Risk Management Framework Tool

Let’s be honest, when most people think of accountants, they don’t think of risk takers. But they’d be wrong. Because risk-taking is a big part of our everyday business.

And there’s some smart ways we can manage it.

Without risk there can be no growth, no reward. Risk involves so much more than simple insurance or backing up your hard drive. It’s about growing and adding value to your business while protecting the public interest.

So, CPA Australia has developed a tool specifically designed to help you identify, assess, mitigate, implement and monitor the risks to your business.

This tool will create your risk management framework – tailored to your practice circumstances, risk appetite and mitigation strategies.

As a CPA, you have a mandatory obligation to document your risk management framework under the requirements set out in APES 325. You should familiarise yourself with this standard – it’s important. To make this easier for you, we have integrated APES 325 in to the tool.

The document produced by you via the CPA Risk Management Framework tool will be compliant with APES 325 to help ensure you meet your regulatory compliance.

When completing the tool, you will need to consider your own practice, the environment in which you operate, the clients you engage with and the services you provide.

You’ll be asked questions about the size and structure of your practice, and whether the business is in start up, maturity or wind down. You will be asked to consider what would happen to your practice if you no longer operated it?

Succession planning is a critical element of risk management to ensure the sustainability of your practice, and it’s a mandatory component of APES 325.

The tool’s risk library will provide you with common practice risks and mitigation strategies to start the process and help guide your thinking.

But risk management is never a ‘one-size fits all’ exercise. Effective risk management for your practice, will be as individual as your business. So the tool allows you to add your own unique risks and mitigation strategies to reflect your specific circumstances.

And as these circumstances change over time, you can use the tool in the future to monitor and re-evaluate your risk management framework and make the necessary changes as required.

Risk management is a dynamic process. You need to embed the management of risk in to the culture of your practice. In all you do.

It would be too great a risk not too.

The tool's final deliverable is the production of a Risk Management Framework in a Word Document, which can be saved on a member's local drive.

This document will automatically have a date included in the filename. Each time you make changes within the tool and produce another document, it will automatically include the latest date, allowing version control.

While the tool has been designed to produce a Risk Management Framework, in line with the requirements of APES 325, it is up to members to ensure what has been developed is applicable to their practice.

This will include following through any action which provides evidence that supports compliance with the standard.

Where an assessor finds a member has not complied with APES 325, they will explain their findings including their reasons.

Assessors will assess the member’s risk management framework to determine whether all the mandatory requirements have been met.

They will be looking for evidence that any policies and supporting procedures that have been developed in the Risk Management Framework are being followed. For example, evidence supporting the specified frequency which the Risk Management Framework is to be monitored.

Assessors will also look to see whether the risks identified are relevant to the practice, and will make suggestions on risks which may be considered, based on the member’s practice.

No, the tool requires login with a registered email address via the CPA Australia website, and it is not possible to link multiple accounts to the same data. CPA Australia does not recommend the sharing of logins between members.

Yes, members can refer to another document for their succession planning policies and procedures. They do not have to display their succession planning in the Risk Management Framework if they do not want to disclose their succession planning to their employees or staff.

However, members are required to provide evidence to their assessors that they have succession planning policies and procedures for the best practice assessment purpose, and are reminded that succession planning is a mandatory requirement of APES 325.