Date post: | 26-Dec-2015 |
Category: |
Documents |
Upload: | elwin-patrick |
View: | 213 times |
Download: | 0 times |
BM
R A
dvis
ors
- A
ll rig
hts
rese
rved
Enterprise Risk ManagementInsights & Operationalization
Prepared for the Committee on Finance & IT
June 18th 2010
BM
R A
dvis
ors
- A
ll rig
hts
rese
rved
Background
Key findings:
1. The current state of ERM implementation
2. Types of ERM program
3. Organisation of ERM functions
4. Operationalization of ERM
Open questions
Next steps
About BMR
Contents
BM
R A
dvis
ors
- All
right
s re
serv
ed
A perfect storm
ERM has been a topic of discussion and
analysis since the mid 1990s – but economic
turmoil has thrown risk management into
sharper focus
Regulatory developments – for example, the
introduction of SEC Rule 33-9089 – are acting
as a powerful catalyst for ERM adoption
Management teams and Boards are under
increasing pressure from regulators, investors
and the media to demonstrate the effectiveness
of risk management efforts – both in protecting
shareholder interests AND in adding value
By 2009, FERF had identified a gap in
knowledge among FEI members – most of
whom knew that they should do something
about ERM, but weren’t sure exactly what to do
• What’s your company’s risk culture?
• Elson & Hubbard to lead study group on corporate boards
• European Commission to unveil governance Green Paper
| 4
BM
R A
dvis
ors
- All
right
s re
serv
ed
Focus on practical implementation
FERF and BMR agreed that an executive report
was needed to help FEI members address the
’operationalization’ of ERM
A steering group was formed, comprising Peggy
Yocher of United Technologies; Joan Netzel of
SunTrust Banks; and Prof Paul Walker of the
University of Virginia, as well as BMR and FERF
representatives
Rather than review theoretical frameworks, it
was agreed that the study should canvass ERM
Managers to find out how ERM is actually
being implemented on the ground and to
identify trends, patterns and future directions
that may be of value to FEI members
It was also agreed that the principal focus
should be upon ERM in non-financial companies
| 5
BM
R A
dvis
ors
- All
right
s re
serv
ed
Participants in the study
Companies interviewed for the study have
aggregate revenues in excess of $1.2
trillion and are generally global in scope
They were predominantly Fortune 500
organisations or similar, on the basis that
these companies are most likely to have
well-developed ERM programs
Personnel interviewed were typically either:
ERM Directors
Treasurers
Strategy Directors
Controllers
In addition to these face-to-face interviews,
we also carried out detailed reviews of
approximately 15 more ERM programs
| 6
BM
R A
dvis
ors
- A
ll rig
hts
rese
rved
Key findings1. Current state of ERM implementation
2. Two types of ERM program
3. Organization of ERM programs
4. Operationalization of ERM
BM
R A
dvis
ors
- All
right
s re
serv
ed
Current state of ERM implementation
•ERM Managers believe ERM exists to make risks more visible before they impact an organization, so that management decisions can be evaluated and challenged
•There is a growing recognition that ‘ad hoc’ risk management approaches have not worked and are no longer acceptable
1. There is a broad consensus as to the
purpose of ERM
•Some organizations have reached ‘advanced’ levels of sophistication
•However, these are heavily outnumbered by those for whom ERM still remains a work in progress, or has not been embarked upon at all
•All ERM Managers agree that there can be no ‘one size fits all’ solution
2. The typical ERM program is still in an
early stage of development
•Proactive decision, prompted by leadership change, Board discussion etc
•Reaction to events, whether internal (fraud, restatement) or external (terrorism, reputational issues affecting other companies)
•Requirements / expectations of regulators and other external bodies (biggest influence on the current heightened interest in ERM)
3. The ‘drivers’ of ERM programs fall
into three main categories
| 8
BM
R A
dvis
ors
- A
ll rig
hts
rese
rved
Key findings1. Current state of ERM implementation
2. Two types of ERM program
3. Organization of ERM programs
4. Operationalization of ERM
BM
R A
dvis
ors
- All
right
s re
serv
ed
Two types of ERM program
ERM programs can be classified
according to the categories of risk that
are deemed to be in scope; and the
overall approach that is adopted to risk
management:
In general, programs tend to fall into one
or other of two program types:
Type One: programs that take a mainly
strategic view of risk, and manage it in a
qualitative way; and
Type two: programs that take a more
financial / operational view, and tend to
manage risks through quantitative control
The view of risk might be said to be either
“Enterprise Level” (Type One) or
“Enterprise Wide” (Type Two)
Quantitative Qualitative
Ope
ratio
nal
Stra
tegi
c
Type One
Type Two
Type of risks that a given program is
mainly designed to
address
Predominant approach that a given company takes to management of risk
BM
R A
dvis
ors
- All
right
s re
serv
ed
Move toward more integrated, holistic approaches
Most organizations are making efforts to take a
more holistic, integrated view of ERM
To do this an organization needs to ask:
How can strategic risks be analyzed on a
quantitative level?
How can financial / operational data be
interpreted in a qualitative way?
The benefits of successfully adopting a more
integrated view are that a virtuous circle would
be created, strengthening the links between
business strategy and operational planning
| 11
Qualitative awareness of strategic risks
Quantitative analysis of strategic
risks informs operational plans
Quantitative control of financial /
operational risks
Qualitative interpretation of operational data brings strategic
risks to the surface
BM
R A
dvis
ors
- A
ll rig
hts
rese
rved
Key findings1. Current state of ERM implementation
2. Two types of ERM program
3. Organization of ERM programs
4. Operationalization of ERM
BM
R A
dvis
ors
- All
right
s re
serv
ed
Organization of ERM functions (1)
•ERM must not operate in parallel to the existing management structure
•Primary responsibility for the identification, ownership and management of risk MUST remain with the business itself
•Accountability for each risk must beheld at an appropriate level, while ‘tone at the top’ is established by the CEO and management team
1. Ownership of risks must be with the
business, not with the ERM team
•The choice of which function should own the ERM process is not critical provided that it has the necessary skills, relationships and knowledge
•In general, Type One programs are more likely to be managed out of Strategy & Planning functions while Type Two programs are more likely to be led out of Internal Audit, Controllership, Treasury etc
2. Functional ownership of ERM
process is less important
•Most ERM functions are staffed by very small teams, which can introduce a significant risk unless steps are taken to institutionalize the knowledge, processes and tools of ERM
•If an ERM program relies too heavily on the personal ‘equity’ of the ERM Manager, what happens if that person leaves? Does ERM cease?
3. Small ERM teams can introduce a risk
all of their own
| 13
BM
R A
dvis
ors
- All
right
s re
serv
ed
Organization of ERM functions (2)
•While some ERM functions act purely as facilitators of a process, others have much more influence over development and enforcement of risk policy
•Whichever approach is adopted, it is vital to ensure that ERM is not perceived as the “risk police”
4. Role of ERM function is different
in each company
•The intensity of ‘engagement’ between the ERM program and the business is a key determinant of success
•This in turn is influenced by risk culture – which cannot be imposed, but must be allowed to develop naturally through human interaction
5. Risk culture drives engagement, which
drives success
•Although accountability for risk management can only extend to relatively senior managerial levels, ERM Managers believe that ERM should aim to increase awareness of risk in all decisions across the business
6. ERM is generally believed to have very
‘long arms’
| 14
BM
R A
dvis
ors
- A
ll rig
hts
rese
rved
Key findings1. Current state of ERM implementation
2. Two types of ERM program
3. Organization of ERM programs
4. Operationalization of ERM
BM
R A
dvis
ors
- All
right
s re
serv
ed
Operationalization of ERM functions
Most ERM programs are operationalized around
five broad activities:
1. Gathering ‘risk intelligence’
2. Cross-functional risk discussion
3. Risk scoring and prioritization
4. Risk response
5. Reporting
Although the activity areas do not necessarily
happen sequentially, most programs reviewed
for the study operate with a natural ‘cadence’
that resembles a cyclical process
For companies starting out on the ERM journey,
gathering of risk intelligence is the most obvious
place to start
1. Gathering risk
intelligence
2. Cross-functional discussion
3. Risk scoring and prioritization
4. Risk response
5. Reporting
BM
R A
dvis
ors
- All
right
s re
serv
ed
Operationalization of ERM functions
• Most ERM programs begin with a ‘top down’ approach to gathering intelligence on risk
• Senior management takes the first cut at defining the risk universe, which is then refined through interaction with leaders of business units and corporate functions
• In some cases, intelligence about risks is harvested from IT systems, through review of ERP data – or even the outputs of continuous control monitoring
1. Gathering risk intelligence
• Cross-functional risk forums are considered essential in most programs
• They bring together insights and inputs from across the business and therefore play a critical role in ensuring truly enterprise-wide engagement
• These forums are perceived to be a key component in infusing energy into an ERM program, and ensuring consistency
2. Cross-functional risk discussion
| 17
BM
R A
dvis
ors
- All
right
s re
serv
ed
Operationalization of ERM functions
• Most programs incorporate ‘heat maps’ to support risk analysis, with axes representing the likelihood and severity of risks
• Some organizations have taken this further, to incorporate ‘effectiveness of mitigation’ or even ‘risk velocity’
• It is often impossible to compare ‘apples with apples’ – particularly when comparing strategic and operational risks, or existing and emerging risks
• The concept of Risk Capacity is not widely adopted in non-financial companies, but Risk Appetite (which is closely linked to corporate culture) is considered of far more relevance
• Some programs are defining tolerances for specific risks which can be used as the basis for business rules – creating a link between business strategy and operational planning
3. Risk scoring & prioritization
| 18
BM
R A
dvis
ors
- All
right
s re
serv
ed
Operationalization of ERM functions
• Essentially, the responses open to a company are to accept a risk; share it; mitigate it; or avoid it – but all can have serious implications
• A risk response may itself create another risk event elsewhere, through ‘risk correlation’ or the ‘law of unintended consequences’
4. Risk response
• Management and Boards must be kept fully informed of the outputs of ERM programs, but must also not become bogged down
• After the initial establishment of a program, Boards typically allow between 30 and 60 minutes per meeting for ERM discussion
• Periodic ‘deep dives’ into specific risk areas are commonly presented (often rotationally) to monthly or quarterly board meetings
• ERM Managers typically aim to report on the ‘top ten’ risks, but in practice this figure varies, depending on pragmatic assessment as to which risk factors merit board-level discussion
5. Reporting
| 19
BM
R A
dvis
ors
- All
right
s re
serv
ed
Questions that require deeper exploration
• What should be the ultimate role of the ERM function – should it be purely facilitative, or given greater ‘teeth’?
• If risk management is embedded in the role of executive management, and risk oversight is earmarked as the function of the Board, what implications does this have for the role of an ERM leader and his or her team?
• Should the ERM leader be a Chief Risk Officer with executive committee status?
The role of ERM
• Should ERM be integrated with compliance and / or internal audit – or should a solution be found by which audit, compliance etc. continue to monitor risks and controls from an historical standpoint, while ERM remains focused on emerging risks?
Integration
• How can a ‘risk culture’ best be created within the organization?• How can an appropriate balance be struck between responsibility and expectation on
the one hand, and empowerment and engagement on the other? • What infrastructure, tools and techniques are needed to ensure top-down AND bottom-
up communication about risk?
Risk culture
| 21
BM
R A
dvis
ors
- All
right
s re
serv
ed
Engaging the FEI membership
As has been seen, the study leaves a number of
questions open for discussion
We also hope that it will provoke debate around
this critical issue, which in itself will prove
valuable and interesting to FEI members
We are exploring options for further engagement
with FEI membership to take forward the
conversation we have started with this study.
Ideas may include:
Regional round table discussions in key ‘hub’ cities
Webinars
Discussions / presentations at CFRI or other FEI
conferences
| 23
BM
R A
dvis
ors
- All
right
s re
serv
ed
Who we are
BMR was founded in October 2004 by a group of
former Andersen and EY partners
We are now recognised as one of the top three tax
firms in India* and the number one M&A service
provider for the Indian market**
At the same time, we have established a global
reputation for risk and process consulting, having
delivered assignments in more than 40 countries
We have a strong track record, with most of our
partners having worked together for 20+ years
We offer the high quality that clients expect from a
major international firm, combined with a flexible
approach that fosters innovation
For the second year, we are ranked among India’s
top employers by the Great Place To Work® Institute
BMR At A Glance
Partners 27
Headcount 425 and growing steadily
Clients 200+
Practice Areas Tax & Regulatory
Mergers & Acquisitions
Risk & Advisory
Key Industries Energy
Financial Services
Infrastructure
Media & Entertainment
Retail
Real Estate
Technology
Telecoms
Locations Delhi
Mumbai
Bengaluru
Chennai
London
New York
Bahrain
Singapore
* Source: International Tax Review, 2009
* * Source: Thomson Reuters, 2009
| 25
BM
R A
dvis
ors
- All
right
s re
serv
ed
Unique model for outsourcing of risk functions
• Most BMR people – including all Partners and Directors – have a Big Four background
• We pride ourselves on the level of Partner / Manager engagement we devote to our client projects – far higher than is typical in the consulting sector
Outstanding quality
• Our clients benefit from massive cost arbitrage and generate savings of 60% or more relative to other approaches
• This is because our teams are based out of India and travel to global locations as required
Reasonable cost
• We have worked extensively on global jobs, covering multiple teams, business units and countries
• Our specialist areas include ERM, Internal Audit, SOX, AML, Decision Analytics and BPM
Demonstrable track record
| 26
To our knowledge, BMR is the only firm offering an unique global business model for the outsourcing of risk-related functions
BM
R A
dvis
ors
- A
ll rig
hts
rese
rved
Contact details
MumbaiThe Contractor Building
41 RK Marg, Ballard EstateMumbai 400 001
Tel: +91 22 3021 7000
BengaluruEmbassy Icon Annex
2/1 Infantry RoadBengaluru 560 001
Tel: +91 80 4032 0000
New DelhiThe Great Eastern Centre
70 Nehru PlaceNew Delhi 110 019
Tel: +91 11 3081 5000
LondonBerkeley Square House
Berkeley SquareLondon W1J 6BD
Tel: +44 20 7849 6100
New York100 Park Avenue
New YorkNY 10017
Tel: +1 212 880 6462
Chennai21 Sambandam Street
MandaveliChennai 600 028
Tel: +91 44 24954783/84
Singapore10 Anson Road
#09-24 International Plaza079903 Singapore Tel: +65 6408 8004
Santa Clara3940 Freedom Circle
Santa ClaraCA 95054
Tel: +1 408 834 4699
Bahrain32 Sabha Building
Diplomatic AreaManama 317
Tel: +97 313 646676