7.3 Enterprise risk management Flashcards
What is enterprise risk management?
ERM is a process, effected by the board, management and other personnel, applied in strategy setting, designed to identify potential events and manage risk to be within risk appetite, providing reasonable assurance regarding achievement of objectives.
Three essential characteristics distinguish ERM from standard risk management:
- a h______ focus
- emphasis on v_____-a______ risk management
- blending f_____ and i________ risk management tolls
holistic
value-added
formal
informal
Why is ERM a “holistic” process?
ERM should be applied across the whole organisation.
What is the traditional “silo” approach to risk management?
Different categories of risk were managed individually by different people, ignoring gaps and interconnectivities between risks.
What is the main way to achieve holistic ERM?
Through a central risk function under the controk of a chief risk officer.
ERM is a value-add activity. What does this mean?
ERM should, if applied correctly, create and protect value to an organisation through effective strategic-level risk management decision making.
ERM has both formal and informal factors. What do we mean by formal factors?
The tangible systems, processes, procedures, policies and committees that make up the risk management system.
ERM has both formal and informal factors. What do we mean by informal factors?
Intangibles such as culture, social networks and the way risk management is perceived.
List some benefits of ERM.
Improve reporting to support strategic decisions Avoidance of silos Improved operational efficiency Better cost effectiveness Improved profitability and equity value Improved ability to achieve objectives Consistent decision making Effective resource allocation Spreading risk ownership to local experts
The key elements of an effective ERM process are:
- ERM policies and p_________
- risk a________
- enterprise risk r___________
- r___ and a____ committees
- escalation and w_____________
- business c__________ management
procedures appetite reporting risk audit whistleblowing continuity
List some key elements of an ERM policy.
- the overarching approach to risk
- how risk aligns with mission, vision and values
- specific risk management objectives
- how the organisation balances risk and opportunity
- a high level overview of the ERM process
- a statement on organisational risk culture
- roles and responsibilities for ERM
- the ERM reporting structure
Why is risk appetite important to ERM?
The organisation must understand the risk it is willing to take and that which it is not.
Why can a combined risk and audit committee be problematic?
Audit committees are usually focused on risk reduction and so may not give positive risks their due consideration.
Why is escalation and whistleblowing important?
Concerns regarding control failures or unauthorised policy breaches including criminal acts must be reported to a single point of contact.
What do we mean by “business continuity management”?
Processes that ensure that the impacts of risk events are properly managed and mitigated.
