Week 2 - Introduction to ERM Frameworks

Question 1

Traditional Risk Management - Siloed

Answer 1

Managing risks is a part of doing business. Functional leaders tend to be accountable for risks in their areas of responsibility - a siloed effect

Problems:
1. Risk falling between silos
2. Risks affect multiple silos
3. Risk responses may affect other silos inadvertently
4. Risk internal to silos and less focus on external risks
5. Risk/return not focused during strategic planning

Question 2

What are some traditional risk management (silos)

Answer 2

1. Financial Risk Silo
2. Operating Risk Silo
3. Strategic Risk Silo

Question 3

Motivation for Enterprise Risk Management

Answer 3

Organizations implement ERM for several reasons, mostly the need to improve the management of various risks that created value destruction or brand damage:
- Major lawsuits
- Big unpleasant surprise, such as cash/liquidity shortage, negative news cycle
- Failure of well-established firms
- Regulatory requirements
- Board of Directors interest, usually audit and risk committee
- Advice of external auditor
- More complex markets (global, complexity, new business models, increased competition, regulatory imbalances)

Question 4

Why is ERM important?

Answer 4

ERM supports value creation by enabling management to:
- deal proactively with potential future events that create uncertainty - builds resiliency
- respond in a manner that reduces the likelihood of downside outcomes and increases the upside

Question 5

What are the reasons for an ERM system

Answer 5

The fundamental reasons for implementing ERM is to increase the value of the enterprise:
1. Enhance corporate governance by reducing unacceptable performance variability
2. Enhance resiliency to respond to a changing business environment
3. Align strategy and corporate culture
4. Build confidence of investment community and stakeholders
5. Better decision-making and allocation of resources

Question 6

What do you need in a good ERM framework - what is the underlying philosophy

Answer 6

• Creates and protects value
• Led and championed from the top of the organization, board and C-suite
• Figure out what you need for your organization
• Build it (policies, processes, roles, responsibilities, communications, etc)
• Need everyone to be on the same page - consistency is key

Question 7

What is some of the industry framework?

Answer 7

• Committee of the Sponsoring Organizations of the Treadway Commission (COSO)
• Sarbanes-Oxley Act
• International Organization for Standardization

Question 8

What is the COSO Risk Management Framework

Answer 8

1. Governance and Culture
2. Strategy & Objective-Setting
3. Performance
4. Review & Revision
5. Information, Communication, & Reporting

Question 9

Foundational principles for risk management

Answer 9

• integrated into an organizations normal business functions, decision-making process
• it is a structured framework so that everyone knows the roles and responsibilities for risk management and that processes used in risk management are consistent
• it should also be comprehensive to make sure that all steps needed from identifying a risk to communicating about risks are taken
• do customize it for your own organization
• make sure you make the process inclusive by engaging many stakeholders and different view points
• it is dynamic because as an organizations context changes so do its risks – make sure you review periodically
• use the best available information other wise it is GICO. Seek out reliable sources and as above, consult with right stakeholders
• human and cultural factors can be surfaced through risk management and they need to be taken into account when designing risk management for the organization
• continual improvement and last but not lease - always review with a critical eye, sometimes and outside expert’s eye to make sure your processes stay relevant

Question 10

What is risk management

Answer 10

Risk management is the blending of culture, processes, and structure which come together to identify and proactively manage risks to optimize the management of potential opportunities. An integrated solution to risk management is enterprise risk management (ERM)

Question 11

ERM Process

Answer 11

1. Establish the context
2. Identify the risks
3. Analyze the risks
4. Take action (appropriately control the risks)
5. Monitor and report