Is your risk assessment keeping pace with real life?

When evaluating risks in an audit and control environment, we often evaluate two core dimensions:

1️⃣ Impact. How much is this going to hurt if the event occurs?

2️⃣ Likelihood. What are the odds that the event will occur?

But reducing a risk to these two dimensions is ignoring a critical reality. How much time will the company have (if any) to react to the risk occurring when it does? This dimension is better known as velocity. 

Measuring just impact and likelihood boils a risk assessment down to an academic exercise. Assessing velocity, and working with management to create response plans take the practise into reality. 

Consider two different events, of theoretical equal impact and likelihood. The first, a hurricane and the second, a accounts receivable error. In a hurricane, there may be critical minutes and hours to respond, whereas a financial error could provide some additional time to respond. 

Incorporating velocity into risk and control assessments enhances clarity, prioritizes actions, and ensures effective mitigation strategies in times of crisis. 

Well structured ERM approaches usually consider this third dimension, but audit less so, and occasionally to it’s detriment. How well are you factoring velocity into your audit work?