Date post: | 11-Jan-2016 |
Category: |
Documents |
Upload: | denis-chapman |
View: | 213 times |
Download: | 1 times |
Enterprise Risk Management
A perspective on implementing an enterprise
risk approachUniversity of Illinois
April 5, 2005
ERM Origins and Rationale
What is risk and risk management?
Company organizational issues
The role of technology
A common language
Statistical modeling and risk experts
Origins
Risk is defined, operationally, as choice under conditions of uncertaintyRisk management, as a 1970’s phenomenon, was related to catastrophe planningIn the 1980’s RM is redefined by the TQM movementEarly 1990’s ERM emerges from consultancies such as PWC, E&Y and Deloitte
Enterprise Risk Management Defined
“A rigorous approach to identifying, assessing and addressing risks from all sources that threaten the achievement of an organizations strategic, operational and financial objectives and/or represent an opportunity or competitive advantage.”
Jerry Miccolis, Tillinghast-Towers Perrin
Enterprise Risk Management ‘s Objective
“Enhancing enterprise value by improving capital efficiency, supporting strategic decision-making and building investor confidence
Jerry Miccolis, Tillinghast-Towers Perrin
Risk Categories (first order risks)
Financial Operational StrategicCurrency Service quality Business design
Interest rate Product quality Brand
Credit Info. Systems Competition
Liquidity Trans. Processing Partnerships/Alliances
Market Company Policy Reputation
Fraud Intellectual Property
Political Merge/Acquire/Divest.
Human Resources Market Capitalization
Culture
Systemic/Exogenous
Tools for Enterprise Risk Modeling
Standard statistical models not sufficient
Structural models
System Dynamic simulation
Enterprise Risk Management
• ERM is not a project, but a process that develops within an organization, driven and supported by senior management
• ERM becomes part of the operational culture of the organization with process owners and drivers
• There is not an off-the-shelf ERM product that works for everyone.
ERM begins with the development of a risk strategy that is linked to and supportive of the overall business
imperatives of the corporation.
Components of ERM
Understand capacity to bear and propensity to assume risk
Establish a robust, yet scalable, process for risk identification and assessment
Evaluate risk on a portfolio basis, with a keen understanding of natural hedges that might exist among risks
Establish a framework and process that allows for a balancing of risk control activities with risk financing mechanisms within business processes
Risk management silos with conflicting goals cross paths…
Internal Audit
Risk Mgmt
Treasury
Legal
Info Tech
HR
Operational
Financial
Human Resource
Environment
Technology
Strategic
An enterprise approach..
Internal Audit
Risk Mgmt
Treasury
Legal
Info Tech
HR
Operational
Financial
Human Resource
Environment
Technology
Strategic
Enterprise RiskStrategy and
Methodology
Risk Management Thinking Has Evolved
Old Thinking
No risk management strategy
Risk management limited to certain areas
Risk analysis in silos
Risks not owned
Inspect, detect, react
Correlation among risks not understood
Strategy
Risk strategy linked to business strategyRisk culture created throughout the enterpriseRisk management is a continuous, systematic process integrated within the enterprise’s cultureRisk management responsibilities clearly definedAnticipate, manage, optimize and monitor riskRisk is quantified, aggregated and studied for interrelationshipsRisk is a key consideration for financial decision making
NEW
ERM Examples
Industry Issue Process Result
Manufacturing Need to better understand its business exposures and the potential risks as a result of corporate governance issues.
Developed formal ERM methodology to identify key risks within the organization along with management strategies.
Formal ERM oversight committee formed; RM a critical part of strategic planning process.
Energy Needed to better understand its business risks as it faced broad regulatory changes; desire to reinvent itself in the marketplace.
Formal process of risk identification, prioritization and measurement was developed.
Risk management became an integral part of the business decision making process.
Communications and Consulting
Concern of the business risks faced by its decentralized operations.
After broad evaluation of risk profile, attention was focused on technology risk within each of the major operating companies.
Risks were identified and common technological risks were assessed and addressed at business unit level and aggregated at corporate level.
Financial Consulting Concern that financial consulting engagements were not considering operational risks
Developed formalized process for evaluating risk on a project by project basis
Risk management process identified; risk owners specified; process documented and consolidated
ERM Oversight
Board of Directors
CEO
Enterprise Risk Management Committee
Enterprise Risk Manager
Business Unit
Business Unit
Business Unit
Business Unit
Business Unit
ERM Oversight
Enterprise Risk Management Committee
Determine RM strategies and goals
Coordinate development of RM program
Evaluate RM infrastructure
Develop/Evaluate identification and measurement methodologies
Identify risk owners and establish accountabilities
Develop and operate RM policy
Risk Analysis Process
Risk Information
Database
ManageAnticipate and React
Communicate
Assess
The process is followed in the context of the overall risk strategy.
•Diversify•Share•Control•Avoid
• Identify/ Source
• Measure• Prioritize
•Risk Owners•Risk Experts•Management•External
• New Hazards• Internal Business
Changes• External
Influences
An Initial Risk Profile
Operational Risk•Contract Performance•Trademark Erosion•Customer Satisfaction
Financial Risk•Currency•Credit•Debt Covenants•Accrual Accuracy
HR Risk•Benefits•Key Management Loss•Stock Ownership Program•Succession Planning
Environment Risk•Terrorism•War•Political Stability•Regulatory- Local/ Nat’l•Public Relations
Technology Risk•Infrastructure Failure•Security•Consistent Strategy•Obsolescence
Strategic Risk•Competition•R&D Resource •Missed Market•Reputation•New Market Entrant•Major Customer (s) Loss
Identification of Key Business Risks- Example
Business Unit Risk Category Specific Risk Likelihood SeverityAll Business Regulatory Medium Moderate to Major
All Business Reputation Medium Moderate to MajorAll Financial Liquidity/ capital access Medium ModerateAll Financial Foreign Exchange Medium to High Moderate to MajorAll Market Interest Rate Medium to High Moderate to Major
All Market Market Availability for Product Low Light to ModerateAll Operational Trade Name Erosion Low Light to Moderate
All Operational Internet Use Low to Medium Moderate to Major
All Operational Customer Satisfaction Low to Medium Light to ModerateAll Operational Patent Infringement Low ModerateAll Operational Information Processing/ Technology Medium Moderate to Major
All Operational Management Fraud Low Moderate to Major
All Operational Employee Fraud Low ModerateAll Operational Leadership Medium Moderate to MajorAll Operational M&A Medium to High Moderate to Major
All Operational Errors and Omissions Medium to High Moderate to Major
All Operational Errors and Omissions Medium to High Moderate to Major
All Operational Errors and Omissions Medium to High Moderate to Major
Risk MapNatural Risks
N1 Earthquake
N2 Volcanic eruption
N3 Fire/EC – PD & BI
N4 Contingent BI
N5 Adverse weather
Financial Risks
F1 Exchange rate
F2 Insolvency
F3 Interest rate
F4 Strategic investment
F5 Nonpayment
F6 Inconvertibility
F7 Government control
F8 Portfolio default
Employment Risks
E1 Benefits
E2 Normal WC
E3 Catastrophic WC
E4 Fiduciary
E5 Employers liability
Operational Risks
O1 Product tampering
O2 Political trade risk
O3 Key executive
O4 Product piracy
O5 Kidnap and ransom
O6 Information security
O7 Employee disSampleesty
O8 Inventory obsolescence
O9 Theft
Liability/Litigation Risks
L1 Business practices (antitrust)
L2 Copyright-patent infringement
L3 Products liability
L4 Contractual risks
L5 Errors and omissions
L6 Employment practices
L7 General liability
L8 Auto liability
L9 Vendors and contractors
L10 Misc. liability
L11 Public network
L12 D&O
SEVERITY
Low
High
$250M
$200M
$100M
$50M
$25M
$10M
$1M
1 5 20 30 50 100 150 250 >250
FREQUENCYLow High
Annual events
N1
O3
O2
O1
N2
O5
N4
E2
F6
F7
N3
O6
O6
L8
E4
E4
L1
F4
O9
L2
O7
O7 E5
L4
L4
F5
F5
L5
L5
N5 L9
L7
L10
L3
L3
L7 L6
L6
F2
O8
O4
F1
F1
E2
E2
E1
E1 F3
F3
Retained
Partially retained
Transferred
Ten key questions to consider…
What is our appetite for risk? (capacity and propensity)
Do we know what our risks are?
Do we know how those risks relate to one another?
Who within our company “owns” those risks?
Can we measure those risks?
Have we evaluated non-traditional risks?
Does everyone at our company understand their role in managing risk?
Is effective risk management linked to performance evaluations?
Is risk considered in all facets of decision making?
Does our company continually look for ways to optimize risk strategy?
ERM – 10 Phase Approach
Identify needs, objectives and
ERM champion
Phase 1
Identify managers
and key risk constituents
Phase 2
Brainstorm to identify key risks
Phase 3
Prioritize risks
identified (qualitative)
Phase 4
Develop risk “short list”
Phase 5
Specific Risk Severity Rating Likelihood Rating Manifestation Rating Overall Rating
1.
2.
3.
Phase 6
Identify mitigating & aggravating risk
factors
Phase 7
Assess current risk management controls
(specific risk)
Phase 8 Phase 9
Develop risk map and gap
analysis
Phase 10
Design action plans with risks owners
Phase 1 Identify Needs and Objectives
The first phase of the ERM process is to identify the key objectives of the ERM undertaking. This will help to establish timelines, priorities and key responsibilities.
Sample Corporation’s Program: To uncover and measure areas of high-potential risks
Develop and measure risk mitigation processes – specifically focused toward key risks
To create a risk aware culture by formally bringing risk consideration into strategic decision-making
To improve capital efficiency by providing an objective basis for allocating resources
To create an internal risk communication tool for building and supporting shareholder confidence
To establish a process that will help the company protect results
Phase 1 (continued) Identify ERM Champion(s)
A critical component of this initial phase is to identify the internal “champion” of the ERM project. This “champion” needs to be a senior executive within the organization. In many cases, the “champion” is the CEO, COO, CFO or even the Board of Directors.
Sample’s Program:For our “key” risks, the CEO personally takes the champion’s role in addressing these risks. “If I’m not responsible for the key risks facing this company, then who is?”
For operating level risks, the Presidents assume responsibility or directly assign responsibility.
This initial step is critical to the success of the ERM undertaking.
Phase 2 Identify Managers and Key Risk Constituents
The ERM process should include active participation from the operational executive manager’s identification and the key operational and strategic managers within the organization.
This group should have knowledge of the business and insight into the business issues that affect the operations. This group will be the core team involved in the risk identification process.
Sample’s Program:Each operating group’s ERM working group consists of the senior manager of the group and the direct reports.
Phase 3Brainstorm to Identify Key Risks
Process to uncover and prioritize the key risks faced by the organization.
After the risks are captured, the group discusses each risk and clarifies any misunderstandings about what the risk. Common risks and duplicates are identified and combined. It is important that you listen to your “experts” on the risk areas to help you gauge the risks. No one is an expert on everything.
Sample ProgramBrainstorming by the ERM Working Group to identify risks that they feel the company faces. A facilitator assists the group in the identification and prioritization. Some of the general ground rules include:
• Each person can contribute as much as they want
• Everyone should contribute
• No judgments or comments- just capture information
• No risk is too insignificant
•Resources are called upon as needed to clarify and explain nuances
Phase 4Prioritize Risks Identified (qualitative)
The risk list identified in Phase 3 will be long and the goal of this phase is to reduce the list so the critical risks surface to the top. This is best accomplished through a multi-voting exercise. Trying to deal with too many risks can bog down your process and cause you to miss achieving your objectives.
Sample Program: • Each participant will receive a specified number of votes, i.e., (n/2)+1 where n equals the
number of items – this is rule of thumb
• Each participant must use all votes
• One vote per risk per participant
• The group eliminates risks not receiving enough votes
• The process is repeated until the list is reduced to only the key risks
Phases 5 and 6Develop Short List/ Quantify Risks
The key risks identified in Phase 4 will now be subject to a quantitative rating methodology that considers the following risk attributes:
• Severity – Refers to the potential financial impact once an event occurs.
• Likelihood – Measures the probability of an event occurring.
• Manifestation –Measures the probable elapsed time from identification of a potential problem to its manifestation, i.e., how long it takes the risk to become a “full grown problem.”
OR
• Recovery – Measures how long it will take to fully recover from the loss.
Phases 5 and 6 (continued)Develop Short List/ Quantify Risks
Sample ProgramIdentify a specific “reasonable, but catastrophic” loss scenario
Identify or assign a risk owner/champion
Severity – determine estimated or expected size of loss (with a loss period of three years or less)
Likelihood – determine the probability that the loss will occur over a period of time, i.e., 50:50 chance of occurrence in the next “X” period of time
Recovery – estimate of the time it will take to recover (fully?) from the loss
Metrics (partial):
(1) Risk Value = Severity times Likelihood
(2) Pure Risk Value = Severity times Likelihood times Recovery
Severity
Severity refers to the potential financial impact once an event occurs. The table below provides an example of ranges of impact on revenue and expense and a score that could be assigned to the risk identified.
5 5 5 5 5 5 5 54 4 4 4 4 5 5 53 3 3 4 4 4 5 53 3 3 3 3 4 4 52 2 2 3 3 4 4 52 2 2 2 3 3 4 51 1 2 2 3 3 4 50 1 2 2 3 3 4 5
Revenue/Assets
0 150%
Expense/L
iability
150%
0
Likelihood
Score Description
1 1 event per 100+ years
2 1 event in 20 - 100 years
3 1 event per 5 - 20 years
4 1 event per 1 – 5 years
5 Regularly Occurring
Likelihood measures the 50:50 probability of an event occurring. The table below presents and example of how to measure the score and time horizon to consider.
Manifestation/Recovery Time
Score Description
1 Greater than 3 years
2 1 to 3 years
3 About 1 year
4 1 week to several months
5 1 week or less
This element measures the probable elapsed time from identification of a potential problem to its manifestation. The table below provides a sample matrix.
Phase 7Identify Mitigating/Aggravating Factors
In the business operation there are both mitigating factors and aggravating factors that can have an impact on the severity, likelihood and/or manifestation of the risk. These factors can be either external impacts or internal impacts.
Mitigating factors are those factors that currently limits or reduces the likelihood or consequence of the risk. A mitigating factor could be existing management efforts, education and training, process testing and improvement, government intervention, or being in a monopolistic position.
Aggravating factors are those factors that currently increases or expands the likelihood or consequence of the risk. An aggravating factor could be political factors, prior poor experiences, lack of a plan for action, fast moving industry changes, or the complexity of the situation.
Phase 8Assess Current Risk Management Controls
Phase 8 of the process is intended to consider the company’s current policies, procedures, management practices, and any other mitigating factors that are in place to manage the identified risks.
Sample Program:Self assessment by management of the current controls in place to manage the claim on a scale of 1 (great) to 5 (non-existent). The assessment is a gauge against known peer best practices for managing this type of risk or an assessment of what is reasonably available to manage the risk.
Management Rating
Score Description
1 Best-in-class risk management processes in place
2 Risk management process would rank in the top 10%
3 Good risk management process
4 Risk Management process needs improvement
5 Non-existent risk management processes
The table below is an example of how a company might evaluate the effectiveness of the controls in place to manage the identified risks.
Sample Risk Map
0.00
1.00
2.00
3.00
4.00
5.00
0.00 5.00 10.00 15.00
Time and Probabilty Element (If and When)
Ris
k S
everi
ty (
Imp
act)
Risk "A"
Risk "B"
Risk "C"
Risk "D"
Risk "E"
Risk "F"
Phases 9 and 10Develop Risk Map, Gap Analysis and Action Plans
Risk Map
The risk map is a graphical representation of the key risks identified. The location of the “bubble” on the map depicts time element and severity. The size of the bubble presents the perceived effectiveness of management controls in place. The smaller the bubble, the better the controls.
0
2
4
6
8
10
1 2 3 4 5
Risk Dashboard- Gap Analysis
Management Effectiveness
Inherent Risk
Specific Risk Management Action Plan
Risk Description
How risk relates to business objectives
Risk Owner
Aggravating Factors
Mitigating Mitigating
Current Risk Management Strategy and Activities
Risk Management Action Plan
Risk A
Enterprise Risk Management
A perspective on implementing an enterprise
risk approach
Questions????