Mod 31: ERM implementation

Question 1

Outline the key considerations when scoping a project to implement ERM ©

Answer 1

Key considerations when scoping an ERM project
* Resourcing
1. internal and/or external staff risk
2. champion / sponsor to judge benefits vs costs of ERM
* Proportionality
1. size of risk exposure
2. sophistication / complexity of the business
* Top-down and/or bottom-up
1. structure and policies established first (top-down)
2. data collection & analysis fed up to decision makers (bottom-up)

Question 2

List three main stages a business typically moves through as their RM capabilities mature

Answer 2

Three stages of ERM maturity
1. loss reduction
2. uncertainty management −
* credit models to better understand credit risk and predict losses
* market risk measurement and management techniques, simulation models, VaR, economic capital
* increased management of operational risks, eg crisis management and prevention
* improved corporate governance
* wider application of risk transfer, eg derivatives, ART
3. performance optimisation
* more integrated approach to RM
* RM as part of decision-making processes ©

Question 3

Outline two key challenges to ERM implementation and how they might be addressed
©

Answer 3

1. lack of risk awareness
   * set the tone from the top (CEO role models behaviours)
   * ask the right questions about ‘risk’ (return/risk balance, limits and controls on downside risk, systems, knowledge)
   * establish a common risk taxonomy
   * provide induction training and ongoing education
   * link compensation to risk, to reward desired behaviours
2. inappropriate risk-culture
   * set the tone from the top
   * aim for incremental change as new recruits change the views of existing staff
   ©

Question 4

Outline the stages of a three-stage ERM maturity model

Answer 4

1.
Early – risk management and internal control activities exist in part but are inconsistently applied and not well understood. Significant opportunities for enhancement remain.
2.
Intermediate – risk management and internal control activities are established, but not consistently applied or fully understood in key functions / business areas. Moderate opportunities for enhancement remain.
3.
Advanced – risk management and internal control activities are established, consistently applied and well understood across the organisation. Opportunities for enhancement remain to align and coordinate activity across the organisation.
(This is the IAA model.) ©

Question 5

Outline the areas to consider when assessing the maturity of an ERM framework
©

Answer 5

Areas to consider in an ERM framework when assessing its maturity
* Corporate governance
Board’s role, risk appetite definition, RM policy, management accountabilities and commitment to RM, responsibilities and resources of RMF
* Risk language and culture
common taxonomy, appropriate RM culture
* Competencies and performance management
aligned with ERM, full range of processes
* RM processes, solvency assessments, reporting and monitoring
range and sophistication, comprehensive reporting, audit of compliance with RM policies, application of RM techniques to new activities, business continuity