sec D Flashcards
1
Q
Risk:
A
Any event/action that hinders achieving objectives.
2
Q
Uncertainty:
A
Unknown outcomes, can be positive or negative.
3
Q
Traditional Risk Management (TRM) vs Enterprise Risk Management (ERM)
A
Scope Departmental or siloed, focused on specific areas Holistic and organization-wide, covering all aspects of the organization
4
Q
A
5
Q
Traditional Risk Management (TRM) Enterprise Risk Management (ERM)
A
Focus Specific types of risks (e.g., market risk, financial risk, hazard risk) All types of risks, including strategic, operational, financial, compliance, and reputational
6
Q
A
7
Q
A
8
Q
Risk
A
Any event/action that hinders achieving objectives.
9
Q
Uncertainty
A
Unknown outcomes, can be positive or negative.
10
Q
Traditional Risk
Management
(TRM) vs
Enterprise Risk
Management
(ERM):Scope :
A
Departmental or
siloed, focused on
specific areas
Holistic and
organization-wide,
covering all aspects
of the organization
11
Q
Traditional Risk
Management
(TRM) vs
Enterprise Risk
Management
(ERM):Focus
A
Specific types of
risks (e.g., market
risk, financial risk,
hazard risk)
All types of risks,
including strategic,
operational,
financial,
compliance, and
reputational
12
Q
Traditional Risk
Management
(TRM) vs
Enterprise Risk
Management
(ERM):Objective
A
Mitigation, loss
prevention, and
avoidance of
specific risks
- Identify, assess,
and manage risks
comprehensively
- Maximizes risk
coverage,
minimizing
overlooked risks
- Enhances both
short-term and longterm stakeholder
value
13
Q
Traditional Risk
Management
(TRM) vs
Enterprise Risk
Management
(ERM):Perspective
A
Reactive, addresses
risks as they occur
Proactive and
integrated,
anticipating risks
before they arise
14
Q
Traditional Risk
Management
(TRM) vs
Enterprise Risk
Management
(ERM):Risk Ownership
A
Handled by specific
departments or risk
managers
Shared across all
levels of the
organization
15
Q
Traditional Risk
Management
(TRM) vs
Enterprise Risk
Management
(ERM):Decision-Making
A
Treats individual
risks independently,
with focus on
minimizing loss
Considers the
interdependence of
risks and their
collective impact
16
Q
Traditional Risk
Management
(TRM) vs
Enterprise Risk
Management
(ERM):Risk Types
Addressed
A
Physical, financial
risks (e.g., theft,
accidents)
Includes strategic,
financial,
operational,
compliance,
reputational risks,
etc.
17
Q
Traditional Risk
Management
(TRM) vs
Enterprise Risk
Management
(ERM):Tools and
Techniques
A
Insurance, audits,
safety protocols
Risk appetite
frameworks,
scenario planning,
key risk indicators
18
Q
Traditional Risk
Management
(TRM) vs
Enterprise Risk
Management
(ERM):Why it Matters -
A
Focus on specific
risk types.
- Tends to be
reactive.
- Provides a
forward-looking,
process-oriented
framework.
- Ensures all risks
(financial,
operational,
strategic,
compliance) are
addressed.
19
Q
Benefits of Risk Management
A
1)Increased Shareholder Value: Reduces losses and capitalizes
on opportunities for better financial returns.
2)Fewer Operational Disruptions: Anticipates risks, ensuring
smooth operations and stability.
3)Efficient Resource Utilization: Allocates resources effectively
and controls costs to maximize asset use.
4)Enhanced Confidence: Builds trust with stakeholders and
regulators, improving reputation and compliance.
5)Effective Strategic Planning: Aligns risk management with
long-term goals and business objectives.
6)Timely Opportunity Response: Enables quick assessment of
risks and opportunities to maintain a competitive advantage.
7)Improved Contingency Planning: Prepares the organization to
react effectively to risks and uncertainties.
20
Q
Contingency Planning
Definition:
A
Creating alternative plans for potential negative
events.
effectiveness.
21
Q
Contingency Planning Process:
A
Identify risks, develop tailored plans, and ensure cost
22
Q
Contingency Planning Benefits:
A
Faster responses, competitive advantage, and longterm savings
23
Q
Types of Risk
A
Business Risk:
Strategic Risk:
Operational Risk:
Financial Risk
Hazard Risk:
Speculative Risk:
Capital Adequacy Risk
24
Q
Business Risk with example
A
Variability in earnings due to factors like
demand, pricing, and operating leverage.
Examples: Demand fluctuations, changes in prices or input
costs, operating leverage changes
25
Strategic Risk with example and challanges
Risks that affect the organization at a high level,
including economic, market, and regulatory risks.
Examples: Economic risk (recession), reputation/brand
damage, political risk (currency devaluation, expropriation,
civil unrest).
Challenges: Global in scope, hard to manage directly.
26
Operational Risk with example
Risks from internal process failures, people,
or systems.
Examples: Supply chain disruptions, technological failures,
legal or compliance issues.
Management's Role: Easier to mitigate compared to
strategic risks
27
Financial Risk with example
: Risks impacting an organization's financial
health, such as capital availability, interest rates, and liquidity.
Examples: Credit risk (default), foreign exchange volatility,
liquidity risk, borrowing risks.
Risks: Solvency, interest rate, reinvestment, and credit risks.
28
Hazard Risk with example
Insurable risks like natural disasters, accidents, or
liabilities
Examples: Property insurance, key person insurance,
liability insurance.
29
Speculative Risk with example
Risks with uncertain outcomes that can result
in a gain, loss, or no change.
Examples: Gambling, financial investments.
30
Capital Adequacy Risk
The risk that a financial institution lacks
enough capital to absorb losses or fulfill obligations.
Explanation: Ensures financial stability by maintaining a
capital cushion.
Key Point: Regulated banks must maintain capital adequacy
ratios (CAR) to manage risks.
31
Volatility
Inconsistency or unpredictability in outcomes, Increases
uncertainty and the likelihood of poor outcomes.
32
Time:
The longer the timeframe, the higher the exposure to risk,
Increases chances of adverse events like delays or cost overruns.
33
Risk Attitude
Risk Seeker: Individuals who enjoy taking risks.
Risk Neutral: Individuals who weigh pros and cons before
deciding to take a risk.
Risk Averse: Individuals who avoid uncertainties and risks.
34
Risk Management Process
The Risk Management Process follows a structured approach to identify,
assess, and mitigate risks that could hinder an organization's objectives
35
Risk Identification :
Identify all potential risks that could negatively impact the organization’s ability to meet its objectives.
36
Responsibility of risk identification
Managers are responsible for identifying risks.
The Board of Directors oversees risk identification activities.
37
Internal Events
1)Capital Investments: Investments supporting customer demand or improving operations.
2)Technological Change: Changes that require new processes.
3)Personnel Events: Issues like work stoppages or loss of key
staff
38
Key Areas to Identify Risks:
Internal Events and External Events:
39
External Events:
1)Economic Events: Market conditions like recessions.
2)Natural Disasters: Events like floods, fires, or earthquakes.
3)Political Events: Changes in regulations or tax laws.
4)Social Factors: Shifts in demographics or societal trends.
5)Technological Changes: Opportunities or risks from new
technology
40
Event Identification Techniques
Brainstorming Sessions
Event Inventories & Loss Event Data
Interviews & Self-Assessment
Facilitated Workshops
SWOT Analysis
Risk Questionnaires & Surveys
Scenario Analysis
Technology Utilization
41
Brainstorming Sessions and its purpose
Meetings with employees and
management to discuss potential risks.
Purpose: Gather diverse perspectives on risks.
42
Event Inventories & Loss Event Data and its purpose
Event Inventories: Detailed lists of common potential
events in an industry.
Loss Event Data: Database of actual loss events in a
specific industry.
Purpose: Provides a structured starting point for
identifying risks during brainstorming or analysis.
43
Interviews & Self-Assessment and its purpose
Description: Employees assess their unit's risks and discuss
them with coordinators.
Purpose: Refine and clarify risk identification.
44
Facilitated Workshops
Description: Workshops led by a facilitator to prioritize
risks.
Participants: Managers, employees, and stakeholders.
45
SWOT Analysis
Purpose: Analyze strengths, weaknesses, opportunities,
and threats to identify risks.
46
Risk Questionnaires & Surveys:
Structured tools to gather
information on risks from employees and stakeholders.
Purpose: Identify key risks based on feedback.
47
Scenario Analysis :
Explore potential risks through "what-if" questions.
Purpose: Assess the impacts of different scenarios.
48
Technology Utilization
Share best practices via internal tools.
External: Monitor external risks using internet tools, such as
reviews or reputational analysis.
49
Risk Assessment
Risk assessment analyzes and
quantifies identified risks,
50
three key factors of risk assessment
1)Likelihood of Occurrence (Loss Frequency or Probability)
Measures the probability of a risk occurring within a specific
time frame.
Example: A loss frequency of 0.25 per year indicates a 25%
chance of a loss occurring annually (once every four years).
2)Potential Impact (Loss Severity)
Assesses the financial or non-financial cost of a risk event.
3)Interrelationship of Risks Analyzes how different risks interact
and affect each other.
51
Inherent Risk :
The risk that exists naturally in a process or activity
before mitigation efforts.
Characteristics:
Tied to the business or activity's nature, Cannot be
eliminated but can be mitigated.
Examples: Company Size: Larger organizations face complex
management or regulatory challenges.
52
Residual Risk :
The risk that remains after mitigation actions are taken.
Formula: Residual Risk = Inherent Risk − Mitigation Activities
Example: Insurance deductibles represent residual risk, where
some costs remain even after insurance coverage.
53
point to note
Risk analytics depend heavily on accurate input data. It
helps assess risk, predict outcomes, and understand risk
connections, but results can be inaccurate if the data is flawed.
54
Risk Analytics:
The use of tools or software to calculate and track
risks.
Simulates "what-if" scenarios.
Tracks avoided risks and measures concentrations.
55
Risk Assessment Methods:
I. Qualitative Risk Assessment
II. Quantitative Risk Assessment
56
I. Qualitative Risk
Assessment Involves non-numerical methods to
evaluate risks.
1. Risk Maps (Heat Maps
2. Risk Ranking
57
Risk Maps (Heat Maps)
A visual tool that plots risks based on
probability and impact.
Purpose: Display risks on a chart with: X-axis: Probability
(scale: 1–8). Y-axis: Impact or severity (scale: 1–8).
Upper Right: High-probability, high-impact risks (most
critical). Lower Left: Low-probability, low-impact risks
(least critical).
Benefit: Helps identify overlooked risks and provides a
portfolio view of the organization's risks.
58
Risk Ranking
A qualitative tool where managers rank risks based
on their intuition, considering the probability and magnitude of loss.
Purpose: Rank risks from most to least significant without
needing precise loss estimates.
59
Quantitative Risk Assessment:
Involves using numerical methods to
assess and measure risks.
Value at Risk (VaR)
Cash Flow at Risk (CFaR)
Earnings at Risk (EaR)
Earnings Distributions
EPS (Earnings Per Share) Distributions
Benchmarking
60
Value at Risk (VaR)
Measures the potential loss in value of a
risky asset due to a specific event over a defined time period at
a given confidence level.
Assumptions: Assumes a normal distribution (bell curve).
Example: If VaR for an asset is $100 million at 95%
confidence for one week, there’s a 5% chance the value will
drop more than $100 million in that week.
Methods to calculate VaR:
Historical Method: Uses past data to predict future
trends.
Variance-Covariance Method: Uses standard deviation
to calculate risk (parametric method).
Monte Carlo Method: Uses computational models to simulate outcomes over multiple iterations.
61
Cash Flow at Risk (CFaR):
Measures the likelihood that cash
flows will decline by more than a certain amount over a given
period.
Purpose: Assesses liquidity risk and tests cash flow sensitivity to risks.
62
Earnings at Risk (EaR)
Measures the confidence interval for a
decline in earnings over a specific period.
Purpose: Assesses variables that impact earnings.
Example: Determines how changes in interest rates would affect earnings
63
Earnings Distributions
A graphical representation of the
probability distribution of potential earnings levels.
Purpose: Visualizes the likelihood of various earnings
outcomes
64
EPS (Earnings Per Share) Distributions :
A graphical
representation of the probability distribution of potential
earnings per share (EPS).
Purpose: Helps assess risks related to shareholders'
returns.
65
Benchmarking :
Compares the company’s risk profile and
potential impacts with similar organizations.
Purpose: Identifies gaps and opportunities for improvement
by learning from industry peers.
66
Additional Techniques for Specific Projects:
Breakeven Analysis: Determines the point where revenue equals costs, highlighting the risk of not achieving profitability.
Sensitivity Analysis:Analyzes how changes in specific
variables (e.g., costs, prices) impact outcomes.
Simulation Analysis:Uses computational models to predict
possible outcomes for various scenarios.
Scenario Analysis: Evaluates risks and outcomes under
different "what-if" conditions.
67
Risk Prioritization (Ranking)
involves identifying
which risks require immediate attention by analyzing both quantitative
and qualitative factors.
68
Unexpected Loss
Loss beyond expected, up to the maximum
probable loss.
Action: Reserve funds to cover it.
Unexpected Loss = Actual Loss − Expected Loss
69
Expected Loss
Average annual loss over several years.
Purpose: Helps prioritize risks financially.
Expected Loss = Loss Amount × Probability of
Occurrence
70
Maximum Probable Loss (PML):
Largest foreseeable loss
under normal conditions.
Purpose: Helps determine insurance coverage
71
Maximum Possible (Catastrophic) Loss:
Worst-case scenario, such as total destruction.
Note: Highly unlikely but considered in extreme planning.
72
Assessing Financial Risks:
Investment Risk:
Stock: Use leverage ratios and beta.
Debt: Measure duration for interest rate sensitivity.
Derivatives: Unlimited loss potential.
Maximum Possible Loss: For assets, loss could be up to 100%
of investment
73
Cost-Benefit Analysis:
Balance the cost of mitigating risk with its
potential loss.
If mitigation cost < expected cost, manage risk. - If mitigation cost > expected cost, accept risk.
Prioritizing Risks:
Calculate expected loss to prioritize risks.
74
Unexpected Loss:
Reserve funds for losses exceeding
expected amounts
75
Maximum Probable Loss and
Maximum Possible Loss:
Helps determine insurance needs and
For worst-case scenarios.
76
Note:
While expected loss is a key tool, also consider other factors like
impact and mitigation options
77
Response Planning (Risk Treatment)
After identifying and assessing risks, management must decide how to
address each based on its impact, probability, and cost effectiveness.
78
Avoiding the Risk When:
High probability and loss.
Actions: Discontinue high-risk units, exit markets.
Drawback: Reactive, may sacrifice opportunities.
79
Mitigating the Risk When:
Risk is tolerable but needs
minimization.
Actions: Diversify, implement safety measures. Goal:
Reduce likelihood or impact.
80
Transferring the Risk When
Offload financial burden.
Actions: Insurance, risk-transfer clauses, hedging.
Note: Shifts impact, doesn’t eliminate event.
81
Retaining the Risk When:
Mitigation cost > expected loss.
Actions: Higher deductibles, self-insure. Considerations:
Needs capital reserves.
82
Exploiting the Risk. When:
Opportunity for profit or strategic
gain.
Actions: Take calculated risks for competitive edge.
Outcome: Increased value
83
Risk Map
High Probability/Impact: Avoid/mitigate.
Low Probability/Impact: Retain/accept
84
Risk Monitoring and Communication
After implementing risk management strategies, organizations must
continuously monitor and reassess their effectiveness. Communication
must flow across all levels
85
Ongoing Review
Regular risk assessments are necessary due
to changes in political, economic, or technological factors.
86
Management Follow-Up
Senior managers must report regularly
on the likelihood and impact of identified risks.
87
Role of Internal Auditors
Auditors verify the status of risks and
assess control effectiveness during audits.
88
Risk Appetite:
The level of risk an organization is willing to accept
overall in pursuit of objectives.
Influenced by shareholder expectations, regulatory
requirements, and organizational capabilities.
89
Risk Tolerance:
The acceptable level of risk for specific objectives,
more precise than risk appetite.
Example: A company may accept some investment risk but
limit losses to 20% annually for securities.
90
Alignment Between Risk Appetite and Tolerance:
Individual
tolerances should align with the overall risk appetite to ensure risks
remain within acceptable boundaries.
91
Operational Risks:
Involve internal processes, human errors,
and system failures.
92
Managing Operational Risks:
Internal Controls:
93
Internal Controls
Process and Personnel Reviews
Ensure processes are robust and regularly updated
94
Process and Personnel Reviews:
Regular reviews ensure
alignment with organizational goals.
95
Managing Financial Risks:
Financial risks like credit and market risks can impact a
company's value.
Commitments from Financial Institutions: Maintain credit
lines for liquidity.
Derivative Instruments: Use instruments like forwards, futures,
options, and swaps for hedging risks.
Investment Policies: Establish guidelines for acceptable
investments.
96
Insurance for Physical Assets:
Ensure assets are insured based on
periodic appraisals to minimize financial losses.
97
Traditional Risk Management (XYLO approach):
Focuses on business
unit leaders managing risks within their areas, leading to overlaps,
redundancies, & overlooked risks
98
Enterprise Risk Management (ERM):
Enterprise Risk: Encompasses all business risks and
opportunities faced by the entire organization.
Approach: Top-down strategy that considers the entire organization, identifying, assessing, and managing risks collectively to maximize coverage and reduce overlooked risks.
Purpose: Integrates risk management with strategy-setting to create, preserve, and realize value.
Objective: Coordinate risk management across the organization
for optimal risk coverage and minimized gaps.
99
ERM and Portfolio View of Risk
Core Concept: Evaluates risks collectively, considering their
interrelations and combined effects, rather than in isolation.
Interrelated Risks: Risks can either amplify or offset each other, which requires a holistic approach.
Example: A multinational corporation facing risks from a declining currency might see:
Negative Impact: Increased raw material costs. Positive
Impact: Increased export sales.
note: ERM ensures preparation for both immediate and long-term challenges by addressing all risk categories
100
Without ERM vs with ERM
Without ERM: Departments act independently (e.g., hedging
separately).
With ERM: Coordination may reveal natural hedges,
avoiding wasteful actions.
101
Risk Category:
High Frequency/High Impact:
Critical risks (e.g.,
cybersecurity).
102
Risk Category Low Frequency/High Impact:
Rare but severe risks (e.g.,
natural disasters).
103
Risk Category Cascading Risks:
Risks that escalate into broader
disruptions (e.g., financial crises).
104
Tools for Managing Portfolio Risks:
Scenario Planning:
Scenario Planning
Statistical Modeling:
105
Scenario Planning:
Collaborative process involving senior
executives and technical experts. - Develops strategies for
unpredictable external events beyond usual expectations.
106
Statistical Modeling:
Analyzes historical data to forecast trends
and potential risks. Example: Linear regression for predicting
risks based on past patterns.
107
Benefits of ERM:
1)Holistic Risk Management:
Aligns departmental and organizational objectives.
Reduces redundancies and optimizes resource use.
2)Proactive Decision-Making: Anticipates cascading effects of risks.
Prepares for both high-impact and frequent risks.
3) Improved Organizational Resilience: Treats risks as
interconnected, enhancing the organization’s capacity to manage multiple risk events.
108
Corporate Governance and ERM
Corporate Governance Overview:
Defines policies, ethics, and practices guiding a company toward its
objectives, ensuring alignment with stakeholder interests and
compliance with regulations.
109
Corporate Governance Roles in Risk Management:
Guidance for Risk Management:
Ensures management identifies, assesses, and mitigates risks effectively.
Board of directors oversees the risk management process.
110
Corporate Governance Roles in Risk Management:
Responsibilities of the Board:
Identifies, prioritizes, and monitors risks.
Reviews and improves risk management processes.
Ensures timely risk communication.
111
Integrating ERM with Corporate Governance:
Improved Communication:
Bridges gaps between management and the board.
Discusses strategic risks and mitigation strategies.
Strategic Objective Alignment:
Identifies acceptable risk levels.
Focuses on critical risks threatening organizational goals.
112
Roles in Risk Oversight:
Risk Management Committees:
Oversee ERM activities.
Review risk-related policies and monitor framework
effectiveness.
Best Practices: Independent directors with at least one risk expert
113
Roles in Risk Oversight: Chief Risk Officer (CRO):
Implements ERM daily.
Reports to the risk management committee.
114
Roles in Risk Oversight: Regulatory Requirements:
Large bank holding companies must establish risk management committees and appoint a CRO.
115
ERM’s Contribution to Corporate Governance:
Comprehensive Oversight:
Provides an organization-wide view of risks, avoiding siloed approaches.
Proactive Risk Management:
Identifies and addresses risks early to prevent escalation.
Strategic Alignment:
Ensures risk strategies align with organizational goals and stakeholder interests.
116
Performance Management and ERM
Performance Management:
Ensures alignment between organizational
activities and long-term goals by monitoring, analyzing, and improving
performance.
117
Balanced Scorecard:
A strategic tool for measuring and managing
performance across four key areas:
Financial Perspective
Customer Perspective
Internal Business Processes
Learning and Growth:
118
Balanced Scorecard: Financial Perspective:
Financial Perspective:
Focus: Value creation for shareholders.
Metrics: Revenue growth, profit margins, ROI.
119
Balanced Scorecard: Customer Perspective:
Focus:
Customer satisfaction and retention.
Metrics: Retention rates, market share.
120
Balanced Scorecard:
Learning and Growth:
Focus: Long-term improvement and innovation.
Metrics: Employee training, skill development.
121
Balanced Scorecard: Internal Business Processes:
Focus: Operational excellence.
Metrics: Efficiency, innovation, quality control
122
Balanced Scorecard: Learning and Growth:
Focus: Long-term improvement and innovation.
Metrics: Employee training, skill development.
123
Key Performance Indicators (KPIs)
Critical metrics aligned with strategic goals.
Measurable: Provide clear data (e.g., sales growth). Specific:
Linked to specific goals.
Relevant: Aligned with organizational strategy. Time-Bound:
Tracked over a defined period
124
Integrating ERM with the Balanced Scorecard
1)Risk Identification:
ERM identifies risks threatening KPI
achievement in each perspective.
2)Risk Monitoring: Continuous KPI assessment evaluates risk mitigation effectiveness.
3)Enhanced Decision-Making: Aligns ERM with strategic objectives for targeted focus.
125
Benefits of Integration
1)Proactive Risk Management:
Early risk identification ensures goal progress.
2)Strategic Alignment:
Links risk management with overall business strategy.
3)Comprehensive Monitoring: Balances opportunities and risks for a holistic view.
4)Improved Accountability:
Embeds risk awareness into performance metrics
126
Internal Control and ERM:
Risk Management
Philosophy: Defines a company's approach to
identifying and managing acceptable risks.
127
Role of Management Accounting and Financial Professionals in ERM
Assist in ERM implementation within the finance function.
Analyze and quantify risk appetite and tolerance.
Providing information to operational management and performing benchmarking studies to identify risks.
Gathering best practice information on ERM.
Quantify monetary impact and probabilities of risks.
Assisting with identifying and estimating costs and benefits of various risk mitigation strategies.
Develop risk monitoring reports, SEC Reporting
Advising management on Integrate ERM with budgeting and performance management.
Participate in business continuity planning.
Advise on risk disclosures in SEC reports.
Manage risk in innovation and new strategies.
128
Internal Control and ERM: Role of Internal Controls:
Address vulnerabilities and mitigate risks.
Adapt or implement controls as part of risk response strategies.
129
Key Contributions of Management Accounting to ERM
Enhanced Decision-Making: Informed strategies through
quantified risks and impacts.
Proactive Risk Management: Reduce unexpected exposures
via monitoring and benchmarking.
Strategic Integration: Align risk management with financial
planning and innovation strategies.
Regulatory Compliance: Ensure transparency and avoid penalties through proper risk disclosures.
Resilience Building: Strengthen continuity plans for better disruption management
130
COSO Framework on Enterprise Risk Management (ERM)
COSO, established in 1985 and sponsored by five professional U.S.
organizations (AAA, IMA, AICPA, IIA, FEI), focuses on ERM, internal
control, and fraud deterrence to improve governance and risk
management.
131
ERM Definition (2017):
ERM integrates culture, practices, and strategy
to manage risks and achieve value creation, preservation, and
realization.
132
What Does COSO Do?
COSO provides a framework and guidance for three key areas:
1. Enterprise Risk Management (ERM),
2. Internal Control,
3. Fraud Deterrence
133
Traditional Risk Management vs. ERM
Siloed, reactive /
Holistic, proactive.
Risk avoidance /
Value-focused
Departmental focus / Organization-wide impact
134
Overview of Strategic Planning
Strategy: A set of actions aimed at improving performance through formulation and implementation.
Strategic Plan: A long-term (5+ years) roadmap used alongside tactical and operational plans.
135
Benefits of ERM in Strategic Planning and Performance
Alignment with Vision and Mission
Enhanced Decision-Making: Provides clarity on how risks impact strategy & performance.
Comprehensive Risk Visibility: Identifies organization-wide
risks, preventing gaps or overlaps.
Proactive Risk Management:Anticipates risks during strategy setting, mitigating issues early.
Improved Resource Allocation: Directs resources to areas of
highest strategic value and risk impact.
136
Overview of Strategic Planning
Strategy: A set of actions aimed at improving performance
through formulation and implementation.
Strategic Plan: A long-term (5+ years) roadmap used alongside
tactical and operational plans.
137
Key Elements of Strategic Planning: mission, vision, values and goals
Mission: The organization's purpose
Vision: Forward-looking goals
Values: Principles guiding behaviour
Goals: Specific, measurable targets.
138
Key Elements of Strategic Planning: Analyzing External Forces
opportunities and threats, including competition, economy, and regulations.
139
Key Elements of Strategic Planning: Analyzing Internal Environment:
Assessing strengths,
weaknesses, and limitations
140
Key Elements of Strategic Planning: Formulating Strategies:
Leveraging strengths, addressing
weaknesses, and mitigating threats.
141
Key Elements of Strategic Planning: Developing and Implementing Strategies:
Translating
strategies into actionable plans, considering:
Structure: Aligning roles and responsibilities.
Control Systems: Monitoring
and alignment.
Culture: Encouraging supportive behaviors.
142
Integrating Risk Management with Strategy Selection
Traditional View: Risk is considered after a strategy is chosen.
COSO View: Risk is a key factor during strategy selection.
143
Integrating Risk Management with Strategy Selection: Key Risk Considerations
Alignment with Mission, Vision, and Values: Ensure strategies
support core organizational objectives.
Identify Unintended Consequences: Recognize potential
trade-offs or negative impacts of the strategy
144
ERM Integration in Strategy
Value Destruction:
Misalignment or poorly chosen strategies
can harm organizational value.
Key Point: Risk assessment must be embedded in the strategy setting process.
145
ERM as a Strategic Tool
Risk Appetite: Strategies must align with the organization’s
tolerance for risk.
Resource Allocation: Optimize resources to support missionaligned strategies.
146
Key Takeaways from ERM Integration
Risk and Strategy Interdependence: ERM should be embedded in strategy selection from the start
Value Creation and Preservation:
Focus on creating, preserving, and realizing value beyond risk
mitigation.
Comprehensive Decision-Making: Evaluate risks of misalignment and strategy implications to
ensure soundness.
Organization-Wide ERM:
Embed risk considerations across all levels of decision-making
to enhance resilience and growth.
147
Five Components of the Framework:
1) Governance and Culture
Establishes oversight, ethical values, and desired behaviors.
Key Roles: Board oversees alignment with mission and strategy. Management fosters a risk-aware culture.
Principles:
Board oversight of risks.
Operating structures for strategy execution.
Defined culture aligned with risk tolerance.
Commitment to core values.
Talent attraction and development.
148
Five Components of the Framework: 2) Strategy and Objective-Setting
Integrates ERM into strategic planning.
Focus Areas: Risk appetite, alignment of objectives, and
evaluating strategies for risk implications.
Principles:
Analyze business context.
Define risk appetite.
Evaluate strategies.
Formulate objectives with risk in mind.
149
Five Components of the Framework:
3) Performance
Identifies, assesses, and manages risks affecting objectives.
Focus Areas: Risk prioritization, response, and enterprise-wide risk view.
Principles:
Identify risks.
Assess risk severity.
Prioritize risks.
Implement risk responses (e.g., avoid, mitigate, transfer,
accept).
Develop a portfolio view of risks
150
Five Components of the Framework: 4) Review and Revision
Ensures continuous improvement and adaptability in ERM
practices.
Focus Areas: Evaluate process effectiveness, address changes, and refine risk strategies.
Principles:
Assess substantial changes.
Review risk and performance.
Pursue improvement in ERM.
151
Five Components of the Framework 5) Information, Communication, and Reporting
Facilitates transparency and informed decision-making through data exchange.
Focus Areas: Effective use of systems, communication flow,
and risk reporting.
Principles:
Leverage information systems.
Communicate risk information.
Report risk, culture, and performance to stakeholders.
152
Key Benefits of COSO ERM Framework
Aligns risk management with strategic goals.
Enhances governance and clarifies roles in risk oversight.
Promotes proactive risk identification and mitigation.
Fosters a culture of ethics and continuous improvement.
Encourages transparent risk communication and reporting.
153
Benefits of Enterprise Risk Management (ERM)
Expanded Opportunities: Identifies risks and opportunities to
broaden organizational potential.
Holistic Risk Management: Manages risks across the entire
organization cohesively.
Positive Outcomes: Reduces surprises and enables proactive
responses to opportunities.
Stable Performance: Minimizes disruptions and ensures
consistent results.
Efficient Resource Use: Guides resource allocation based on
risk understanding.
Enhanced Resilience: Strengthens the ability to adapt to uncertainty and change.
Strategic Insight: Aligns strategies with risk appetite and
improves decision-making.
Adaptability: Offers timely adjustments to evolving strategies
and conditions.
Increased Confidence: Improves stakeholder trust in strategic
choices.
Stakeholder Trust: Builds credibility through proactive risk
management.
Preparedness for Change: Anticipates and adjusts to shifts in
the external environment.
154
Limitation of ERM
Unidentified Risks:
ERM cannot capture all risks, necessitating
contingency planning for unknown risks.
155
Capital Adequacy: A Buffer for Banks
What is Capital Adequacy?
Capital adequacy refers to the financial resources a company needs to
survive unexpected events, ensuring liquidity and solvency. For
example, if a production line fails, having reserves or loans helps the
company stay afloat.
156
Why is Capital Adequacy Important for Banks?
For banks, capital adequacy is crucial to protect depositors' money.
Banks face risks when lending money, and having enough capital
ensures they can absorb losses, safeguarding customers' funds.
157
What is the Capital Adequacy Ratio (CAR)?
The CAR compares a bank’s capital to its Risk Weighted Assets (RWA).
A higher CAR indicates better financial health.
CAR = (Tier 1 Capital + Tier 2 Capital) / Risk Weighted
Assets (RWA)
Tier 1 Capital (Core Capital): Includes common stock, retained
earnings, and perpetual preferred stock.
Tier 2 Capital (Secondary Capital): Includes reserves, loan-loss
provisions, and subordinated debt.
Risk Weighted Assets (RWA): RWA adjusts the total value of a bank's assets (like loans or investments) based on their
riskiness. Safer assets like government debt have 0% risk
weight, while riskier loans have higher risk weights.
Higher CAR: Indicates a strong financial position and good risk
absorption capacity.
Lower CAR: Suggests the bank may be overextended and more at risk.
158
Tier 1 Capital (Core Capital):
Includes common stock, retained
earnings, and perpetual preferred stock
159
Tier 2 Capital (Secondary Capital):
Includes reserves, loan-loss
provisions, and subordinated debt.
160
Risk Weighted Assets (RWA):
RWA adjusts the total value of a bank's assets (like loans or investments) based on their riskiness. Safer assets like government debt have 0% risk weight, while riskier loans have higher risk weights.
161
Basel Accords
The Basel Accords, particularly Basel III, set international standards for capital adequacy, emphasizing:
Leverage Ratio: Prevents excessive borrowing.
Liquidity Ratio: Ensures enough cash for short-term needs.
Higher Capital Requirements: For large banks that could
cause a financial crisis if they collapse.
162
Importance of Capital Adequacy
Protects Depositors: Ensures banks have enough resources to
protect customer funds.
Prevents Failures: Reduces the risk of insolvency from
unexpected losses.
Enables Risk Management: Allows banks to take risks while
being able to handle financial difficulties.
163
note:
A company with no existing debt borrowing money will
lower financial risk at first, but after a certain point issuing
debt will increase financial risk.
164
note:
Strategic risk is the risk of loss from an unsuccessful business
plan. It may be unsuccessful because it was the “wrong” plan or
because it was poorly implemented. One specific example of
strategic risk is not responding in a timely fashion to changes in
the business environment
