รู้ รอบรั้ว บัญชีกลาง 3 EP.13 การบริหารความเสี่ยง

Main ideas and lessons

• Risk management is essential and tied to organizational survival

  • “Risk” refers to uncertainty/causes that can prevent an organization from achieving its objectives.
  • Risk management is the tool/process used to manage the impact so the organization can survive under varying internal and external conditions.

• Internal controls and risk management are inseparable

  • Internal controls are part of the risk management process (they operate “go hand-in-hand”).
  • Confusion often exists about whether internal control is “different from” risk management; the episode clarifies they are integrated.
  • Internal controls include controls required by regulations and instructions (not just general “good practice”).

• Government agencies must focus on stakeholders/people

  • Even though government agencies are not profit-driven, they still have stakeholders (service recipients/citizens).
  • Objectives and risk considerations should align with service delivery and public expectations.

• Risk management is practical, not only academic

  • Examples like commuting/arriving at work on time show how people naturally assess internal/external factors and apply controls (e.g., alarm clocks, checking the car/route).

Methodology / process presented (structured steps)

A) Risk management framework at the organizational level

1. Start with management direction

   • The unit/organization head sets direction and priorities.

2. Design an Organizational Risk Management Plan

   • The plan should be developed and agreed at the beginning of the fiscal year (timing can vary by agency, but the intent is early alignment with budget and plans).

3. Assign responsibility and accountability

   • Designate a responsible person who is accountable.
   • Include the risk owner for that year (named within the plan).

4. Identify and analyze risks

   • Risks must be identified (based on organizational context and objectives).
   • Risks must be analyzed.

5. Determine response/controls for risks

   • Specify how to respond to risks and what controls will be used.

6. Implement and track results

   • Track outcomes according to required guidelines/criteria.
   • Evaluate effectiveness and identify improvements.

7. Evaluate and improve

   • Review at year end and carry improvements into the next year.
   • The plan should help achieve objectives, so it must begin early rather than only at year-end.

B) Internal controls and reporting/evaluation timing

• Controls are ongoing

  • Internal controls are considered part of the year-round process.

• End-of-year actions focus on evaluation

  • Control measures reported later are used for evaluating whether internal controls/processes were effective.

• Key distinction emphasized

  • Starting risk management early (to support objectives) differs from only evaluating/reporting controls at year-end.

C) Standards and legal/regulatory basis for government agencies (how they govern risk management)

• Financial Discipline Act (Section 79) and audits

  • The Ministry of Finance requires government agencies to conduct audits.
  • Risk management and internal control practices operate within this framework.

• Three risk-related areas / audit matters

  • The episode references “three matters related to auditing” and controlling/managing risks in that area.

• Use of standards

  • A guideline is based on international standard COSO.

• Relevant guideline/article references mentioned

  • Article/War “23”: standards/guidelines for risk management (noted as released earlier).
  • Risk factor “36” / “War 36”: later guideline (released 2021) connected to management/enterprise risk management, and clarified as a guideline rather than a simple replacement naming issue.
  • The episode emphasizes the relationships among these issued items (and explains confusion about cancellation vs guideline naming).

D) Practical guidance for forms/tools

• Use a universal application/form approach

  • The framework allows organizations to design their forms using accepted standards.

• ISO as an example

  • If the organization doesn’t use ISO terminology, it can still be adopted conceptually; the idea is to follow the guideline’s acceptable structure.

• The form should clearly define steps

  • Steps must be explicitly shown in the risk management plan/document.

Speakers / sources featured

• Penpaka Silpasuwan (introduced as “P’Ploen”; expert/host speaking on behalf of P’Ploen)
• P’Ploen (main knowledge presenter)
• Nong Tuang (used as a discussion voice/participant in explaining risk management concepts)
• Fern (a participant in explanations and examples)
• “Nong Tuang’s younger sister” (used as a hypothetical participant in one example)
• Ministry of Finance (Thailand) (referenced as the regulator issuing guidelines and audit requirements)
• COSO (international standard) (referenced as the basis for risk management standards)
• Financial Discipline Act (referenced as legal basis for required audits and risk-related obligations)
• ISO (example only, European ISO mentioned) (cited as an optional reference for form/approach)