The COSO Framework for Internal Control
February 12, 2025
According to organizational diversity, individuals from diverse backgrounds, religions, communities, age groups, genders come together on a common platform to work towards a common goal – i.e. to achieve the objectives and targets of the organization within the shortest possible time frame. Organizational diversity ensures individuals with varied experiences; knowledge and expertise form a team […]
In the previous articles, we have already studied about the concept of reinsurance. However, the reinsurance we have studied is a contract between two independent parties. This means that a ceding insurance company often transfers the risk to an external third-party reinsurance service provider. The risk actually moves out of the balance sheet of the […]
Return on Investment is a popular analytical tool which is used to measure the benefits relative to the cost. There is an ongoing debate in the business world on which is better – co-located or virtual teams. Though there is no black and white answer to this question. But the key lies in carefully assessing […]
The modern approaches to risk management are data-driven. There are four basic steps to this approach which we will study later in this module. The first step contains information about how data related to internal losses suffered by an organization needs to be collected and studied in order to better mitigate risks in the future. […]
The concept of learning is quite comprehensive as it covers a broad range of activities. In many books, the theories of learning are also regarded as kinds of learning. The theories of learning are an organized set of principles that explain how individuals attain, retain or recall the learnt knowledge. Learning theories establish the conceptual […]
Technology has disrupted the entire business world and the field of risk management is no exception. All across the world, companies have been spending millions of dollars in order to upgrade themselves and use technology in a manner that helps them minimize risks. There are several advantages to this approach which we already studied in the previous article. However, there are also some disadvantages related to risk management information systems.
In this article, we will try to make the reader aware of the disadvantages of using a risk management information system.
The first disadvantage of using an automated risk management information system is that it may not be useful for all companies. These systems are only useful for companies that have a certain kind of profile. Some of the characteristic features of such companies are as follows:
Companies that have a large number of risks to track benefit from using risk management information systems. Hence, if a company does not own a lot of movable and immovable property and does not use several different risk management products, the integrated system may have limited utility.
If a company does not have to deal with a large number of third party vendors with each transaction having its own different terms and conditions, the risk management information system may not be very useful
If a company does not have its business interests located across different geographical areas and hence is forced to use different currencies and languages, the risk management system may be unnecessary.
If the company does not need automated actions to be taken based on certain pre-defined business rules then risk management information systems may not add value to the business proposition of the company
The bottom line is that risk management information systems are valuable only for companies which have a wide variety of complex business interest that span various geographies. For small and medium-sized companies, using simple spreadsheets to manage the risk seems like the best alternative.
Risk management information systems can be quite expensive. They are often sold as standalone software solutions or as solutions that can be integrated with the overall enterprise resource planning software. Either way, planning and implementation of these systems can be expensive as well as time-consuming. To make matters worse, the implementation of information systems is not a one-time activity.
These systems need to be updated every few months and hence there are significant maintenance costs associated with their purchase. Also, access to risk management software is often restricted to higher-level employees. Hence, business stoppages have been reported since employees have to wait for their managers before performing certain tasks. These business stoppages also cost money and add to the expense of the software.
Risk management software can be complicated to use. This is the reason that employees have to be trained to use them. Also, if employees leave the organizations, their replacements also have to be trained. This training takes time and also costs money. Hence, productivity goes down and expenses go up. As mentioned earlier, this makes the cost of implementing risk management information systems prohibitive for smaller and medium-sized companies.
In the absence of automation, employees have to collect data from different parts of the organization. This helps them build relationships and also identify practices that help make the organization vulnerable to risks.
In the case of a risk management information system, the entire process of data collection, as well as analysis, is automated. In some cases, systems are being programmed to make decisions based on available data using artificial intelligence. However, as more and more tasks become automated, employees interact less with the processes. Hence, they have a lesser understanding of the systems and processes. This is the reason why the gains from automation often end up being offset by the losses arising due to lower process knowledge.
Lastly, risk management information systems collate all of the organization’s important data in one place. This creates data security risks. If the risk management information system is hacked, it could cause severe damage to the company. This is because important data could be hacked into. Details regarding the assets, employee personal data, financial data are all part of the risk management information system.
Centralization of data brings advantages in the data processing. However, it also creates a situation wherein the data security of the organization is jeopardized. The end result is that organizations have to spend large sums of money in order to protect sensitive data. This ends up adding to the overall cost of having a risk management information system.
The bottom line is that it is not feasible for every company to have an integrated risk management information system in place. Since the costs are so high, companies need to have large-scale operations before they can afford these systems. In the absence of large-scale systems, it would be better to use spreadsheet-based or lesser sophisticated systems rather than incurring cost overruns because of investing in the more sophisticated ones.
Your email address will not be published. Required fields are marked *