Enterprise Risk Management

---

All of life is the management of risk, not it's elimination

---

Risk management encompasses the identification, analysis, and response to risk factors that form part of the life of a business, and it is usually done with its best interest in mind. Effective risk management means total control of future outcomes proactively rather than reactively. Therefore, effective risk management offers the potential to reduce both the possibility of a risk occurring and its impact.

Enterprise risk management (ERM) in business includes the methods and processes used by organizations to manage risks and seize opportunities related to the achievement of their objectives. ERM provides a framework for risk management, which typically involves identifying particular events or circumstances relevant to the organization's objectives (risks and opportunities), assessing them in terms of likelihood and magnitude of impact, determining a response strategy, and monitoring process. By identifying and proactively addressing risks and opportunities, business enterprises protect and create value for their stakeholders, including owners, employees, customers, regulators, and society overall.

ERM can also be described as a risk-based approach to managing an enterprise, integrating concepts of internal control, the Sarbanes-Oxley Act, data protection and strategic planning. ERM is evolving to address the needs of various stakeholders, who want to understand the broad spectrum of risks facing complex organizations to ensure they are appropriately managed. Regulators and debt rating agencies have increased their scrutiny on the risk management processes of companies.

ERM Frameworks:
There are various important ERM frameworks, each of which describes an approach for identifying, analyzing, responding to, and monitoring risks and opportunities, within the internal and external environment facing the enterprise.

• Casualty Actuarial Society framework
• COSO ERM framework
• ISO 31000 : the new International Risk Management Standard
• RIMS Risk Maturity Model

Risk Responses:
Management selects a risk response strategy for specific risks identified and analyzed, which may include:

• Avoidance: exiting the activities giving rise to risk
• Reduction: taking action to reduce the likelihood or impact related to the risk
• Alternative Actions: deciding and considering other feasible steps to minimize risks
• Share or Insure: transferring or sharing a portion of the risk, to finance it
• Accept: no action is taken, due to a cost/benefit decision

Monitoring is typically performed by management as part of its internal control activities, such as review of analytical reports or management committee meetings with relevant experts, to understand how the risk response strategy is working and whether the objectives are being achieved.

Risk Functions:
The primary risk functions in large corporations that may participate in an ERM program typically include:

• Strategic planning - identifies external threats and competitive opportunities, along with strategic initiatives to address them
• Marketing - understands the target customer to ensure product/service alignment with customer requirements
• Compliance & Ethics - monitors compliance with code of conduct and directs fraud investigations
• Accounting / Financial compliance - directs the Sarbanes-Oxley Section 302 and 404 assessment, which identifies financial reporting risks
• Law Department - manages litigation and analyzes emerging legal trends that may impact the organization
• Insurance - ensures the proper insurance coverage for the organization
• Treasury - ensures cash is sufficient to meet business needs, while managing risk related to commodity pricing or foreign exchange
• Operational Quality Assurance - verifies operational output is within tolerances
• Operations management - ensures the business runs day-to-day and that related barriers are surfaced for resolution
• Credit - ensures any credit provided to customers is appropriate to their ability to pay
• Customer service - ensures customer complaints are handled promptly and root causes are reported to operations for resolution
• Internal audit - evaluates the effectiveness of each of the above risk functions and recommends improvements

Current issues in ERM
The risk management processes of corporations worldwide are under increasing regulatory and private scrutiny. Risk is an essential part of any business. Properly managed, it drives growth and opportunity. Executives struggle with business pressures that may be partly or completely beyond their immediate control, such as distressed financial markets; mergers, acquisitions and restructurings; disruptive technology change; geopolitical instabilities; and the rising price of energy.

• Sarbanes-Oxley Act requirements
• NYSE corporate governance rules
• ERM and corporate debt ratings
• IFC Performance Standards
• Data Privacy

Common challenges include:

• Identifying executive sponsors for ERM.
• Establishing a common risk language or glossary.
• Describing the entity's risk appetite (i.e., risks it will and will not take)
• Identifying and describing the risks in a "risk inventory".
• Implementing a risk-ranking methodology to prioritize risks within and across functions.
• Establishing a risk committee and or Chief Risk Officer (CRO) to coordinate certain activities of the risk functions.
• Establishing ownership for particular risks and responses.
• Demonstrating the cost-benefit of the risk management effort.
• Developing action plans to ensure the risks are appropriately managed.
• Developing consolidated reporting for various stakeholders.
• Monitoring the results of actions taken to mitigate risk.
• Ensuring efficient risk coverage by internal auditors, consulting teams, and other evaluating entities.
• Developing a technical ERM framework that enables secure participation by 3rd parties and remote employees.

A risk management strategy provides a structured and coherent approach to identifying, assessing and managing risk or uncertainties followed up by minimizing, monitoring and controlling the impact of risk realities or enhancing the opportunity potential by applying coordinated and economical resources.

Our experts partner with clients on risk management, providing perspective not only on immediate value and impact, but on long-term implications. We work closely with management and other advisers to leverage and complement their knowledge and ensure maximum impact, and actively support implementation and skill building.