedging or neutralising the financial risks that result from one or a series of transactions. For the purposes of this discussion, risk control is the entire process of policies, procedures and systems an institution needs to manage prudently all the risks resulting from its financial transactions, and to ensure that they are within the bank's risk appetite. To avoid conflicts of interests, risk control should be separated from and sufficiently independent of the business units, which execute the firm's financial transactions, (the latter are often responsible for hedging the risks which result from their trades.) In some organisations, risk control work is carried out by independent risk management units rather than specially-named risk control sections, but the difference here is a question of semantics rather than job function.
Answered by
Yash
, an ibibo Master,
at
8:32 PM on June 25, 2008