Fundamentals of Risk Management

Data security and privacy
Increasing risks of cyber-attack 
threaten the security of customer, 
colleague and supplier data.
We must ensure that we 
understand the types of data that 
we hold and secure it adequately to 
manage the risk of data breaches.

---

Risk assurance
392
Edited extracts from J Sainsbury plc
Annual Report and Financial Statements 2015
Edited extracts from Tesco plc
Annual Report and Financial Statements 2015
Sainsbury’s: Our principal risks and 
uncertainties
Tesco: Principal risks and 
uncertainties 
Trading environment and competitive landscape
Effective management of the trading account is key to 
the achievement of performance targets. The sector 
outlook has been and is set to remain challenging.
The challenging trading environment, food price deflation 
and the price reduction and price matching activity 
across the sector may adversely impact performance.
Competition and markets
If we fail to address the differing 
challenges of the budget retailers, 
the premium retailers and online 
entrants, it may adversely impact 
our market share and profitability.

---

33
the control 
environment
nature of internal control
The system of internal control within an organization is an important component in 
the successful management of its risks. Internal control is concerned with the meth-
ods, procedures and checks that are in place to ensure that a business or organization 
meets its objectives. There are alternative definitions of internal control and some of 
the key definitions are set out in Table 33.1. Internal controls can be considered to 
be the actions taken by management to plan, organize and direct the performance of 
sufficient actions to provide reasonable assurance that objectives will be achieved.
The phrase ‘control environment’ is preferred by internal auditors. ISO 31000 
refers to the ‘risk management context’. COSO refers to the ‘internal environment’. 
In all cases, the intention is to refer to the level of maturity of the organization with 
regard to internal control activities. When referring to internal control activities, it
is important to have a single definition within the organization. Table 33.1 sets out 
some of the best known definitions of internal control.
ISO Guide 73 defines control as a measure that is modifying risk. It also states that 
controls include any procedure, policy, device, practice or other action that modifies 
risk. Guide 73 also makes the important point that controls may not always exert 
the intended or assumed modifying effect. Internal control incorporates the organ-
izational and hierarchical structure, as well as planning and objective setting. The 
scope of internal control extends to evaluation of controls designed to support the organ-
ization in achieving objectives and executing strategy, but it also applies to the control 
of actions to ensure that the organization does not miss business opportunities.
When designing effective internal controls, the organization should look at the 
arrangements in place to achieve the following:
●
●
maintenance of reliable systems;
●
●
timely preparation of reliable information;
●
●
safeguarding of assets;
●
●
optimum use of resources;
●
●
preventing and detecting fraud and error.
Effective financial controls, including maintenance of proper accounting records, are 
an important and well-established element of internal control. These financial controls