Fundamentals of Risk Management

274
FIgURE 
23.4
Risk and reward decisions
Level of risk
Marginal
benefit, so
judgement
required
Increasing
reward with
increasing
risk exposure
Increasing
risk with little
additional
reward
Level of
reward
is taking place, because the level of risk will be affected by the nature and quality
of the controls. The role of monitoring controls is an area of expertise that is well 
established for internal audit.
Learning from controls may be mainly concerned with increasing their efficiency. 
However, it is also necessary to ensure that they are effective and they are the correct 
controls. Internal audit will assist with the evaluation of the effectiveness and
efficiency of existing controls and this will assist with learning from controls. The 
evaluation of controls should also pay regard to the level of reward that is being 
sought. Therefore, there is a need to evaluate strategy and tactics, as well as evaluat-
ing the effectiveness and efficiency of hazard and compliance controls.
Throughout this chapter, the emphasis has been on hazard controls, with details 
presented on some of the more common hazards that will be faced by many organ-
izations. The ideas and principles explained in this chapter are also appropriate to 
opportunity management, and Figure 23.4 illustrates how the relationship between 
risk exposure and anticipated reward affects business decisions.
Initially, as risk exposure increases, a higher reward will be expected and the
increase in reward is greater than the increase in risk exposure. Ultimately, there will 

---

Control of selected hazard risks 
275
be increasing exposure, but no increase in expected reward, so there is no benefit in 
taking that extra risk. In between these two situations, increasing risk exposure will 
produce a marginal increase in anticipated reward.
It is in this intermediate area that the judgement of management is required as
to whether the increase in risk exposure is within the appetite of the organization. 
Although it may not seem appropriate to increase risk exposure for a marginal
increase in anticipated reward, this may be necessary to satisfy existing customer 
requirements or to help fulfil a longer-term business objective.
The analysis in Figure 23.4 relates to opportunity risks. There is a similar analysis 
that can be undertaken in relation to hazard risks, whereby the cost of further
controls has to be evaluated against the reduced risk exposure that would result. 
When deciding whether to introduce further controls, the organization will need
to also consider risk appetite and make a judgement concerning the risks that it is 
willing to take in pursuit of strategic objectives.