Module 2 Assessing Risk and Risk Management – Question Answer Each district school board The role of the audit committee is to determine how should have a strategic governance risks are being managed and that a business plan. What is the strategic business plan is in place. The audit committee audit committee’s role would not review the sufficiency of the plan. regarding the plan, e.g. does the audit committee determine that such a plan exists; does the audit committee check that various elements have been considered? Who sets the risk appetite School board management sets the risk appetite and for a district school communicates this to the board of trustees for review and approval. Some risks cannot be For such areas, the risk is compliance related (i.e. the controlled (e.g. Ministry risk of not meeting the requirements). Management is mandated areas, regulated expected to implement appropriate controls to manage staffing). How is decision the risk and to update the controls as needed when the making impacted where rules and guidelines change. The role of the audit risks cannot be controlled? committee is to ask the appropriate questions to What if rules or guidelines understand whether and how compliance risks are change? being managed. Is it necessary to Yes. The reputational impact of the various processes reputational impact across will vary from high in some instances, to low in others, all school board audit and there might even be a few instances where there is universe processes? no reputational impact. However, as a school board is a publicly funded organization, we anticipate that there will be some sort of reputational impact for most processes Following the completion of Risk management is a continuous exercise. The risk the risk assessment, an assessment is updated annually to reflect changes that internal audit plan is have taken place since the last risk assessment. prepared for a 3-5 year period. What is management doing in the
Module 2 – Assessing Risk and Risk Management Question Answer Each district school board should have a strategic business plan. What is the audit committee’s role regarding the plan, e.g. does the audit committee determine that such a plan exists; does the audit committee check that various elements have been considered? The role of the audit committee is to determine how governance risks are being managed and that a strategic business plan is in place. The audit committee would not review the sufficiency of the plan. Who sets the risk appetite for a district school School board management sets the risk appetite and communicates this to the board of trustees for review and approval. Some risks cannot be controlled (e.g. Ministry mandated areas, regulated staffing). How is decision making impacted where risks cannot be controlled? What if rules or guidelines change? For such areas, the risk is compliance related (i.e. the risk of not meeting the requirements). Management is expected to implement appropriate controls to manage the risk and to update the controls as needed when the rules and guidelines change. The role of the audit committee is to ask the appropriate questions to understand whether and how compliance risks are being managed. Is it necessary to reputational impact across all school board audit universe processes? Yes. The reputational impact of the various processes will vary from high in some instances, to low in others, and there might even be a few instances where there is no reputational impact. However, as a school board is a publicly funded organization, we anticipate that there will be some sort of reputational impact for most processes Following the completion of the risk assessment, an internal audit plan is prepared for a 3-5 year period. What is management doing in the Risk management is a continuous exercise. The risk assessment is updated annually to reflect changes that have taken place since the last risk assessment.
Questions%20and%20Answers%20-%20(EN).docx