Module 1 - Unit 3 (Enterprise Risk Management)

Question 1

Identify two features of an ‘enterprise wide’ approach to risk management that sets it apart from a ‘traditional’ approach to risk management.

Answer 1

• Traditional Risk Management approach:

1. Focus on risk identification and analysis.
2. Risks as individual hazards.
3. Focus on all risks managed in separate areas.
4. Risk mitigation.
5. Risk with no owners.
6. Risk is insurance.
7. Risk is not my responsibility.

• Aspects of an ERM approach

1. Risk in the context of the business strategy.
2. Risk portfolio developments with risk interconnectiveness.
3. Focus on critical risks.
4. Risk is entity-wide.
5. Identifying and defining risk responsibilities.
6. Monitoring and measuring risks.
7. Risk is embedded into everyone’s responsibility.
8. Takes an integrated or holistic approach
9. Is concerned with the management of risks that can impact the objectives, key dependencies, core processes, or stakeholder expectations of the organisation.

Question 2

Enterprise Risk Management (ERM) is considered to have significant advantages over traditional risk management approaches because ERM

A. Ensures that an organisation’s objectives will be achieved.
B. Takes an integrated or holistic approach.
C. Addresses strategic, tactical, and operational risk management.

Answer 2

B. Takes an integrated or holistic approach.

Question 3

According to RIMS, define ‘Enterprise Risk Management’.

Answer 3

• ERM is a strategic business discipline
• that supports the achievement of an organisation’s objectives
• by addressing the full spectrum of its risks
• and managing the combined impact of those risks as an interrelated risk portfolio.

Question 4

COSO has recognised that there needs to be a stronger link between strategy, risk, and performance, therefore an updated ERM framework was published in 2017.

State three reasons for the updated ERM framework.

Answer 4

1. More clearly connect ERM stakeholder expectations.
2. Position risk in the context or an organisation’s performance.
3. Enable organisation’s to better anticipate risk.
4. Provide an understanding that change creates opportunities.
5. To elevate discussion of the strategy, enhance the alignment between performance and ERM and more explicitly link ERM to decision-making.

Question 5

Explain why the COSO ERM framework puts so much emphasis on embedding risk management from the top of the organisation.

Answer 5

• This goes to the heart that ERM in risk management starts at the top of the organisation, by the management of entity-wide risks and then the same methodology spreads from there down and across the organisation.
• These entity-wide risks might well be the strategic type or risk that if they occur will impact upon the whole of the organisation.

Question 6

List three driving forces in the development of ERM in your sector or country.

Answer 6

Some of the major influences might be:

1. Laws and regulation.
2. Cultures in both the country and sector.
3. Competitor behaviour.
4. The influences of powerful stakeholders.

Question 7

The risk assessment that is required as part of the risk management process, and the business impact analysis that is the basis of business continuity planning (BCP) are closely related. Explain why this statement is true.

Answer 7

• The output from a business impact analysis is the identification of the critical activities that must be maintained for the organisation to continue to function.
• Both approaches are based on the identification of the key dependencies and functions that must be in place for the continuity and success of the business.

Question 9

Explain what is meant by ‘establishing the context’ and describe the aspects of the organisation’s risk management context, internal context, and external context.

Answer 9

• Establishing the context defines the internal and external parameters that organisations must consider when they manage risk.
• ISO 31000 states that the first stage in the risk management process is to establish the context (scope, context, and criteria).

The context has three components:

• The risk management context
• The internal context
• The external context

The aspects of the risk management context are:
• risk architecture, strategy, and protocols (or risk management framework) RASP
• the framework provides support for the RM process within the organisation
• Ensure the outputs from the RM process are communicated to internal and external stakeholders.
• Includes responsibilities and identifies resources that will be required
• Establishment of the risk appetite (risk criteria), and of the overall total risk exposure.
• Important to deliver RM strategy and develop a risk-aware culture (LILAC)
• Identify emerging risks

Aspects of the internal context are:
• The culture of the organisation
• The available resources
• Objectives and strategy
• Core processes
• Decision making
• Risk Management governance
• Internal stakeholders and their expectations.

Aspects of the external context are:
• Sector
• The environment within which the organisation exists
• Industry
• External stakeholders and their expectations
• External financial environment
• Industry regulations and regulators
• Behaviour of competitors

Question 10

The FIRM Risk Scorecard provides a structure for carrying out detailed evaluation of the context of the organisation.
State which components are evaluating the internal context, and which are evaluating the external context.

Answer 10

Internal Context:
• Financial
• Infrastructure

External Context:
• Reputational
• Marketplace

Question 11

Explain five reasons why setting business objectives can be difficult.

Answer 11

1. It’s hard to choose a range of suitable business objectives to support the strategic mission
   - organisation’s have to balance the conflicting expectations of stakeholders
   - the result can be a range of compromises or potentially conflicting objectives
2. The organisation’s strategies and objectives need to be continuously questioned because the internal and external context of an organisation is constantly changing
3. If there is an inappropriate strategic mission/mission is not clear and understood at all levels of your organisation, people are likely to interpret the mission in different ways.
4. The formal objectives might be at variance with the informal objectives
   - an organisation might issue a range of objectives to its staff, but if these objectives are not fully accepted by those people charged to deliver them, then you can already see risks arising even in the objective-setting process.
5. It is likely to increase its risk exposure if it sets its objectives as being over-ambitious

Question 12

Explain how objectives can be set at different levels within the organisation.

Answer 12

A. Organisations must set the overall, organisation-wide strategic objectives.
• all objectives should be supporting of, and be aligned with the strategic mission and purpose of the business

B. Organisations must then agree on compatible tactical objectives
• at the level of departments, divisions, or business units
• these will focus on the implementation of strategy, and these will typically cover timescales of around 1-3 years

C. The tactical objectives will be further delegated into the operational objectives
• of teams and even individual personnel
• covering a much shorter period of time, ranging typically from days to months.

Question 13

Draw a diagram to represent the three levels of objective setting.

Answer 13

See study guide Figure 3.2 ‘The three levels of objective setting’.

(3.4)

Question 14

List two major objectives of internal control

Answer 14

1. Safeguard and protect the assets of the organisation
2. Ensure the keeping of accurate records
3. Ensure compliance with laws and regulations
4. Safeguard the interests of shareholders/stakeholders

Question 15

Describe four barriers that can occur when an organisation seeks to implement enterprise risk management (ERM).

State one action to overcome each barrier that you have identified.

Answer 15

1. Lack of understanding of risk management and belief that it will suppress entrepreneurship
   • Establish a shared understanding, common expectations and consistent language across an organisation.
2. Lack of support or commitment from senior management
   • Identify a sponsor on the main board of the organisation and confirm shared and common priorities.
3. Seen as just another initiative so relevance and importance not accepted.
   • Agree a strategy that sets out the anticipated outcomes and confirms the benchmarks for anticipated benefits.
4. Benefits not perceived as being significant.
   • Complete a realistic analysis of what can be achieved and the impact on the mission of the organisation.
5. Not seen as a core part of business activity and too time-consuming.
   • Align effort with core processes and achievement of the mission of the organisation
6. Approach too complicated and over-analytical
   • Establish appropriate level of sophistication for risk management framework and undertaking risk assessments
7. Responsibilities unclear and need for external consultants unclear
   • Establish agreed risk architecture with clear roles and accepted risk responsibilities.
8. Risk separated from where they arose and should be managed
   • Include risk management in job descriptions to ensure risks are managed within the context that gives rise to them.
9. Risk management seen as a static activity and not appropriate for a dynamic organisation.
   • Align risk management efforts with the mission of the organisation and with the business decision-making activities.
10. Risk management too expansive and seeking to take over all aspects of the company.
    • Be realistic: do not claim that all of the business activities within the organisation are risk management by another name.

Question 16

List three actions that would help to avoid a repeat of the global financial crisis.

Answer 16

1. There should be a common process, terminology, and practices for managing risks of all kind.
2. It is essential that risk tolerances be fully understood, communicated and monitored across the enterprise.
3. Risk management practices should be incorporated into all key business processes and decisions.
4. Management should make risk-related decisions using dedicated high-quality risk information.