8 The COSO framework: risk assessment

The second internal control component is risk assessment. A general definition of risk is the variation from an expected outcome over time (Kallman, 2005).

A favourable or positive risk could be referred to as an opportunity, while a negative risk could be referred to as a threat and the possibility of harm or loss. Examples of opportunity or positive risk include favourable mergers, acquisitions and new business ventures. There are some negative risks, including risk from fraud, money laundering and poor organisational controls (Hillson, 2002).