Assignment 4: Enterprise Risk Management

Question 1

Four Major Differences Between RM and ERM

Answer 1

1. Risk categories
2. Strategic integration
3. Performance metrics
4. Organizational structure

Question 2

Risk Categories (Traditional RM vs. ERM)

Answer 2

RM: Pure risk only
ERM: Both pure and speculative risks (and the interrelationships between them)

Question 3

Strategic Integration (Traditional RM vs. ERM)

Answer 3

ERM is integrated with the entire organization’s strategy, while RM is siloed

Question 4

Exposure Spaces Model

Answer 4

A three-dimensional depiction of attributes – resources, events, and impacts – which is used in ERM to consider the range of potential impact from positive to negative

Question 5

Performance Metrics (Traditional RM vs. ERM)

Answer 5

RM: Measures activity and result, without considering a more balanced equilibrium between the strategic goals and the risk
ERM: Seeks to optimize risk taking in relation to strategic goals

Question 6

Organizational Structure (Traditional RM vs. ERM)

Answer 6

RM: Generally reports to a centralized organizational department
ERM: Unlike RM, engages all of the organization’s stakeholders in the risk management process – it is both iterative and recursive

Question 7

Chief Risk Officer (CRO)

Answer 7

Also known as an enterprise risk manager, they are a senior risk professional who has oversight over an organization’s enterprise risk management function

They help their enterprise create a risk culture in which individual department heads and project managers are identified as risk owners

Question 8

Risk Owner

Answer 8

Someone who is responsible for managing risks from a specific center or operation

Question 9

Strategic Planning

Answer 9

The process by which an organization’s board and executives develop, refresh, and refine its strategies in line with its view of the future

Question 10

Business Model

Answer 10

The core aspects of an organization, including its vision, mission, strategies, infrastructure, policies, offerings, and processes

It is recognized in ERM that this will not survive indefinitely

Question 11

Improvements in Strategic Decision Making (by incorporating ERM)

Answer 11

1. It can address potentially devastating threats
2. It can exploit opportunities by incorporating them into its current business model or completely reinventing a new model that will successfully carry it into the future
3. It can use ERM as a process to manage unwanted variations from expectations

Question 12

Process to Integrate ERM

Answer 12

1. Develop ERM goals (establish the internal and external contexts)
2. Identify risks (risk assessment)
3. Analyze, evaluate, and prioritize critical risks (risk assessment)
4. Treat critical risks, considering priority (risk treatment)
5. Monitor critical risks (monitor and review)

Question 13

Categories/Techniques for Treating Risks to Strategy

Answer 13

Avoid: Use alternative approaches that eliminate the cause of the risk or its consequences

Accept: Accept the risk by planning for ways to deal with the uncertainty if it occurs

Transfer: Assign the responsibility to manage the risk to a third party

Mitigate: Initiate activities to reduce the probability, impact, or timing of a risk event to an acceptable risk tolerance

Optimize/Exploit: Develop actions to optimize positive consequences to achieve gains

Question 14

Enhanced Decision Making

Answer 14

This is one of two important benefits to adopting an ERM approach and has the following advantages:
1. Increased profitability (economic efficiency)
2. Reduced volatility
3. Improved ability to meet strategic goals
4. Increased management accountability

Question 15

Improved Risk Communication

Answer 15

This is one of two important benefits to adopting an ERM approach and has the following advantages:
1. Management consensus: ERM creates a corporate culture that embraces risk as an additional component of each decision
2. Stakeholder acceptance: ERM builds a spirit of cooperation among management, which subsequently instills confidence among all employees. It also establishes management strategies that protect assets and reputation, which encourages the buy-in of external stakeholders

Question 16

ISO 31000:2009

Answer 16

Provides an international standard for risk management as well as a generic approach to risk management applicable within any industry sector

Three major parts are principles, framework, and processes for managing risk

It is not certifiable, but some other ISO standards are

Question 17

BS 31100

Answer 17

A code of practice for risk management with the following four primary goals:
1. Ensuring that an organization achieves its goals
2. Ensuring that risks are managed in specific areas or activities
3. Overseeing risk management in an organization
4. Providing “reasonable assurance” on an organization’s risk management

Question 18

COSO II

Answer 18

Provides an effective mechanism for initiating a dialogue with an organization’s board and its senior executives about establishing ERM goals as part of the strategic management process

Intended audience is organizations of sufficient size to examine risk appetite at the board level

Question 19

AS/NZS 4360

Answer 19

A joint Australian/New Zealand Standard for ERM intended to provide only a broad overview of risk management

They later adopted ISO 31000:2009 renaming it AS/NZS/ISO 31000:2009

Question 20

The Federation of European Risk Management Associations (FERMA)

Answer 20

An organization consisting of national risk management associations, individual risk managers from Central European countries, and representatives from health organizations, educational sectors, and public sectors

Adopted Risk Management Standards with several elements:
1. The establishment of consistent terminology
2. A process by which risk management can be executed
3. An organized risk management structure
4. Risk management goals

Question 21

Basel II

Answer 21

Established an international standard that banking regulators can use when creating regulations regarding the amount of capital banks need to keep in reserve to guard against the financial operations they face