Enterprise Risk Management

Is it Time to Reconsider the Concept of Risk Management?

noreply@blogger.com (Prasetyo) — Thu, 28 Aug 2008 12:21:00 +0000

Is it Time to Reconsider the Concept of Risk Management?

Seen from an outside perspective, there are several schools of thought in the field of risk management. The Nordic perspective and approach has long been characterised by ‘hard and technical matters’. In the last few years, particular attention has been paid to IT security and business continuity planning, these having gained a firm foothold in risk management work aimed at preventing, eliminating, minimising and controlling risks identified in business enterprises.

Different Approaches to Risk Management

The Anglo-Saxon approach to risk management focuses on compliance and legality issues, placing a major emphasis on the company’s related internal processes. The Sarbanes Oxley Act, the Patriot Act and other U.S. legislation have had a major impact on this Anglo-Saxon approach making a breakthrough all over Europe. As we know, European companies listed in the stock exchanges of the United States must follow U.S. legislation.

There are also clear differences in the way municipalities and regions handle their risks compared to private businesses. nesses. In many local and regional government units, the risk management function’s duty is mainly to acquire insurance cover in order to manage risks. In only a few exceptions is risk management systematic and holistic and risks prevented with a long-term approach.

Definitions of Risk

The way a company defines risk clearly reflects its approach to risk and risk management. The plethora of such definitions – almost every company has one – ranges from “a threat with major consequences” to “events that prevent the company from achieving its goals”.

In the last few years, we have seen the definition of risk adjusted dramatically, comprising not only traditional risks but also ‘lost business opportunities’, i.e. events that prevent the company from achieving its goals.

An increasing number of companies have started to use the following definirisktion of risk that complies with the Basel II agreement: “Operational risk is a risk of losses resulting from inadequate or failed internal processes, people, technical systems or external events”. Adoption of this definition helps companies to analyse and classify operational risks appropriately and focus more on risk areas that until now have not received the attention they deserve.

From ’Hard and Technical Matters’ to Soft and Human Ones

One of the benefits of a broader ap proach to risk is a major shift in em phasis towards human factors. Various cases around the world such as Arthur Andersen, Enron, Bearings Bank and World Com have proved the amount of definirisk involved in people and internal processes. Who would have believed that a company like Arthur Andersen, valued at billions of dollars, would be wiped off the map only four weeks after one of its employees spent a few nights destroying documents with a shredder?

These examples have contributed to the fact that risk management focus has shifted to employees, managers and corporate culture in a completely different way than before. Consequently, the importance of key employee dependence, leadership, corporate demography, bonus contracts, internal crime and other such factors has grown substantially.

From an Internal, Backward Approach to an External, Forward One

The events of September 11, 2001 in the United States left deep scars, making companies realise how vulnerable they were to uncontrollable events. Furthermore, the tsunami in Asia and the storm, Gudrun, have clearly demonstrated the need for a systematic analysis and monitoring of the operating environment.

Elements of an Environmental Analysis

Analysis of the operating environment can be divided into the following areas:

Business Intelligence – simply defined as a way of handling the known and anticipated operating environment (e.g. competitor monitoring) in order to maintain one’s own position.

Scenario planning – briefly expressed as an analysis of the operating environment with a future perspective, where operations are planned on the basis of various, imagined future scenarios.

Trend scanning – the analysis of the unpredictable and unknown operating environment, encompassing broad areas of data, finding unexpected material and increasing one’s lead on competitors.

Disturbance monitoring – the analysis of events such as paradigm shifts and changes in discourse and trends as well as boundary-breakers and passionate persons that turn our lives upside down.

The three key questions of environmental analysis are as follows:

Relevance?
• How interesting is this event from the viewpoint of our operations?
• What long-term implications does this event have?

Impact?
• How much can this event affect our operations?

Timetable?
• How quickly can this event affect our operations?

In many companies, environmental analysis and monitoring has become a key tool for achieving success.

Risk Management of the Future?

In my opinion, risk management has acquired a completely different meaning over a short period of time. Dramatic national and global events have triggered new needs, placing entirely new requirements on risk management which is now seen as an activity that must support business operations. While I find this a positive trend, it also provides major challenges for we who participate in and develop current and future risk management.

Ulf Rönndahl
ulf.ronndahl@if.se

http://ifnews.if.fi/en/

Will your company survive the crisis

noreply@blogger.com (Prasetyo) — Thu, 28 Aug 2008 12:09:00 +0000

Will your company survive the crisis

Enterprises sometimes encounter crisis situations. The smaller situations are maybe managed with pure luck, but for the real crisis situations, the enterprise needs a carefully-planned continuity plan. The writer has helped a number of If’s clients to develop their own continuity plans during the past years.

When the World Trade Centre was attacked by terrorists in September 2001, the companies that had prepared themselves with a continuity plan managed the crisis much better than the other companies. Many of the companies situated in the buildings had updated their plans after the previous terrorist attack in 1994, and those plans were now activated. For example a well-known rating company had set up its own ”hot” spare office on Manhattan, where everything was ready if the company would have to move from the WTC premises. Thus, already that same morning the personnel were servicing their clients ”normally” from their new offices.

In their study ” The Impact of Catastrophes on Shareholder Value” (Oxford Executive Research Briefings), Rory F Knight and Deborah J Pretty looked at the operations of 15 major US companies after they had experienced a catastrophe. They found that the companies that were prepared for such a situation and managed to show that they could handle the crisis (the Recoverers) could see their share prices increased by 12% on average after 250 days. However, those companies that were not prepared for the crisis and handled the situation in a less effective manner could see their share price decreased by about 15%.

In the Nordic countries the importance of a continuity plan has been realised during the past years. Quality thinking has caused many companies to improve their operations by documenting their own processes, and risk management with all its sectors has also been defined in writing. The company’s risk management policy, strategy, insurance strategy and continuity plan are now often part of the company’s written processes. Corporate Governance has also helped to spread this way of thinking.

Generally, at least the companies’ IT departments have been thinking about the continuity problems. IT cannot be at a standstill too long before it causes problems throughout any company. As a matter of fact, the companies’ processes are today all so integrated that if one of these parts is out of the game, it will have an impact on all the other sectors. Emergency preparedness plans, media plans and other similar plans are normally in place in different parts of the organisation. The continuity plan, which covers the whole group, is a wide package that bundles up all these plans and provides the framework for the company’s crisis operations during a crisis.

Organising a continuity plan

The continuity actions can be split into three main phases: actions before, during and after the crisis. Before the crisis, obviously the planning must be done including also the continuity plan. The most important thing is that top management must commit itself to the project and communicate this to all parties. Top management will choose the planning group members, who will represent all sectors of the company – at least production, IT, HR, Finance, Logistics and PR should participate, but when needed, also maintenance, purchasing, marketing and storage will be represented in the project.

When the planning group has been formed, a BIA (Business Impact Analysis) will be carried out, i.e. the members of the group will discuss different crisis scenarios, imagining the impact of those scenarios and how to deal with them. If a somewhat updated risk analysis is available, its findings will be used in the work. It is, however, important to realise, that reality is often much more amazing than what we can imagine, and it is impossible to plan for all situations. But the framework for crisis management can be built, and the processes with which the crisis management will proceed in a controlled way can be defined. To operate in a crisis often needs some improvising, and if that can be done based on check lists and directives prepared in advance, it is possible to save a lot of time. In the projects where the writer of this article has participated, the best results have been reached when the planning group really has been enthusiastically working together from the beginning and the discussions have been lively. As a so-called spin-off effect, valuable information about other parts of the organisation has come out that might not otherwise have been available to all participants.

Information and communication

Communication and media planning is an important part of the Continuity Plan. It has been said that no crisis can be so bad that it couldn’t be worse through bad communication. On the other hand, a crisis can be turned into an advantage by handling the communication in an exemplary way.

The media plan defines who will inform what and to whom and in what order. One way is to split the information into two parts the initial information and the follow-up information. The contents of the bulletin must be planned including who the receivers will be, what media and channel are to be used. Generally there should only be one person and his substitute who will give out information about the crisis, and to whom all contacts should be directed. It is most important not to give out false information, and that the information is received exactly as it has been intended to.

When the crisis is over, one generally releases a final bulletin where the final facts about the crisis are explained, and also how the crisis finally was handled.

It is advisable to use the available expert training services in crisis communication.

Crisis management in a planned way

It is a good idea to draw a flow chart of how the beginning of the crisis will be handled. It will define the responsibilities and tasks of each organisation level. It might be sensible to divide the flow chart into local measures and Group measures. The chart will also define at what stage the local crisis management teams and the Group crisis management teams will be convened.

The crisis management team is one of the most vital parts of the continuity plan. The team members, their tasks and responsibilities and where they convene should be stated in the plan.

The crisis management team gives advice to the management in matters pertaining to the crisis, and will assess the needs of the parties involved in the crisis. The team will convene whenever needed and makes plans for all the sub-areas. The premises of the team, the crisis management centre, have been planned and reserved in advance. All decisions and pieces of information received during the crisis will be marked in the logbook.

After the crisis

When the acute crisis is over, the “after crisis phase” will commence. This can be split into three parts: psychological first aid, company recovery and learning from losses.

It is natural that HR must be responsible for the personnel’s well being and psychological recovery by recruiting skilled outside help as soon as possible. Directives as to what authority one should turn to and where help will be given will be stated in the continuity plan. There are organisations specified into this activity in most countries.

How the company’s recovery is handled will at the end of the day decide if the company will survive after the crisis. When the recovery plan is drafted, one has to know the company and its resources thoroughly. From that follows that only the company staff can draft the recovery plan and choose the right recovery strategies.

Group level and local level crisis management often need different skills; thus the local level crisis management team can be more or less equal to the recovery team. Recovery includes all the measures that have to be undertaken in order to get the company back in business fast and effectively. The recovery team starts its work simultaneously with the crisis management team. When the group crisis management team is convened, this fact does not cause any trouble, but if the local crisis management team is supposed to convene at the same time with the local recovery team, it might be difficult, and the operation must be planned carefully. It is worth while to specially consider the structure of the recovery team. Persons who are practical and creative should be allocated to this group.

The recovery strategy work starts by assessing the critical needs for the personnel, raw material, machinery, storage and logistics etc. The critical time for certain functions, i.e. the time that the plant can cope without those functions, must be defined. After this the processes and parts of production must be prioritised. After the prioritisation has been done, the recovery strategies for each sub-operation will be drafted. The following matters must be considered in the recovery strategy: what resources are needed to get the fundamental functions back on track within the critical time frame? Can the production be moved to another unit? Is there spare capacity available? Can personnel be moved to another unit? In that case, how do we solve the logistic, IT, overtime and other similar problems?

One also has to remember the legal facts when drafting the recovery plan. Concerning these matters, the company’s legal department has to be consulted. Matters like how to interpret the force majeure paragraphs, what obligations there are towards business partners in a crisis situation and other legal problems will be discussed with the legal department.

Dependencies are one of the key areas in recovery planning. When assessing the risks, the size of all the dependency risks is considered, but the recovery plan has to define how to deal with these risks during crisis. The dependencies can be split into internal (interdependency) and external risks. The production chain has to be considered starting from suppliers of raw materials and commodities ending with customers and logistics. In this work it is a good idea to use the experts from your insurance company.

One must learn from losses. All incidents, even the minor ones, should be analysed. A process of how to follow up the losses and what was done right and what was done wrong should be created. This is normal quality work, but it is often forgotten in connection to losses. The knowledge gained from the loss must then be put to use in training programmes, thus ensuring that the perhaps very expensive experience can be of benefit to the personnel throughout the company.

Communicating the continuity plan and training

When the plan has been completed, it must be communicated to the whole staff. A good channel for this is the company’s own intranet. Staff should be trained in activating the plan. The crisis management team could be trained by using case exercises in order to see whether the plan would function in practice. The plan and all its appendices must be updated continuously. This way the company’s continuity plan will turn into a tool that helps and serves the whole company and perhaps even its survival.

Lars von Hertzen

http://ifnews.if.fi/en/

Enterprise Risk Management model increases If capacity

noreply@blogger.com (Prasetyo) — Thu, 28 Aug 2008 11:58:00 +0000

Enterprise Risk Management model increases If capacity

To consolidate its position as the leading insurer of major risks in the Nordic countries, If has increased its capacity. This growth in capacity has also been supported by If raising its own retention during recent years. As a token of our commitment to the Nordic market, If recently increased the upper limit on automatic Property per risk capacity available to €200m; thereby placing us, among our peers, at the top-end in terms of capital available for Nordic clients. The Casualty and Cargo capacity of If also supports the needs of most Nordic based clients. This capacity increase is also supported by the gradually increased net retention for If over the last few years.

In this article our aim is to describe how
• Holistic risk management perspective utilizing state-of-the-art analytical techniques (DFA modelling)
• Diversification across all perils in If
• Allowing for "unbalanced" local portfolios
• Underwriting combining individual responsibility and team-work approach through standardized processes form the basis of our philosophy regarding capacity and risk appetite.

Hopefully, this also offers some inspiration to our clients in the continuous search for the optimal risk based management of your operation.

Capital allocation, investment versus insurance risk and reinsurance strategy

The capitalization versus risk appetite, the investment policy, the reinsurance strategy as well as the allocation of capital to individual lines, countries and risks is in If governed through a centralized actuarial unit running a DFA (Dynamic Financial Analysis) model. These models have been gradually refined in If through the last decade or so. Currently, we consider our expertise in this area to be world-class. In addition to supporting us in today’s business decisions, the development of new regulatory regimes within the insurance industry (Solvency 2) make these types of tools strategically important for the total ERM (Enterprise Risk Management) work going forward.

The DFA tool aims at deriving a holistic view on all risks in If, ranging from insurance risks, investment risks, credit risks, business risks to operational risks. The latter ones, however, are still in an early phase when it comes to quantitative models.

Based on combining regulatory requirements, rating agency requirements (preserving our S&P A rating) and the DFA model, there are 3 pillars leading to the risk profile of the different insurance operations in If:

Balanced risk taking in the investment operations
The main principles behind If’s investment strategy are asset-liability matching and diversification. In the allocation of investment assets, the structure and requirements of the technical provisions are taken into account in order to reduce the overall risk for the company. Duration targets for the fixed income investment portfolios are set based on the durations of the liabilities, in order to hedge the economic exposure of assets and liabilities. Furthermore by having investments spread across various asset classes and markets, diversification is achieved and thereby contributes to a balanced risk profile of the investment operations.

Capital allocation based on risk contribution
All insurance companies need capital to support the risks of its business. The need for capital will depend on the level of the risk. The main principle behind allocating the total capital (essentially shareholders’ equity) in If to individual lines of insurance is the idea of risk contribution: We are not primarily interested in the risk in a portfolio on a stand-alone basis. Rather, we analyze how a risk class contributes to the total volatility of the operating result of the whole of If.

Since risks are not fully correlated, some in fact work in opposite direction creating hedges, diversification benefits are achieved. Being a large insurance company, writing insurance in different geographical areas and across several classes of insurance is one of If’s key advantages. This is taken into account when allocating capital to different insurance classes. This is also to a large extent the key behind the risk taking ability of the industrial organization where we are able to write business at a risk level which as an isolated portfolio would be considered as quite unbalanced. The diagram below – based on actual analysis of BA Industrial’s portfolio –illustrates the effect of the aggregation of two insurance classes that are not fully correlated.

If Industrial’s Loss ratio volatility for Property and Liability insurances
In this diagram the fully correlated dotted line shows that there is clearly a wider spread in the range of Loss Ratio compared with the Aggregated one. The narrower this range is the more stable the insurance carrier’s Loss Ratio is also from year to year. As another example, the 1,8 bn € Nordic and Baltic motor portfolio of If balances by its non-correlation much of the large fire risk volatility of Industrial.

If’s reinsurance strategy
Supporting the holistic view on capital allocation through risk contribution, reinsurance in If is always purchased from a corporate perspective (though taking into account the solidity of the different legal entities). In essence, this means that we buy a highly efficient and stream-lined reinsurance program protecting the total capital for If, but allowing for significantly higher result volatility for individual lines or countries than with a more conventional “balancing each portfolio” way of looking at reinsurance. However, it is fair to add that If also lives in the real world of quarterly capitalism leading to some protections being installed simply in order to protect our more short-term key ratios.

In this graph the basic reinsurance program takes a capital protection point of view. The stabilizing reinsurance program (if any) should then protect the (quarterly) financial results of an insurance company.

Capacity and retention for If
The somewhat theoretical considerations above result in If being able to
• Provide a higher amount of capacity for individual risks than traditionally seen.
• Retain more of our clients' risks on a net basis than in earlier days.
• Lead to a more efficient price for capacity.

The automatic treaty capacity for If, which enables a swifter response to clients and brokers, has been raised in cooperation with our re-insurers as a consequence of a long-term stable relationship. Thus as the international reinsurance market trusts our underwriting and insurance skills, we are able to lead in an efficient manner the whole programme for our Nordic clients.

Of course this also demonstrates the trust in our own organization; underwriters are equipped with considerable mandates leaving short decision making processes. On top of this, the underwriter is supported by analytical tools, where the price for all layers and sections are included.

For the underwriting decision, capacity only is one factor, and not even the most important one; as risk profile, wording and pricing are also of utmost importance. However, modern analytical techniques definitely have shed light also on this highly traditional discipline of large corporate client underwriting.

Revitalized underwriting

One interesting consequence of this corporate managing of risks is that the portfolio of each underwriter can not offer a stable financial performance by itself. This has lead to the development of concepts such as 4 eye underwriting, re-underwriting meetings and generally more team-work and cooperation securing same treatment and risk evaluation for all risks and clients. However, the authority and responsibility of each underwriter is maintained. In this way we combine the best pieces of analytical tools and collective approach without compromising the importance of each individual underwriter’s responsibility and the use of each individual’s uw-knowledge.

Client trends

Do we see similar trends among our clients? Firstly, the Enterprise Risk Management (ERM), prompted through the Sarbanes-Oxley (SOX) at the aftermath of Enron, WorldCom and other corporate scandals alike has given an enhanced focus on a holistic view on all risks in a company. Guidance on the implementation of ERM has been provided by the Committee of the Tredway Commission (COSO) ERM framework.

The SOX together with ERM emphasize the fact that companies need a clear picture of potential risks, an idea on how to deal with them and prior to this, management has to evaluate and decide on a company’s risk appetite. Among other things ERM clearly has raised the interest toward more efficient insurance programs.

The clearest trends we see among our clients are
• Lift of program trend • Holistic risk management approach
• Service and quality expectations from the insurer
• Clarification of captive strategies

Lift of program trend
We clearly have seen a need for higher capacity. When mapping risks and corresponding risk management measures – including insurance – companies have started to check if the old worst loss scnarios and sums insured are sufficient for their current business operations. At the same time requests for broader wordings have increased as protection for the more unlikely events are sought. And naturally this does not just concern the working layers. It has become even more important with similar coverage also on the upper layers of insurance programmes. This trend can be seen in both property and liability insurance programmes. This corresponds also with the way If evaluates reinsurance. The graph below demonstrates the relationship between the probability of a risk and the financial magnitude of a possible risk.

Holistic risk management approach
This is the result of the same type of awakening process as If has been through, where for many of our clients, e.g., financial risks more severely could violate bottom-line performance than, say, the fire exposure.

However, also business (e.g., share price), operational and other risk factors need to be considered. A major fire in a key facility or a large product liability claim, could affect the share price of the company to a much larger extent than its purely financial effect would indicate. Thus, a holistic risk management perspective is needed in order to assess the appropriate insurance cover to set up.

Service and quality expectations from the insurer
ERM also puts pressure on the effective and efficient use of a company’s resources – not only limited to capital resources. In order to have a finger on a company’s risk management pulse one has to be able to trust external service providers’ capabilities. For insurance carriers this means serving clients not only on clear underwriting issues, but also on claims handling, risk management and global and also local services wherever our clients have their business operations.

As an example If Industrial acknowledges this trend by tailoring Claims Models in order to find the most suitable claims service package to match a client. In addition, we are now further improving our service standards for handling international insurance programmes (ISM models).

Clarification of captive strategies
When the captive evolution started in the Nordic region back in the 1970s, Captive insurance companies used to be considered more of a financial vehicle than a real risk management tool and were mainly run by the companies’ CFO.

The development during the 1990s made captives more of a risk management tool for the companies’ CRO. After careful evaluation of the company’s risk map and appetite, the captive is used as a method for retaining part of the risks and also a tool for insuring risks that do not fall within the basic scope of property and casualty risks - like some of the pharmaceutical or automotive industries´ risks.

However, captives should be subject to the very same holistic risk management considerations as for any other risk carrier. As for insurance companies in general, companies using captives have to consider at least the following issues:
• Operational risks, e.g., claims handling and international service for global units
• Cost for reinsurance versus retaining risks
• Reserve setting / balance sheet risks
• Market risks
• Exit possibilities from the captive solution

Example 1: With a widespread international/local insurance need with many locations it could, say, be more beneficial from an operational point of view to utilize a reinsurance captive rather than a direct captive.

Example 2: In order to prepare the company for being divested, one stops writing liability in the captive in order to avoid putting old exposures up for sale.

Summary

Regulatory environment such as solvency 2, SOX and thereby ERM has put a lot of positive pressure on our and our clients’ risk management and capital allocation. We have to be well aware of our risk map and at the same time evaluate how to allocate the capital in use in the most efficient manner.

If has increased its treaty capacity in order to respond to the needs of our Nordic clients. At the same time we increased our service level to match the requirements of holistic risk management and larger risks. Consequently, I believe we have an excellent foundation for dealing with the challenges of large risks and capital efficiency together with our clients.

Espen Husstad

http://ifnews.if.fi/en/

The Chief Risk Officer is multi-talented

noreply@blogger.com (Prasetyo) — Thu, 28 Aug 2008 11:34:00 +0000

The Chief Risk Officer is multi-talented

The Chief Risk Officer (CRO) or Risk Management Director is now an established position in Finnish companies and is responsible for a wide range of tasks, the emphasis of which is moving from property risks to business risks. The most significant challenge for these professionals is considered to be establishing risk management as an integrated part of the management system and business process. In order to be successful, the CRO must first convince line managers of the importance of risk management.

At the same time as enterprise wide risk management (ERM) has become more common, a new group of professionals – the CRO:s – has evolved. The views and opinions of these professionals and the challenges they have experienced were studied in a research project during the spring of 2007. The research was organized by Ernst & Young in co-operation with the Finnish Risk Management Association. The target group was the risk management professionals working in Finnish companies and associations.

The professional background of individual CRO:s varies a lot (figure 1). This may be due to the relative newness of the position and that risk management in its entirety is quite an extensive area, covering many different sectors.

The risk management professionals who answered the questionnaire represented 15 different educational and experience backgrounds in total. When asked, only 17 % of those who answered stated that their education and experience were specifically connected to risk management. The vast majority, i.e. over 80%, have therefore moved to risk management work from another sector, the most common of which is insurance. The other common backgrounds are corporate safety, accounting and financing.

Risk management seeks security

The objectives that an organisation sets for risk management form an important starting point for the work of a CRO (figure 2). The most common objective that the organisations participating in the research work identified for risk management is “ensuring the achievement of targets”. Three-quarters of those who answered the questionnaire stated that they had set this objective.

Setting objectives is a fundamental part of ERM. According to this, hazards are all those factors that can put the achieving of business targets at risk – no matter which risk class they represent. Other objectives, which have been most commonly set are connected with improving risk awareness and the risk management function within the organisation, loss prevention and securing continuity of business operations.

In contrast, the objectives connected to economy and financing, such as reducing the fluctuations in profits or cash flow, or ensuring the achievement of the forecasted profit are only rarely set. Thus the dogmas of business economics and financing do not seem to be applied to any significant degree in practical risk management work. This is despite the fact that business economics and financing are well represented in the backgrounds of risk management professionals and that risk management directors or CRO:s very often report to the Chief Finance Officer.

Chief Risk Officers participate in many activities and must work in several areas of risk in order to meet the objectives. Typical areas of work cover physical as well as intangible risks, technical as well as commercial risks, together with risks that are internal as well as external to the organisation. However, this does not mean that the CRO would be responsible for all of these risks; according to an established model, the Group Risk Management operates primarily as a coordinator and internal consultant for the managers of the business units, who in practise are responsible for the line risk management.

Based on the research results, it is clearly more common for the CRO to participate in developing and co-ordinating risk management activities rather than to be completely responsible for the work. According to the survey, property risk management is the area for which the CRO bears most responsibility for developing risk management strategies.

It has been estimated that nowadays property risks occupy most of the time of the CRO (figure 3). Property risks represent the traditional area of risk management, as do health and safety risks, which also demand a substantial portion of the CRO’s time. Furthermore risks related to marketing, client contact, competitors and supply chain management have recently emerged, to broaden the scope of CRO’s area of responsibility.

In the future the emphasis will be on strategic risks

The results of the survey suggest that this trend will be further strengthened in the future. When asking the question; which types of risk the CRO:s will put the most effort into during the next three years, it is clear that the risks connected with marketing, clients contact, competitors, partners and networks are clearly expected to rise above the others.

It seems that the focus for risk management work in the future will be concentrated towards the strategic risks of business operations. This is an area in which the CRO:s have not traditionally been involved. Only a few of those who answered the questionnaire were of the opinion that in the future the focus should be on property risks. It was also considered that the risks connected to health & safety and economic reporting will demand less consideration in the future than is currently the case. However, this does not mean that these risks will disappear. But so much effort has already been put into these risks, that in the future it is anticipated they will demand less consideration, relative to the newly emerging areas of risk.

The main risk management activities for which the CRO:s are responsible include the development of risk management principles, reporting practices and tools and insurance (figure 4). However, only one in four of the CROs are responsible for identifying and assessing risks. The survey indicates that this task belongs primarily to those who are directly responsible for the risk, being typically found within the sphere of the specific business operations management.

However, it would be beneficial if those working in risk management, actually participate in the risk assessment and provide the necessary methods and tools to carry out the process. Thus it is alarming that almost 40 % of those who answered the questionnaire advised that the risk assessments of investments are carried out without the participation of the CRO, although, it is more common for the CRO to participate in due diligence processes.

The challenge is to take risk management to the business operation units

The biggest challenges for CRO:s are in connection with introducing risk management to the organisation (figure 5). As many as 80% of those who answered the questionnaire felt their main challenge was to integrate risk management into the management system and business processes. The second most important challenge the questionnaire highlighted was marketing risk management and proving its benefits to line management and business operation units. One third of those who answered also felt that the maintenance of defined operating methods in the organisation was a significant challenge. These three issues are closely connected to each other.

To ensure that the organisation maintains the risk management processes, it is necessary that risk management is integrated into practical management and that the benefits it brings are clear for the business operation units. The selling of risk management to senior management in a company seems however, to be a lesser challenge, only stated by 25% of the participants. Using the words of one of those who answered the questionnaire: “Senior management has already begun to understand the significance of risk management, however, how do we increase the understanding of the next management levels”?

The most significant challenges when communicating with senior management are connected to understanding their expectations, clarifying their targets and meeting their targets, i.e. proving the operating ability of risk management to them and the board of directors.

The operating environment of companies is constantly changing and developing and the new phenomena that are emerging in addition to familiar risks must be understood and managed. The world of risk is continuously expanding, so that the challenges facing the Chief Risk Officers will not decrease. On the other hand, the same development might ensure that the services of the CRO in greater and greater demand in the future.

Fredrik Åström, Manager, Advisory Services unit of Ernst & Young

http://ifnews.if.fi/en/

Risk management is a clear competition factor

noreply@blogger.com (Prasetyo) — Thu, 28 Aug 2008 11:19:00 +0000

Risk management is a clear competition factor

A good level of risk management helps a company to economically recover from a disaster. Senior management and its ability to perform correctly in the aftermath of a crisis situation are of crucial importance. Risk management is therefore a clear competition factor.

Oxford Metrica recently published an international research study in which the impact of mass fatality events on the shareholder value is clarified. Companies can be clearly divided into companies which deal effectively with the situation and whose shareholder value after initially declining eventually strengthens and those companies whose shareholder value does not recover. In the latter group, the decrease in shareholder value became deeper and stayed permanently on a low level during one calendar year (261 trading days).

One of the key conclusions from the study was that the ability of senior management to perform in the aftermath of a disaster and in the crisis caused by the disaster is a significant factor in influencing the company’s value. 74 companies which suffered from disasters were analyzed in the research study.

A good level of risk management has become a significant competition factor and Enterprise Risk Management-process (ERM) has become an integral part of almost every major enterprise’s Corporate Governance system. At the same time, the demands which have been imposed have increased.

The task of the ERM process is to ensure the management of all of the types of risks, that can threaten business operations and which can prevent the company from reaching the targets that have been set for its business operations.

One of ERM’s important areas is accident risks. The task of If Industrial is to support our client companies in this area by providing insurance and risk management solutions which will secure the business of our clients. The solutions include client specific risk assessment, loss prevention, an insurance solution and claims handling.

With regard to risk assessment and loss prevention If Industrial has the largest RM unit in the Nordic insurance industry. In addition to property and loss of profits risks, it concentrates on cargo, health and safety and liability risks. The unit supports our client companies’ domestic and international risk management work.

One of the most challenging risk management areas is the management of liability risks. The risks in this area have not be so well predicted or evaluated in comparison to property and loss of profits, for example.

The health effects of chemicals and their associated liability issues might not appear until many decades have passed. The risks associated with components as part of a safety critical system can be difficult to analyse, too. In the same way, the risks connected with different product user groups can be a challenge from the assessment point of view.

Legislation varies in different countries and the laws can be amended and this can have an impact on risk assessment. There are also many different forms of liability. In addition to the third party and product liability areas, the an alysing of professional indemnity and directors’ and officers’ liability requires its own expertise.

If Industrial has carried out consultancy work connected to liability risk management for its client companies in Finland for over 10 years. The operating model has now been refocused and is being extended to every Nordic country. The new approach supports underwriting decisions and at the same time provides a good overall picture of the management of the liability risks in its entirety on an enterprise level for our client companies.

The operating model is based on co-operation with our client companies. The tools used to assess the risks are:

(1) Positioning and analysis of the liability risks
(2) A Navigator analysis of high risk liability areas.

The operating model is the same for all areas of risk management and it is based on co-operation between our client companies, brokers and If Industrial. Our objective is the correct identification and assessment of the risks and a thorough review of the risk management in a constructive manner. We handle identified risks openly with our client. The target is to produce a three year programme for improving the level of risk management.

Juha Ettala

http://ifnews.if.fi/en/

A holistic risk management framework

noreply@blogger.com (Prasetyo) — Thu, 28 Aug 2008 10:51:00 +0000

A holistic risk management framework

Risk in general is the likelihood or probability of a negative consequence, typically a loss or a missed profit opportunity. For a P&C insurance company like If, the largest risk is insurance risk. However, we are also exposed to other risks such as credit, market, operational and business risks. No one can predict the future with 100% certainty, but there are many ways of handling its uncertainties. Management of risks is important for both small and large corporations, either it is a manufacturing company or a financial institution. For an insurance company in particular, risks and management of risks are part of the daily operations, since insurance by definition is about transferring risk from the insured to the insurance company.

For us, the purpose of risk management is to identify, analyze, control and mitigate all risks that could prevent us from achieving our goals and targets as well as to determine, implement and improve risk management methods. There are risks connected to both pricing insurance products, cost management, investment strategies and claims handling. Therefore we aim to secure that the risk management work is continuously ongoing in all parts of our organization. The ultimate objective of our risk management process is to ensure adequacy of capital in relation to the risks we carry, as well as limit fluctuations in financial results.

During the last couple of years, there has been a development in risk management, from traditional risk management where risks were managed on a stand-alone basis into Enterprise Risk Management (ERM), which places emphasis on a holistic view of risk management at an enterprise level and the integration of risk management with other business processes. The drivers behind this development are:

• more complicated risks
• enhancing the deployment of capital
• internal requirements from owners and management
• external requirements from regulators and rating agencies
• more sophisticated methods to quantify risks

One of the drivers behind the change in the insurance industry is the current on-going EU-driven project (named “Solvency II”) aimed at establishing new risk-based capital requirements for the European insurance industry. The new regulation will to a greater extent encourage and give incentives for insurance companies to measure and manage all their risks properly and on an aggregated level. “Solvency II” is expected to come into force in 2010 and we are actively taking part in this project in our efforts to be “Best in Risk” and in having a leading risk management practice.

Enterprise Risk Management

For us, ERM is the assessment, exploitation, financing and monitoring of risks from all sources for the purpose of ensuring that the aggregated risk exposure is in relation to our capitalization (Based on CasualtyActuarial Society’s definition of ERM). Through our ERM process, risks across the whole group are managed holistically.

ERM encompasses for example:

• identifying and managing multiple and cross-enterprise risks
• aligning risk appetite and strategy
• improving deployment of capital

Identify and manage multiple and cross-enterprise risks

In order to properly assess exposures, companies must continuously measure all risks, both financial and operational, across the whole organization. When making this assessment, the correlation between risk classes and risks across all products, business areas, legal entities and geographies must be identified.

One of the main objectives of ERM is aggregating risks, explicitly capturing existing correlations. This will provide valuable insight into the interactions betweens risks and the diversification effects given certain business mixes, investments strategies etc.

In If, methods to assess the aggregation of exposures by risk type, within for example a business area, or country, as well as the ability to calculate total aggregated risk within the whole group has, been developed to help us understand our existing exposures and to define risk tolerances.

Aligning risk appetite and strategy

Effective ERM can help enhancing strategic decision-making and optimize return on capital by providing a better understanding of the trade-offs between risks and rewards. This will help decision making in issues like product design, product pricing, reinsurance program design, market and product expansion strategies etc.

Improving deployment of capital

ERM can improve the deployment of capital by aligning capital management with all risks and with diversification effects taken into account. By proper risk management and risk quantification, the need of solvency/risk capital can be more accurately quantified, thereby limiting the excess capital and consequently the cost of capital.

Implementation

In order to implement ERM, a new risk management governance framework was approved by If’s Board of Directors, in May 2005.

The following chart illustrates our current risk management governance framework.

The current risk management governance framework was established in order to:

• Create a centralized group risk management function responsible for monitoring all risks
• Identify, and as required quantify and aggregate, all risks in the organization
• Formalize and set-up of reporting routines to meet regulatory requirements as well as internal risk reporting

By this risk management governance framework, the If Risk Control Committee (IRCC) will appropriately assist the CEO and the Board of Directors in fulfilling their responsibilities relating to risk control. The IRCC is responsible for the review of systems and processes as well as for the coordination of efforts and actions related to internal control, risk management and compliance. The IRCC meets at least on a quarterly basis with an agenda that consists of aggregated risk and capital summary reports, in addition to specific risk reports for each risk area and legal entity.

Different sub-committees are responsible for measurement and follow-up of the various risks. For each risk area, the respective sub-committees are responsible for ensuring that the risk reports are produced and updated to the IRCC meetings.

The Chief Risk Officer (CRO) is responsible for coordinating the risk management work on behalf of the IRCC and for coordinating the risk reporting to IRCC. It is also within the responsibility of the CRO to secure a holistic view of the risks we are exposed to, including continuously monitoring our accumulated risk. In addition, the CRO is responsible for assessing and implementing processes related to risk management and for compliance with relevant legislation, policies and instructions.

Quantification of risk

In addition to the specific risks, which are individually associated with the insurance business or the investment assets, we are exposed to the aggregated effect of such risks. Some of the risks develop in different directions creating natural hedges. To analyze accumulation and diversification of risks, a Dynamic Financial Analysis (DFA)-model is used. The model is based on Monte Carlo-simulations, of both the investments and insurance operations. The purpose of our DFA-model is to be able to specifically quantify the risk profile of various risk types as well as the total risk, in terms of statistical measures. The model is used for instance to analyze the impact of different reinsurance strategies and investment allocations, in order to make decisions concerning for example the optimal retention level or share of equities in the investment portfolio. In addition, our DFA-model is used as basis for capital allocation to different insurance classes, depending on their respective risk contribution. By allocating capital in relation to risk, improvements are made in terms of a more correct pricing of different products.

The DFA-model is also used for calculating the economic capital. Economic capital is a measure of the aggregated risk, describing the amount of capital required in order to carry different kinds of risks given a certain confidence level and risk exposure. Insurance, market credit and operational risks determine the size of the economic capital.

Value creation

We believe a strong risk management framework adds value to both our customers and our owners.

First of all, by implementing ERM, we increase our knowledge of the aggregated and cross-enterprise risks we carry. Combined with an improved understanding of individual risks, it will enable us to utilize capital more efficiently. This will ultimately benefit our customers over time since an improved risk profile will result in pricing of our products which even more accurately reflects the transferred risks.

Furthermore, by being risk experts, we can share our improved knowledge with our customers, assisting them proactively in risk management issues – for instance, in terms of recommendation of risk-reducing actions and advice on need of insurance. We are also happy to share experiences on implementing a risk management framework, and on for example risk governance related issues.

ERM has also helped us to make decisions on issues like product design, product pricing, investment strategies and reinsurance program design. In general, through ERM we can ensure that we have a strong balance sheet and risk capital in relation to our risk exposure, which again gives our customers a strong and very solid insurance provider.

ERM should not be viewed as a “luxury”. We believe ERM is an essential tool for companies to engage in effective risk management, and to support strategic decision-making to protect stakeholders’ (owners as well as customers) interest. In other words, a strong risk management framework is a key success factor for small and large companies competing in increasingly complex environments.

Knut-Arne Alsaker

http://ifnews.if.fi/en/

ERM: Are directors on board?

noreply@blogger.com (Prasetyo) — Thu, 28 Aug 2008 10:31:00 +0000

ERM: Are directors on board?

Conference Board study shows directors pushing hard for ERM

Michael J. Moody, MBA, ARM

Much has been written about enterprise risk management (ERM) over the past few years. A number of reports and studies have discussed the rationale for adopting an ERM approach and how corporate management has been accepting of the concept. A variety of new laws and regulations following the Enron et al. financial collapses have clearly pointed out to corporate executives the wisdom of an enterprise view for risk management. And at this point in time, there is little doubt as to management’s commitment to ERM. However, until recently, little was known about the corporate directors’ commitment to ERM.

Recently, The Conference Board issued a report titled “The Role of U.S. Corporate Boards in Enterprise Risk Management.” This landmark study confirms that boards of directors of publicly traded companies have been heavily focused on the Sarbanes-Oxley requirements over the past couple of years. Despite this renewed interest in governance and compliance, boards are also beginning to assess their evolving role in risk management oversight. The report notes that most directors now realize that they must advance their focus from the traditional role of internal control to a more comprehensive ERM framework.

Emerging trends

The Conference Board identified a number of key findings in their report. Included in this list were the identification of several emerging trends with regard to corporate boards and the responsibilities of the directors. Among the more important trends were the evolving legal developments that make it prudent for directors to ensure they have a robust ERM oversight process is in place. Further, boards must be proactive in their oversight of the risk management process.

The report noted several developments that make this proactive involvement critical for a board. These developments include new New York Stock Exchange listing standards, SEC’s endorsement of self-regulatory frameworks to manage financial risks, Federal Sentencing Guidelines reform, and best practice standards being implemented in highly regulated industries such as banking and insurance. It also noted that several key groups are beginning to focus on whether companies have ERM processes in place. These include rating agencies, institutional investors and insurance companies directors and officers underwriting departments. As a result, the study suggests that corporate boards may soon choose to reassess their approach to risk oversight as a fundamental element of good governance.

The report also noted that an increasing number of directors are beginning to acknowledge that they must oversee business risk as part of their overall strategy-setting role. While most directors agree that they previously had a less than perfect understanding of business risks, just a few years ago, now many more directors say they have a better understanding of the major risks facing their companies. As a result of this improved understanding, directors believe that strategic risks rather than financial risks should be their key concern. They also recognize that an enterprise-wide approach to risk management should be viewed as a strategic effort rather than merely a compliance issue.

Despite the improved view of risk management, some directors still admit they need to make improvements in their risk management oversight processes. They indicate that every conversation they have about strategy embodies issues of risks and, as such, risk is now discussed on a case-by-case basis in connection with specific strategies or events. In addition, most directors say they have a “good’’ or “very good” grasp of the risk implications of different strategies their companies may choose.

However, while the survey results indicated that directors were satisfied with their risk oversight and management’s implementation, personal interviews with individual directors showed considerably less comfort. Areas of concern for the individual directors were the variation in knowledge of risks among their peers and significant differences in ERM practices among different industries.

The report also noted that sound ERM oversight and implementation practices are now a trend that is recognizable in a number of leading companies. Leading companies have indicated that the full board has clear oversight responsibility for strategy as well as ERM. And while management sets the agenda for both, the board must approve it. Additionally, it is the board’s responsibility to provide oversight as well as ensure that an effective process is in place for identifying, assessing, and mitigating risks that exist within the company. Management’s responsibility, on the other hand, is to see that risk management is embedded in everyday business decisions throughout the company on an enterprise-wide basis.

The Conference Board report also noted a trend that companies are beginning to look at best-in-class peer organizations for emerging practices in ERM oversight. They also noted that despite the reported variations from industry to industry, corporations could look to the financial service industry for more sophistication with regards to ERM oversight. This will provide the board with an opportunity to learn from the financial service firms while distinguishing themselves as leaders in ERM development.

Recommendations for boards

The Conference Board report notes that many directors are now considering recommending that their companies upgrade their ERM capabilities. They believe that directors may wish to consider several specific recommendations. For example, directors want to confirm that risk management oversight rests with the board. While some corporations have placed this responsibility within the audit committee, most directors believe that this committee is already too overburdened and may lack the skill sets to effectively handle this duty. In order to correct this problem, some organizations are now forming new ERM committees to handle this important task.

The Conference Board report also recommends examining the competencies of the board members to assure successful risk oversight. If needed, the report suggested strengthening the board to get people with a variety of expertise and proper risk management training. Further, corporate management should continue to work toward increasing directors’ risk management IQ. One method that can be used effectively is to dedicate time at each board meeting to discuss various risk management relevant topics.

The report also suggested that the board implement a risk management process that will ensure that the individual directors are fulfilling their fiduciary responsibilities. This process should center on the appropriate oversight of the ongoing ERM assessment, mitigation and monitoring. This process should begin with an in-depth review of the corporation’s performance drivers. It should continue with an inventory of risks and an analysis of how those risks will affect shareholder value.

Another important recom-mendation advanced in the report is to develop a robust ERM reporting system. Central to the reporting system is providing information that gives directors the data needed to understand the company’s risk. It is critical that the board understand which risks it needs to be aware of and how often it should review the handling of those risks. All risk reports should be designed to provide specific, decision-making information, and should prioritize the key risks and include management’s assessment of these risks.

A final suggestion stated that management should invest the time needed to relate the core risk issues to the directors. Further, management and the board should identify those key executives who have the best perspective on the organization’s risks and have ongoing dialogue with this group.

Conclusion

The recent Conference Board report has provided significant insight into how corporate boards are now viewing their responsibilities regarding risk management. As the report documents, there is little doubt that boards are now recognizing the critical nature of risks within their corporations and their oversight responsibilities. While a number of organizations are still struggling with ERM implemen-tation, their boards are painfully aware of their oversight role and their duties from a risk management standpoint. Speculation has been high as to who will be the ultimate driving force for ERM implementation. Among possible drivers, experts have recently identified directors & officers liability underwriters, lending institution requirements, rating agencies and institutional investors. However, as time goes on, it may well be the corporate directors who will insist on a state-of-the-art ERM program. *

The author
Michael J. Moody, MBA, ARM, is the managing director of Strategic Risk Financing, Inc. (SuRF). SuRF is an independent consulting firm that has been established to advance the practice of enterprise risk management. SuRF’s primary goal is to actively promote the concept of enterprise risk management by providing current, objective information about the concept, the structures being used, and the players involved.

The Top 10 Enterprise Risk-Management Myths

noreply@blogger.com (Prasetyo) — Tue, 26 Aug 2008 10:34:00 +0000

The Top 10 Enterprise Risk-Management Myths

Gordon Burnes

Few companies can grow without taking risks. But poor risk management leads to surprises in business operations that can impact shareholder confidence, regulatory oversight and the bottom line. An unprecedented wave of regulatory oversight in recent years has convinced many organizations how inadequate their enterprise risk management (ERM) policies and procedures really are.

Many of the world's largest companies have responded to external and internal pressures by embarking on a journey to unify governance, risk and compliance (GRC) management across the enterprise. Yet, many organizations that don't have a historical foundation in risk management are still struggling to come to grips with this new discipline and how to embed risk management into the business.

With that in mind, here's a Letterman-like look at the top 10 myths regarding ERM.

Myth Number 10: IT Risk Management = Information Security

Most information security programs place far too much emphasis on the how and what, and far too little on the why. Information risk management, on the other hand, is inherently focused on the why.

Unfortunately, there's always far too much for information technology (IT) staffs to do. There are too many vulnerabilities to remediate and too many controls to implement, so some critical deficiencies will go unmanaged.

True risk management requires a business perspective on these deficiencies to better manage and prioritize the issues that threaten the organization. A check-list approach to information security ignores business impact and criticality.

Myth Number 9: CIOs Embraced Enterprise GRC

To address Sarbanes-Oxley compliance, many companies put in place technology platforms that now support a variety of risk and compliance initiatives. Sarbanes-Oxley solutions were generally purchased with the tacit approval of IT, but few IT organizations standardized on a strategy for managing risk and compliance data. As a result, different parts of the problem are addressed by a wide and disparate range of solutions, including spreadsheets, custom and commercial applications.

In numerous buying decisions, IT is too often at the table in a support role, rather than as a strategic thinker focused on the long-term strategic benefits of a common GRC platform. Scattered risk and compliance data marts will cause an immense amount of pain for risk managers trying to get a clear picture of risk throughout the business.

Myth Number 8: A Rigid, Standardized Approach Is Best

ERM, similar to most business processes, is not a "one-size-fits-all" solution. It has to be customized and tailored for each firm. As Mark Olson, chairman of the Public Company Accounting Oversight Board (PCAOB), notes, "An effective enterprise-wide compliance-risk management program is flexible to respond to change and is tailored to an organization's corporate strategies, business activities and external environment."

Companies that try to implement an out-of-the-box methodology will likely fail. ERM methodologies and taxonomies must be adapted to a company's legal, regulatory, economic and competitive environment, all of which can vary dramatically by industry. Further, the risk framework must be able to adapt to change over time to avoid losing competitive advantage.

Myth Number 7: You Can Manage Risk Only from the Center

No one is likely to argue that strong, central risk management is a bad thing. Unfortunately, many organizations make the mistake of investing only in a centralized function because it's too difficult to federate, and they don't know how to push risk management to lower levels of responsibility in the organization. It's a classic issue of consistency vs. quality of information.

But, accurate information lies at the business line level. Organizations must augment their centralized risk management efforts with localized, distributed data, and the only way to reliably and cost-effectively do mat is to invest in automated technology solutions.

Myth Number 6: You Can Manage Risk and Compliance with Spreadsheets

Spreadsheet wizards have carved out a significant role in managing financial and operational data in many companies. The problem is that this approach is: a) manually intensive; and b) highly reliant on the individuals that manage and operate these spreadsheets. Further, the processes for linking, updating and archiving data in spreadsheets is mostly ad hoc, leading to significant risks.

In its 2005 annual report, for example, the Federal Home Loan Mortgage Corp. (Freddie Mac) noted that reliance on "end-user computing systems" (read: spreadsheets) posed a significant risk to its ability to report accurately on financial data. Using spreadsheets and file shares for risk and compliance data is a dead end; risk managers have trouble getting visibility into the data because of poor reporting capabilities, and will rightly question the accuracy of the data itself.

Myth Number 5: Traditional Audit Planning Is Good Enough

A traditional model to planning the audit process typically examines 10-20 risk factors for each element of the audit universe, and runnels each auditable entity into a risk category that will drive its audit frequency. But the known risk universe gets bigger by the day, and investing in a massive risk evaluation for each entity may not be the best use of resources.

Is it worth tying up valuable stakeholders in management and on the audit committee to assess the risk inherent in the coffee procurement process for a remote sales office? Progressive organizations are turning toward a more agile, top-down approach to risk assessment to drive audit scheduling. This will lead to more efficient resource allocations, ensuring that auditors are focused on the truly risky areas.

Myth Number 4: Enterprise Risk Management Is Dead!

David Martin and Michael Power assert in "The End of Enterprise Risk Management," a report published last year by the AEI-Brookings Joint Center for Regulatory Studies, that ERM frameworks are outmoded because they embody an unrealistic and outdated theory of organizations -- hierarchical, "bird's-eye views" from the top that are progressively detached from the reality of modern financial organizations.

Truth be told, the current regulatory climate has resulted in control-based ERM frameworks that have a bias for analysis versus action, and the production of evidence for regulators and auditors in some instances has become more important than managing real risks. But that doesn't mean we should abandon ERM.

ERM needs to be deployed bottom-up so that business managers are the first-line managers of risk, embedding enterprise risk management within the day-to-day business processes of the firm. They must understand the risk/reward trade-offs involved in their own decision-making. Risk management should create a bias for action, surfacing problems as they arise and empowering the entire organization to be risk managers.

Myth Number 3: It Just Takes Common Sense

"There are really no cookbook solutions. One has to use creativity and a lot of common sense." This was a May 16, 2000 email response from Enron Corp. risk expert Vince Kaminski, when asked by a colleague to recommend a good book on operational risk.

As Enron proved, creativity is a no-no and common sense alone just doesn't suffice when it comes to risk management. As business activities have become more complex, so has risk management. The sheer magnitude of the regulations leaves many firms struggling to put in place processes and infrastructure that are able to identify and control the compliance risks they face.

Risk management covers a wide variety of risk disciplines, including operational, compliance, financial controls, legal, liquidity, business strategy and technology, each of which has its own nuances and specialized models for assessing risk. It may not be rocket science, but it does require application of sophisticated models and analytics, aided with accompanying software tools.

Myth Number 2: TJX -- It Can't Happen Here

The TJX. Cos. data breach, perhaps one of the biggest business stories of 2007, involved the inadvertent dissemination of as many as 94 million credit card accounts. It is only one of the breaches that were publicly reported. Attrition.org maintains a list of public, high-profile data breaches that is staggeringly long, going back to the year 2000. When you consider companies have a vested interest in not making such events public and the many more breaches that undoubtedly go undiscovered, only the tip of the iceberg is visible to us.

But, shouldn't we be getting safer? Preventative technology and knowledge gets better and better every day. Unfortunately, the villains also get better and better every day, so the gap persists. Your organization is susceptible, and it's critical you do everything you can to keep the gap as narrow as possible to minimize your risk.

The Number One Myth about ERM: You Can't Plan for the Unknown

You may not be able to predict events that lie outside the realm of regular expectations, but risk managers have to plan for their occurrence. No one could predict or even imagine the series of events that occurred on 9/11, but some firms did plan for the possibility of a long-term disruption of their business operations due to a catastrophic event taking place in Manhattan and were up and running from alternate operational centers within hours of the fatal events of 9/11.

Key risk exposures, whether they are operational, market or credit risks, do not always follow a normal distribution or bell curve. Some risks have fat tails, and it is the events that lie at the lower and upper ends of the distribution curve that are most important to consider and plan for. You have to fight the natural tendency to focus on the known, the tangible and the repeated and devise strategies to cope with the unknown -- your company's viability may depend on it.

Companies that try to implement an out-of-the-box ERM methodology will likely fail. ERM methodologies and taxonomies must be adapted to a company's legal, regulatory, economic and competitive environment, which can vary dramatically by industry.

Enterprise risk management to the rescue

noreply@blogger.com (Prasetyo) — Tue, 26 Aug 2008 09:51:00 +0000

Enterprise risk management to the rescue*

A Canadian CA gives his perspective on COSO’s new integrated ERM framework

By Frank Martens

*This is an expanded version of a summary that originally appeared in the March 2005 issue of CAmagazine.

Effective enterprise risk management is more than just getting better at identifying and assessing risk. The true value of ERM is that it can help organizations operate more effectively in environments filled with risks. ERM is not about constraints; it’s about helping organizations get where they want to go.

Businesses in Canada and around the world are experiencing unprecedented change. Once-stable companies have dissolved and been replaced by seeming upstarts. Businesses that are flexible, readily adaptable and more anticipatory are being rewarded. This challenge – ensuring strong performance in an environment of accelerating change – is compounded by the mandate for companies to be accountable to stakeholders’ growing expectations. The resulting increase in uncertainty affects virtually every business, and has given rise to a need for aligning corporate governance, enterprise risk management and organization-wide compliance.

Most large companies have risk management processes in place. They know taking risks is part of doing business, and managing risk is critical to success. But enterprise risk management practices vary greatly and the term itself has meant different things to different people. As a result, boards and senior executives who are responsible for overseeing the identification, analysis and management of risk have not had comprehensive guidance from a single source by which to evaluate their approach to ERM.

In September 2004, the US Committee of Sponsoring Organizations of the Treadway Commission (COSO) released the Enterprise Risk Management – Integrated Framework. With the release of this framework, organizations have a principles-based framework to provide direction and criteria for improving their ability to manage risks to the enterprise. This emerging open standard should eliminate past confusion resulting from competing views of what ERM is and is not.

“This framework could not be completed at a more appropriate time,” says COSO chairman John J. Flaherty. “Organizations worldwide now recognize the linkage between corporate governance, enterprise risk management and entity performance. Many seek to improve processes for identifying, analysing and managing risks. Yet until now, there hasn’t been a comprehensive framework that truly meets the far-reaching demands of the new regulatory and competitive environment.”

The advantages of the COSO framework have not gone unnoticed. Says Tamara Ebl, manager, enterprise risk management and OSC compliance for Terasen Inc.: “Enterprise risk management provides management throughout the Terasen group of companies with a more holistic view of the enterprise from a corporate governance perspective. Management is cognizant of the importance of mitigating risk and periodically reassessing the risk profile of the enterprise in response to changes in the business environment, both internal and external. Management believes that Terasen’s shares command a premium as a result of investor confidence in the management of the enterprise’s risk profile and earnings consistency year over year.”

A strategic approach to risk management

COSO’s framework adopts the premise that every entity exists to provide value for its stakeholders. All entities face uncertainty and the challenge for management is to determine how much uncertainty to accept as it strives to grow stakeholder value. Uncertainty presents both risk and opportunity, with the potential to erode or enhance value. ERM enables management to effectively deal with uncertainty, enhancing its ability to build value.

This applies to for-profit as well as nonprofit organizations. Kay Best, executive vice president, risk management and CFO for the Calgary Health Region, puts it this way: “We are constantly challenged to find new ways to provide services with limited resources. Risks are being presented on multiple fronts, demanding well-coordinated and integrated responses to minimize uncertainty and maximize opportunities. To meet these challenges, healthcare organizations need to move beyond the traditional insurance and claims management focus and take a more strategic approach to risk. Our main focus is preserving and creating value for the people we serve by ensuring that our strategic efforts are not diminished through avoidable loss, or hampered by change and uncertainty.”

While COSO’s framework offers benefits to organizations that move to adopt it, there are other risk management frameworks in use today. Several organizations have adopted Standard Australia’s Risk Management framework and many government organizations have adopted the Treasury Board of Canada Secretariat’s Integrated Risk Management Framework. In addition, publications such as the CICA’s Criteria of Control (CoCo) guidance provide insight and assistance to organizations reviewing and assessing control, risk and governance.

One of the inevitable questions will be how the CICA intends to respond to the COSO framework and whether it also plans an update of its Criteria of Control publications to adopt emerging views on ERM. Says Gigi Dawe, principal, risk management and governance department at the CICA: “The CICA has no current plans to re-issue its Criteria of Control publications. However, this is not to say that the CICA has reduced its support for these publications, and continues to develop publications on risk and governance that, among other things, will be aimed at helping organizations respond to regulators’ expectations for internal control over financials and disclosure controls and procedures.”

While there remains support for these documents, it appears that a shift toward the adoption of the COSO framework has already begun. The recent CICA Exposure Draft on Service Organizations (Section 5900) has adopted COSO-based terminology. Many Canadian businesses seek to comply with their respective regulatory requirements are applying one of the COSO frameworks. The review of several major accounting firms’ publications on OSC material suggests few are promoting the use of the CICA’s internal control framework, deferring to COSO’s Internal Control – Integrated Framework for organizations both south and north of the border. Only time will tell whether organizations will look for a single source that integrates internal controls and risk management rather that relying on multiple sources.

The Canadian profession continues to seek to position CAs as the provider of choice by boards and management for guidance on governance and risk management, with recent publications providing questions for consideration at senior levels. Many of these publications focus primarily on internal roles and responsibilities for ERM – the CEO, risk manager and internal auditors. CAs filling these roles will most certainly bring their financial skills to the risk management processes.

Tamara Ebl notes, “The broad-based business knowledge I attained through the CA program has definitely been a fundamental asset. Development skill sets including researching, facilitation, critical analysis and application of professional scepticism, the ability to effectively communicate results in both written and oral form, professionalism, flexibility and ability to multitask, etc. can be attributed in large part to the CA training program and articling experience. The soft skills developed, such as management of client relationships, have been equally relevant in dealing internally with various levels of management and staff throughout the Terasen group of companies.”

As growing governance duties require board members to provide oversight to these risk management processes, members are looking for support from their trusted advisers. It is becoming more common for CAs in an external audit role to provide insight to boards and management seeking to understand this topic. Expect to see more and more CAs including material on enterprise risk management in regular communications to boards and audit committees, especially once the initial focus on regulatory compliance has passed.

Boards and senior management are also asking questions about the “value” derived from current certification efforts. Organizations continue to invest considerably in the regulatory compliance programs, an investment that continues to increase. Gartner Inc. estimates that by 2006 public companies that do not adopt compliance management processes will spend 50% more annually to achieve US regulatory compliance. Accordingly, building effective, sustainable processes that integrate governance, risk management and compliance efforts is becoming increasingly important, with organizations looking for some form of payback.

The COSO Enterprise Risk Management – Integrated Framework is built on the foundation of the Internal Control – Integrated Framework. The fact that COSO’s ERM framework incorporates the key elements established in the previous internal control framework may ease the transition from a focus on internal control to integrated risk management. However, COSO’s new framework does not replace the internal control framework, and organizations are not required to use it for regulatory reporting.

Getting started

Many companies are now shifting their focus to better leverage people, process and technology to help launch ERM initiatives that align with the goals of the organization and provide a value greater than periodic sign-offs. As with any endeavour, however, knowing where to start can be a challenge. A practical first step is to establish a core team that can bring energy and dedication to this effort. Include people from strategic planning, finance, operations, compliance, internal audit, marketing and human resources – people who play a key role in your organization’s success. This team will also take responsibility for overseeing the design of program tasks and monitoring them in the initial stages. Have each member research a specific topic, reach out to other organizations for insight, or develop a portion of the organization’s presentation on enterprise risk management and solicit feedback from peers. Hold practice Q&A sessions with this group until they are in-house experts on the topic. Develop responses to anticipated questions, such as “Why is this good for us?” and “Which organizations do this well?”

Once your core team is in place with an understanding of basic ERM principles, the organization can begin to identify potential benefits. Since organizations will not all pursue ERM in the same way, the benefits of ERM will differ for each. ERM offers many benefits, but finding those that are relevant for your organization is one of the most important choices you will make. Looking to enterprise risk management to reduce operational surprises and losses is of little value if these losses have not been significant in the past. However, ERM may be of significant value in helping your organization integrate responses that were traditionally managed through multiple and awkward internal channels. Once these benefits are determined, management can then begin to develop a business case. A recommendation to pursue ERM should be supported by an appropriate business case – one that captures the points above, anticipates how key planning tasks will be deployed and establishes authority and accountability.

Together these tasks can help an organization move forward. The tasks themselves need not be overly complex, but should be sufficiently rigorous so that management and the board can pursue the implementation of ERM with confidence.

So, will the COSO Enterprise Risk Management – Integrated Framework really make a difference to Canadian organizations? The answer will depend on how organizations choose to view risk management. Those that adopt the view that managing risk drives better business performance and facilitates achievement of strategic, operations, reporting and compliance objectives are likely to attain greater benefits from their efforts than those that focus their risk management efforts on protecting against bad things that can happen. That choice rests with managements and boards.

Frank Martens, B.Comm, CA, is a senior manager in PricewaterhouseCoopers Advisory practice in Vancouver and one of the principal contributors to the COSO Enterprise Risk Management – Integrated Framework. Contact: frank.j.martens@ca.pwc.com

http://www.camagazine.com

Risk Management Dashboards: Make Protecting Your People a Priority

noreply@blogger.com (Prasetyo) — Tue, 26 Aug 2008 09:34:00 +0000

Risk Management Dashboards: Make Protecting Your People a Priority

William Laurent, William Laurent, Inc.

Risk Management is now a top agenda item for corporate boards, even though there is not always a consistent and correctly structured approach to the handling of risk. As a premium component of corporate governance, the attention given to risk management topics will only increase in this century. Because of this focus, risk management dashboards are gaining prominence, as they attempt to tackle the many dimensions of business risk above and beyond the traditional areas such as legal, market, credit, and asset risk. Various industry studies show that most company boards have established risk policies and control mechanisms in place to oversee risk; after all, failure to properly mitigate and handle enterprise risk could mean the overnight destruction or collapse of an entire business entity. Yet, curiously, only about 25% of major companies have a functional “CRO” (Chief Risk Officer) title at this time (though in fairness, this number is quickly growing).

In the last few years, the historical means of managing risk, using primarily internal or subscription-based information sources, is quickly mutating; companies are concentrating more and more on what is happening outside corporate boundaries. For example, many large companies have special risk management teams that incorporate ex-government intelligence officials, or have agents “on the ground” in various geographical locales who are tasked with conducting threat assessment and risk-related research. Since 9/11, the experts in enterprise risk management are giving additional weight and scrutiny to considerations that are outwardly hostile in nature. For example, a study by ISMA (International Security Management Association), whose primary members are the chief security officers in large publicly traded companies, has listed their largest concerns as:

Business continuity
Employee safety
Property crime
Political unrest
Terrorism

The fact that an organization like the ISMA exists and is assisting legislative and regulatory bodies in an advisory capacity (and liaising with educational institutions) speaks volumes. It shows that executives, audit teams, regulators, and various risk professionals now want dashboards that track and manage risk around new classifications of exposures and threats to their companies’ and clients’ business viability. External risk factors are gaining credibility and attention with senior management, many of whom until recently have been solely concerned with more internal factors such as portfolio management. The good news is that from both logical and physical perspectives, many of the same frameworks to model and monitor risk used in the past can be leveraged to protect corporate assets and lives. However, an unfortunate obstacle for many companies wanting to begin (or improve) the risk dashboard development process may be procuring data that will help paint a holistic risk picture on an international level. In this case, as part of the dashboard platform specification and creation process, serious attention should be paid to potential sources of non-standard business intelligence needed for the dashboard to be fully functional—both initially and on a daily going-forward basis. Many times outside expertise will to be brought in to help educate companies on what intelligence is available in the international marketplace and how this information is not only critical to the success of the risk dashboard, but how it can help drive corporate strategy. According to Kirk Dauksavage, CEO of RiverGlass Inc., a developer of intelligent web monitoring software “The trend – or more, accurately, the imperative is the identification of relevant information from the WWW. Did you know that The Office of the Director of National Intelligence has referred to the Internet as ‘the source of first resort’ and estimates that upwards of 95% of the information required for guidance of our national policy is available in open [web] sources? Just imagine the edge companies gain if they can put the power of the Internet to effective use in their risk and threat mitigation efforts.”

Although corporations sometimes have a reasonable understanding of which of their physical assets may be exposed to excess risk, they seldom apply the same sort of diligence to their employees. Ironically companies usually expend far more time and energy (through background checks, drug testing, enforcement of stock trading policies, etc.) limiting the potential liability that may result from the actions of employees, rather than actually protecting their well-being when they are traveling into a potentially hostile environment. Company travel intranet sites are a good start; nevertheless, these sites need to become more integrated with corporate security departments to include dynamic travel advisories for employees, whether they are on business or vacation travel. Political and geographical threats mutate and evolve, as do those related to corporate espionage and sabotage.

Best practices and feature sets of such risk dashboards will provide:

Clear lines of accountability and responsibility in risk identification and mitigation

Robust reporting of risk, based on a system of alerts and thresholds

Risk score carding and risk intelligence hierarchy creation

Clear definitions of each dimension and category of risk

Ability to collect and make sense of unstructured and internet-based data elements

Incident command and response functionality

Calendaring and notification of special political events, protests, and more

Means to track risks over time

Virtual data integration and federated queries

Corporate executives and senior managers have an ongoing need to make informed decisions on the travel and living logistics of their expatriate employees and themselves. Risk perspectives change when people’s lives are considered! Having an intuitive and graphical interface that can qualify and quantify such hazards greatly limits corporate liability and while increasing resource stewardship and employee loyalty. In a theme similar to that implemented by the U.S Department of Homeland Security, a series of color coded risk thresholds should be implemented in order to visually categorize travel risks from a high-level:

Low (Gray/Black) : No credible threats; continue to monitor and report on threats or vulnerabilities
Minor (Blue) : Low overall threat levels although some risk is present
Medium (Yellow) : Specific and credible threats; proceed with caution
High (Orange) : Imminent threats reported; proceed with utmost trepidation
Critical (Red) : Incidents in progress; suspend all travel activity to location

Graphical “heat maps” that show levels of risk exposure across geographical regions would accompany such information along with an automated system of alerts and notifications tied to threat level categorizations. Such functionality can embed voracious accountability into not only risk management processes, but also day to day operational processes. All companies need the ability to better discern how risks to both business capital and employees can be minimized. The reality is that political instability and natural disasters are dynamic and unpredictable, and threats to business continuity lurk everywhere. We must remember that risk management applies to all aspects components of the business, including its most important resource—its people. And thinking of risk in geographical and geopolitical terms is here to stay.

From a higher level, a new generation of BI platforms are being developed with risk management as their primary focus, supporting a larger function of corporate governance. Such platforms should be able to gauge and report risk at various minutiae in real-time across all geographic regions, no matter how a business’s organizational silos are structured. Globalization has required a paradigm shift in how we think of and visualize risk. As our notions of risk become more sophisticated, so do the platforms used to manage risk: senior managers now seek to be educated about risk from one central repository or portal from which responsibility accountability for risk mitigation can be delegated. This has created an exciting new opportunity in business intelligence—the creation of risk intelligence hierarchies (RIH) which will help pinpoint flawed policies or operational issues where things and people are in danger, and assess the likelihood and consequences of such dangers. Once the leading indicators of corporate risk are understood, it is much easier to embed controls in business processes to reduce risk, with all the auditable metrics and KPI you come to expect from a real-time BI dashboard.

For more information on William Laurent please visit www.williamlaurent.com

What is missing from the RMIS designs? Why enterprise Risk Management is not working

noreply@blogger.com (Prasetyo) — Tue, 26 Aug 2008 06:55:00 +0000

What is missing from the RMIS designs? Why enterprise Risk Management is not working

Warren, Brian

MANY RISK MANAGERS HAVE ATTEMPTED TO TAKE ENTERPRISE RISK MANAGEMENT (ERM) FROM A SLICK CONSULTING PITCH TO A PRACTICAL MANAGEMENT SYSTEM. BUT WHILE ERM HAS HELPED MANY OF THESE PROFESSIONALS IMPROVE THE STRATEGIC STRUCTURE OF THEIR RISK FINANCING PROGRAMS FEW HAVE FULLY ACHIEVED THEIR AMBITIONS. ONE OBSTACLE IS THE RISK MANAGEMENT INFORMATION SYSTEM (RMIS) BUILT WITHOUT AN ENTERPRISEWIDE ORIENTATION TOWARD RISK DATA.

For ERM programs to fulfill their potential, the RMIS must focus on the risk financing needs and processes of the entire company-i.e., reporting based on its specific financial and operational dynamics. It cannot just tally the insurance companies' claims and losses, as it does now. The system should incorporate occurrence descriptions and retained loss costs. It should support a range of risk financing methods and the financial analysis and reporting needs of the risk manager.

The recommendations that follow do not describe a total ERM system. (Indeed, building a separate ERM system would be like constructing an independent six sigma program. Both must be built into other enterprise processes to be effective.) Rather, the recommendations that follow offer suggestions for the next steps in the evolution of RMIS design, which will, if adopted, make RMIS an integral part of ERM practices.

ERM: Great Concept, Intractable Implementation?

Current professional and academic schools of thought dictate that ERM should achieve proper allocation of risk capital across three major risk categories-financial, credit and operational risk.

To this end, financial risk management is highly standardized. (This is possible because of the extensive statistical data available from large, open markets-equity, bond, currency, derivative and commodity trading systems-and the traders' interest in any analytical systems that provide a competitive advantage.) Credit risk management methods are less developed than those for financial risk management, but they are rapidly evolving. Operational risk is the least developed.

Operational risk includes traditional property/casualty risks, but it is also a catch-all term for any risk that is not financial- or credit-related. This includes risks that are typically beyond the scope of the traditional risk manager: business control risks, corporate governance risks and capital-intensive project risks. For these, we lack statistical data and validated statistical methods to gauge the risks, and therefore few transfer markets have developed for them.

Though we have accurate data on the actuarial dimensions of the frequency and severity of many risks, operational risks often are multidimensional. Across an enterprise, risks have widely varying time horizons, degrees of certainty and predictability. The nature of an occurrence or event can vary widely (e.g., discrete versus continuous occurrences, speculative versus fortuitous outcomes). And the correlations between risks typically are not well understood.

Operational risks frequently derive from specialized functions where evaluating the risks requires experience and expertise (e.g., information systems security, environmental health and safety, contractual risks). Within those business functions, specialists are often unwilling or unprepared to conform their risk assessment methods to a broader system. So while we may be able to get their participation in creating assessments, the assessments cannot be easily aggregated with other loss probability distributions across the organization. Even if we are somehow able to aggregate risk assessments, the credibility of the results may be questioned by the decision maker to whom it is presented because its method of calculation is not clear, or required assumptions are disputed.

All of this reflects a lack of commonly understood and accepted ERM principles, concepts and standards around which to build business processes and systems.

Where Current Generations RMIS Falls Short

Current generation RMIS technology was designed primarily to support insurance claims processing, and it does this quite well. It organizes data in a way that most closely resembles the claims processing systems used by insurance companies. The basic data record is for an insurance claim, meaning that incidents must at least be potential insurance claims to be supported. The data to fill these claims records are normally provided by the insurer or third party administrator and loaded into the database by the RMIS provider. In other words, the system is primarily intended for electronic storage and retrieval of traditional insurer loss runs. This is great if you are running a claims department, but ERM requires much more.

If the goal of ERM is to maximize the firm's net income, then the fundamental premise of ERM is that risk decisions are capital allocation decisions. Risk managers strive to assign the right amount of capital to a mix of risk financing or mitigation methods to optimize results. To accomplish this, they need to understand their company's risk tolerance in light of their organization's cash flows, debt position, credit rating and price-earnings ratio (if publicly traded).

But given that the fundamental concepts of ERM are not yet standardized, how could an information system be designed from the ground up to support it? There are systems that will, with the help of an analyst or actuary, allow risk managers to develop and run simulations of limited sets of risks. Few, however, are designed to collect the requisite data in the first place.

Because the insurer can predefine its risk through coverage definitions, exclusions, retentions, deductibles and limits, these risk-limiting tools ultimately shape the structure of today's RMIS. The risk manager, however, cannot predefine risks and cannot describe every loss incident in terms of the coverage definitions intended to serve the needs of the insurer. Risk managers need an information structure that extends beyond the insurers' boundaries.

Without standardized methods of management and analysis-and the technology to link the information together-it is difficult to implement ERM programs and information systems. And the lack of information systems to collect the loss experience data on nontraditional risks prevents the development of ERM procedures and methodologies. The absence of each element hinders the evolution of the other.

Making ERM tractable will require a pioneer effort to develop the intellectual tools, the prerequisite data standards and information systems that will let us achieve a real breakthrough. Unfortunately, today's RMIS provides no support for this kind of analytics. And a lack of compelling market demand for enterprise risk assessment tools has failed to induce IT entrepreneurs to invest in the development of systems that support ERM.

A Cost/Benefit Analysis

Risk managers already use elements of enterprisewide risk management to improve the efficiency of risk spending. They make estimates of the scope and size of risks facing the firm and thus allocate risk financing resources to bring the firm closer to an optimal allocation of risk capital. The estimates start with risk mapping-plotting the expected frequency and severity of each risk (often displayed on an x-y coordinate chart).

This is followed by scenario analysis, which stress-tests the potential loss amounts. A low probability (95 percentile) sequence of adverse outcomes is developed from the chain of events following a major loss event. The total cost of the path associated with these adverse outcomes is then calculated.

For example, an earthquake damages a key facility. This damage prevents delivery of products, leading to disruption of contracts and revenue loss. The lost revenue subsequently prevents wage increases, leading to a labor union action, which further disrupts production. Unreliable production drives away potential new customers, further reducing future sales.

An initial event often has ripple effects. The full cost of the loss extends far beyond the original damage to the facility. Stress-testing or scenario analysis allows the firm to paint a more complete picture of risks, and to gauge the extent of the firm's exposure to catastrophic events.

To improve these analyses, the risk manager needs to use RMIS to capture more data on the downstream effects of the initial loss event. Invisible costs could be calculated and incorporated into the overall risk picture. This might include the cost of overtime hours for recall and remediation of a defective product, lost sales due to bad publicity, or the added cost of debt service due to a downgrade of the firm's financial rating.

Unlike financial risks or even most traditional property/casualty risks, there is virtually no statistical history on these kinds of costs. And yet, these are the costs that most often threaten the viability of a company in the wake of a catastrophe.

Without more advanced RMIS technology, risk managers are limited to recording the company's loss experience or collecting other firms' case histories and using techniques like modeling and Monte Carlo simulations.

So, would the cost of developing a robust, ERM-supportive RMIS exceed its benefits? The costs are immediate and tangible; the benefit is difficult to estimate or demonstrate. Risk managers already struggle with how to explain the value of a loss that is prevented or financed, particularly as measured by the net present value of the improved capital allocation. Even if the risk reduction is significant, it is a potential future benefit, not an assured, immediate expense reduction.

Whether the risk assessments from RMIS are likely to lead to enough marginal benefits to offset the cost of data tracking and analysis depends on the company's risk profile. Large firms stand to gain the most from refining the efficiency of risk capital allocation. But as the cost of the computing tools needed to collect data and perform the sophisticated modeling and analyses continue to decrease, the benefits grow for all organizations. Ultimately, RMIS may pay for itself by empowering an organization to avoid or effectively finance that one catastrophic loss that would otherwise slash the company's financial results.

Say More: How far is the risk management community from realizing the double goal of ERM-oriented RMIS technology? Reader Forum at rmmag.com

Brian Warren is claims manager for Microsoft Corporation in Redmond, Washington. He is a member of the RIMS Technology Advisory Committee.

Copyright Risk Management Society Publishing, Inc. Oct 2002
Provided by ProQuest Information and Learning Company. All rights Reserved

A building-block approach for implementing COSO's enterprise risk management...

noreply@blogger.com (Prasetyo) — Tue, 26 Aug 2008 06:48:00 +0000

A building-block approach for implementing COSO's enterprise risk management—integrated framework: here is a way organizations of all sizes, cultures, and risk experiences can apply the framework without becoming overwhelmed by it

Brian Ballou

EXECUTIVE SUMMARY: As a result of the highly publicized business failures, scandals, and frauds over the past several years, senior managers must now comply with a series of laws, regulations, and listing standards calling for strengthened corporate governance and risk management. To help them comply, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) issued its framework for enterprise-wide risk management, Enterprise Risk Management--Integrated Framework, in September 2004. The goal of the framework is to enable organizations to standardize enterprise risk management (ERM) so that organizations can more easily benchmark, establish best practices, and have more meaningful dialogue about the critically important issue of risk management. One concern regarding the COSO ERM framework is that its overreaching nature can appear overwhelming for some organizations, particularly those that are small in size or have not previously established an ERM culture.

This article presents a building-block approach to implementing the COSO ERM framework that makes it usable to organizations regardless of their size or previous experience in risk management. Our building-block process enables organizations to evolve ERM as they establish a risk culture and offers better opportunities for efficient and effective allocation of resources for ERM activities.

**********

Managing risk is an important aspect of running an organization that is sometimes overlooked--despite the unprecedented level of business failures and financial reporting scandals over the past several years. The responsibility of overseeing risk management falls on the board of directors, while the ownership responsibility for enterprise risk management falls on the CEO and senior executives.

In Risk from the CEO and Board Perspective by Mary Pat McCarthy and Timothy Flynn, Hewlett-Packard board member Jay Keyworth states, "In my years at H-P and in talking to other board members from large Fortune 50 companies, I find that people thought that actually becoming familiar with the business itself and the details of the business, and particularly the half-dozen major areas of potential risk the company faces, was not really a board responsibility." (1) Keyworth has been on H-P's board for 19 years, served as chairman of the Progress and Freedom Foundation, worked as the Science Advisor to President Reagan, and dealt with risk and governance issues while serving on six other boards. His comment in the McCarthy and Flynn book suggests that boards might not have taken responsibility for risk management to the extent that stakeholders expect.

From directors on down to other people in the organization, the need for enterprise risk management is even more important than ever because of today's business environment. Organizations now face unprecedented challenges as they compete in an increasingly global, volatile, and regulated business environment. Further, meeting customer needs, managing complex supply chains, utilizing strategic alliance partners, and ensuring effective and efficient internal business process performance are increasingly more difficult, even with today's more sophisticated, real-time information systems. Added to these pressures are the threats to an organization's reputation. There is an ever-strengthening public perception that organizations are improperly, or not all, socially responsible. This perception is due in part to the public's belief that organizations are not doing enough to improve the communities and environments in which they operate. Further damaging organizations' reputations is the distrust from frauds and reporting restatements, especially from 1999 to 2004.

Taken together, the increasingly complex nature of business risks suggests that companies need to develop a formal process for managing their portfolio of risk properly. But, until recently, there has not been a standardized framework for approaching enterprise risk management (ERM) that organizations could use to establish benchmarks and best practices. To address this void, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) developed an enterprise risk management framework, Enterprise Risk Management--Integrated Framework, which was released in September 2004. COSO includes representatives from IMA (the Institute of Management Accountants), AICPA (American Institute of Certified Public Accountants), AAA (American Accounting Association), FEI (Financial Executives International), and IIA (the Institute of Internal Auditors); PricewaterhouseCoopers LLP was instrumental in researching and developing the framework. COSO's framework defines ERM as follows:


 Enterprise Risk Management is a process, effected by
 an entity's board of directors, management, and other
 personnel, applied in a strategy setting and across the
 enterprise, designed to identify potential events that may
 affect the entity, and manage risks to be within its risk
 appetite, to provide reasonable assurance regarding the
 achievement of entity objectives.

IMPLEMENTING THE FRAMEWORK

The COSO ERM framework can be intimidating upon first review. The report consists of two volumes: One presents the framework, and the other offers helpful guidance for implementing it. One of the drawbacks with introducing such a comprehensive framework is that it requires a significant investment of time and resources to fully implement within an organization. Further complicating this challenge is that effective ERM requires ownership by executives, careful oversight by directors, and a cultural shift at most organizations. That makes the initial implementation of the framework the biggest challenge before the process can reach its potential.

Our practical approach to implementing the framework should help organizations become comfortable using an entity-wide portfolio approach to risk management, including an allowance for the culture shift needed for an ERM framework to achieve its potential. This practical implementation, encompassing the entire framework, uses a building-block approach. The approach consists of: (1) implementing the ERM framework on a limited basis across each of the framework's eight interrelated components, shown in Figure 1, and (2) placing initial emphasis on entity-wide risks across all four risk categories--strategic, operations, reporting, and compliance--shown in Panel A of Figure 2. The ERM framework can be expanded, including an eventual cascading of the framework throughout other levels of the organization as senior management becomes comfortable with the culture the framework creates. Part of that cultural change requires that people throughout the organization take ownership of risk management.

There are several benefits associated with using a building-block approach to implementing the COSO ERM framework:

* Size Does Not Matter. All organizations can benefit from enterprise risk management to some degree, no matter what size they are. COSO argues that its ERM framework is applicable for small companies as well as mid-sized and large firms, as long as each component is present and functioning properly. Smaller organizations can benefit from having a structured, formal ERM process that can be expanded over time--to the extent that doing so makes sense for the organization. They, too, can use a formal building-block approach in which the framework is applied on a limited basis and only entity-wide risks are included during initial implementation.

* Culture Shifts Take Time. Shifting employees' attitudes about risk management to include monitoring, measuring, and controlling certain risks while sharing, avoiding, and accepting other risks will not occur effectively in a short period of time. Initially, many employees may view ERM as the latest corporate trend that distracts from running the business. As the framework evolves over time, however, employees are more likely to adopt the ERM philosophy when they see senior management and board members adopting it. As the risk management culture develops throughout the organization, each aspect of the ERM framework can be incorporated efficiently into day-to-day operations.

* Better Allocation of Resources. Implementing an effective ERM framework will consume significant resources. No organization has excess resources lying in wait for adopting a new framework for managing risk. But by first understanding entity-wide risks, executives and directors can determine the amount of resources they need to devote to each component of ERM. For example, certain business units can be identified as having more significant risk that can affect the organization overall, while other units that are more mature but excellent sources of cash flow might be identified as needing fewer resources for effective ERM.

There are also several pitfalls to avoid when using a building-block approach to ERM that can occur if an organization is not careful to emphasize the cultural shift. Two of the more important challenges are:

* Simplification of the Framework. Over time, the initial ERM framework becomes too simplified for effectively understanding entity-wide risks and making management decisions. Thus, organizations need to invest a sufficient amount of time and resources to implement an effective ERM framework culture and establish a foundation for managing risks not only at the entity level but at other levels of the organization as the framework evolves, as shown in Panel B of Figure 2. Sufficient time and resources should be invested in each component of COSO's framework to help avoid oversimplification.

* Skeptical Perceptions Associated with Implementing a Framework. When an organization opts to roll out new initiatives slowly, skeptics within the organization often will assume that there is an ulterior motive. For example, even if the initial rollout of an organization's ERM framework emphasizes ownership of risk management only within pockets of the organization, executives and directors should try to create a risk management culture across the entire organization. This will demonstrate their commitment to the ERM initiative to all employees and curb skepticism. Furthermore, if the organization only introduces a skeletal risk management framework, securities analysts might see it only as a signal that an organization is following trends to meet shareholder expectations. Thus, executives should ensure that a firm-wide risk management culture is developed, even though initial rollouts of the framework might not involve every aspect of the organization.

USING THE BUILDING-BLOCK APPROACH

Let's now look at how to implement an ERM framework using a building-block approach. This approach, as outlined in Figure 3, incorporates all steps of the COSO ERM framework so that risk owners and other employees within the organization can compare risk management initiatives with those of other organizations and have more meaningful discussions with people from those organizations. But if only parts of the framework are implemented during initial rollouts, these comparisons and discussions might be difficult.

Our building-block approach provides organizations with the time to gain comfort with utilizing a formal ERM framework such that executives, with oversight by directors, can make informed decisions on how best to develop a more intricate framework that cascades throughout the organization. In the last step, monitoring, we encourage organizations to continue to expand their ERM frameworks at a rate and in directions that make the most sense based on people's experiences with the framework.

Internal Environment

There are many components of an organization's internal environment described in COSO's framework that we believe ultimately should be emphasized as an organization develops its ERM framework, but only three elements are critical for laying the foundation for ERM: a risk management philosophy, culture, and organizational structure. Based on our three subcategories under "Create a Risk Management Culture" in Figure 3, many organizations might argue that they already have a risk culture. But the cultural items we note will serve to create a risk culture only if a risk management philosophy and organizational structure are also in place. We should note that the COSO report includes several other categories under internal environment, some of which we have reclassified under these three components.

There are two necessary conditions for an internal environment to facilitate an effective risk culture: (1) an awareness of the risk appetites of key stakeholders and (2) a philosophical commitment to align the organization's risk appetite embedded in its strategic objectives, strategies, and other initiatives with those of the key stakeholders. An emphasis on aligning risk appetites is not likely to occur unless the risk management organizational structure includes some level of responsibility of ERM for all C-level employees and directors. Although the authority and responsibility for ERM should lie with a risk committee of the board of directors and a chief risk officer, the remaining directors and executives should read reports and discuss the risk levels and their alignment with stakeholder risk appetites.

Objective Setting

An organization needs to specify its strategic objectives and the key strategies for achieving them. Defining its risk appetite and ensuring that it is aligned with the organization's objectives and strategies are also part of the objective-setting component. An organization's risk appetite should be aligned with stakeholders such as shareholders, key employees, and external entities involved in the supply chain, such as suppliers and customers. An organization should foster open and transparent dialogue with its shareholders because risk/return preferences should be agreed upon by all.

Event Identification

Identifying risk events that could impact an organization is an important step in developing an ERM framework. Because of the potential for forgetting risks, organizations need to carefully create risk categories and consider various ways that such risks can occur. The four risk categories in COSO's ERM framework are clearly universal to most organizations. In Figure 2, Panel A, we offer examples in parentheses of the types of risk that likely affect most organizations to varying degrees. Organizations should also consider risk interdependencies. In other words, are risk events isolated, are they part of a chain reaction, or do they result in ripple effects? We encourage organizations to utilize holistic, systems-type thinking to develop a deep understanding of the full impact of risk. This knowledge will be useful during the next phase of the framework, risk assessment. Also, organizations should consider the methodologies and techniques that might be used to assess and measure risk management to better understand the resources required to complete the ERM framework. Enterprise Risk Management--Integrated Framework provides examples of various methodologies and techniques.

Risk Assessment

The risk assessment stage is the place the "rubber meets the road" in an ERM framework. Here, organizations first estimate probabilities/frequencies and cost impacts of risk events. By first carefully considering the source of events and interdependencies with other risk events, organizations are in a better position to make these estimates. Also, estimates can be made utilizing various approaches. An estimated probability or cost can be used. Some organizations prefer to use relevant ranges. Others use various scenarios, such as best case or worst case. There is no right answer; rather, organizations should use an approach that is agreeable and most consistent with other components of the framework, such as risk appetite.

Figure 4 provides an example of various risks that a hypothetical "Company M" faces relative to its risk appetite. The general probability of each risk occurring is graphically plotted in Graph A. The diagonal line represents Company M's risk appetite--the points at which Company M would prefer its risks to lie.

Risk Response

Other than risk appetite, determining risk response is the most important decision that organizations make in developing an ERM framework. Because risk events by definition are uncertain, deciding whether to accept or avoid a risk-related activity can have significant consequences for an organization. By choosing to share a risk, an organization is committing to expend resources to purchase an insurance premium or enter into a strategic alliance. By choosing to reduce a risk, an organization is committing to implement control activities, which generally consume resources.

Organizations should also be careful to consider the impact of risk responses for a given risk on other risks. This relationship is commonly referred to as risk correlation, a challenging aspect of ERM. For example, the decision to implement a quality-control procedure to ensure end-product quality can lead to increased production cycle time, increasing the risk of late delivery to customers. An organization that chooses this risk response should, for example, ensure that there is sufficient cycle time remaining to perform the quality inspections or that the penalty for any late deliveries is less costly than the cost of delivering defective products.

The risk response choice results in alterations to inherent plotting of risks graphically. A decision to avoid a risk results in the removal of that risk from the plot because the underlying activity is no longer being performed, as shown in Graph B of Figure 4. For any risks that are accepted, the initial risk plot remains because no action is taken to reduce it. For any risks that are shared or reduced, the impact of the strategy serves to reduce the inherent risk. On a plot, an arrow can be used to represent a reduction in probability/ frequency (e.g., a horizontal arrow), cost impact (e.g., a vertical arrow), or both (e.g., a diagonal arrow). After considering the risk response, the remaining risk serves as the residual risk that an organization has decided is appropriate based on its risk appetite.

Control Activities

Organizations that decide to reduce risks need to identify control activities that can be used to effectively reduce risks or the costs associated with them. Note that control activities under the COSO ERM framework expand beyond what have traditionally been considered control activities under the notion of internal control. A control activity consists of any initiative or activity that reduces the probability/frequency of any risk or reduces the associated cost impact. What has been traditionally considered "internal control" is a subset of possible control activities and applies to those activities that specifically manage financial reporting risks.

The next aspect of control activities is determining the cost of risk reduction activities. In our example, Company M is determining all costs associated with its premiums for insurance or other risk-sharing contracts, agreements associated with its alliance, and implementation of control activities. Organizations, however, must be careful to consider that the impact of risk sharing and reduction activities is not likely to eliminate the risk in question. Rather, the activities likely reduce the probabilities/frequencies of risk (preventive), cost impacts (detective), or both (preventive and detective). An effective way to understand that residual risks remain is to adjust the risk plots with arrows representing the reduction of risk from the associated share or reduction activity. Thus, the adjusted risk costs for Company M consists of the costs of the premium, alliance, or control activity plus the residual probability/frequency multiplied by the residual cost impact, as depicted in Graph B of Figure 4.

Information and Communication

Even a building-block ERM framework needs effective information systems and communication channels. At a minimum, information systems should be able to track actual information to inform the organization about occurrences of actual events, including those avoided. For Company M, information systems should also track the actual costs of premiums, alliances, and control activities so that a comparison of the costs of actual risk events to the estimates of them can be performed as part of monitoring. Further, organizations need to ensure that timely reporting of ERM occurs at all levels of the organization that are actively involved in managing the framework, most notably the responsible party for ERM, such as the chief risk officer. In particular, the effectiveness of the ERM framework at managing risk events and the actual costs associated with the events should be reported. Perhaps most important, the responsible party should provide updates on ERM effectiveness and costs to senior executives and directors.

Monitoring

Monitoring is important for a building-block ERM approach because at this point the organization makes decisions about how to expand its ERM framework throughout the organization. By performing separate risk assessments comparing actual events and their associated costs to estimated risk probabilities and costs, the organization can refine its risk assessment and response decision-making process such that some degree of internal standardization can occur. Further, as executives and directors gain comfort with the ERM framework, a solid risk philosophy and culture can be developed that will enable more effective internal marketing of the benefits of the framework as it is expanded throughout other parts of the organization.

AUGMENTING THE ERM FRAMEWORK

Our building-block approach should help augment COSO's Enterprise Risk Management--Integrated Framework so that organizations of all sizes, cultures, and risk experiences can implement the framework successfully without becoming overwhelmed by its overreaching goal. Organizations can decide how to best evolve their framework, including the activities within each component and the extent to which the framework is applied throughout the organization. The key aspects to this building-block approach are to start by: (1) considering entity-wide risks, then cascading the framework throughout the organization over time, and (2) including all phases of the COSO framework but limiting those phases to the basic elements needed to construct a solid foundation that can be evolved over time. Accordingly, we encourage all C-level managers and directors to obtain and read a copy of COSO's full report so that an understanding of the endgame of the ERM framework can be established. With an effectively developed and carefully implemented ERM framework, most organizations should improve the probability of achieving their objectives.


Figure 1: Eight Interrelated
Components of Enterprise
Risk Management--Integrated
Framework


INTERNAL ENVIRONMENT
OBJECTIVE SETTING
EVENT IDENTIFICATION
RISK ASSESSMENT
RISK RESPONSE
CONTROL ACTIVITIES
INFORMATION AND COMMUNICATION
MONITORING


Figure 2: Categories of Risk and Organization of
Enterprise Risk Management *

Panel A: Four Categories and Corresponding Types of Risk

STRATEGIC

(Governance, Strategic Objectives, Business Model,
External Forces, etc.)

OPERATIONS

(Business Processes, Upstream Value Chain, Downstream
Value Chain, Financial, etc.)

REPORTING

(Information Technology, Financial, Internal, Intellectual
Property, Reputation, etc.)

COMPLIANCE

(Securities & Exchange Commission, Environmental, Legal,
Contractual, etc.)


Panel B: Organizational Levels of Enterprise Risk Management (ERM)

ENTITY-LEVEL
Fundamental to the Initial ERM Framework

DIVISION LEVEL
Expand ERM as Needed Over Time

BUSINESS UNIT LEVEL
Expand ERM as Needed Over Time

SUBSIDIARY LEVEL
Expand ERM as Needed Over Time

* Adapted from the Committee of Spnsoring Organizations
of the Treadway Commission (COSO), Enterprise Risk
Management--Integrated Framework, 2004.


Figure 3: Components of a Practical
Enterprise Risk Management Framework

The headings below come from the COSO framework, but the
descriptions under them are the authors' suggestions for a
practical, building-block approach to implementing the
COSO framework, Enterprise Risk Management--Integrated
Framework.


INTERNAL ENVIRONMENT

Develop a Risk Management Philosophy

* Take steps to understand the risk appetites of key
stakeholder groups of the organization.

* Take steps to align the risk appetites of all stakeholder
groups.

Create a Risk Management Culture

* Emphasize integrity and ethical values in every
endeavor.

* Emphasize the role of employee commitment and
capability by giving them incentives and measures.

* Design human resources policies and practices to
support a risk culture.

Design a Risk Management Organizational Structure

* Establish responsibility for all board members and
senior executives.

* Consider organizing a risk committee beyond the
audit committee.

* Assign authority and responsibility for risk management
to an executive such as a "chief risk officer."


OBJECTIVE SETTING

Establish Clear, Strategic Objectives and Strategies

* At entity-wide level.

* At other levels of the organization to the extent that
a direct, material impact on the entity is reasonably
likely.

Determine Entity-Wide Risk Appetite

* Align the risk appetites of key stakeholders with
those of the company's strategic objectives and
strategies and its alliance partners.


EVENT IDENTIFICATION

Identify Risk Events

* Consider factors influencing objectives and
strategies.

* Analyze each risk category (i.e., strategic, operational,
reporting, and compliance) carefully.

Consider Event Interdependencies (i.e., isolated, part of a
chain reaction, those that cause ripple effects)

Identify Measurement Issues Associated with Methodologies
or Techniques Utilized


RISK ASSESSMENT

Select Assessment Technique (e.g., point estimates,
probability/loss ranges, best/worst-case scenarios)

Assess Inherent Probability/Frequency of Risk Events

Assess Cost Impact of Risk Events (any losses per unit of
output multiplied by output until contained)

Consider Plotting Risks on a Graph


RISK RESPONSE

Identify and Select Response for Each Risk (accept risk,
avoid risk, share risk, or reduce risk)

Consider Effects of Risk Response on Other Risks
Adjust Risks Graphically Plotted During Risk Assessment

* Accepted risks (estimated risk cost is plotted).

* Avoided risks (remove plots from graph).

* Shared and reduced risks (alter plots based on
control activities).


CONTROL ACTIVITIES

Shared Risks

* Assess costs of premiums for insured risks.

* Assess forfeited returns and/or costs to manage
alliances.

Reduced Risks

* Identify control activities needed to reduce risk.

* Assess all costs associated with control activities.
Adjust Graphic Plots of Risks

* Determine the extent to which a shared risk activity,
such as insurance, an alliance, or a control activity,
reduces inherent probability/frequency estimates (preventative)
and/or cost impact estimates (detective).

* Estimate total risk costs, which are the sum of residual
risk costs and premium/alliance/control activity
costs.


INFORMATION AND COMMUNICATION

Ensure that Information Systems Can Measure and Report
Risk

* Actual risk event occurrences (including those associated
with avoided activities).

* Actual costs of shared risk activities such as insurance
premiums and control activities.

* Actual costs of risk events.
Communicate ERM Effectiveness and Costs

* Ensure proper periodic reporting of ERM within the
organization, particularly among people responsible
for managing and overseeing ERM.

* Chief risk officer or other responsible executive
should measure and document ERM effectiveness
and costs.

* Responsible party reports on ERM effectiveness and
costs to executives and board of directors.


MONITORING

Perform Separate Risk Evaluations

* Compare actual event occurrences with residual
probability/frequency estimates.

* Compare actual costs with risk sharing/reduction
and residual cost impact estimates.
Reevaluate Risk Assessments

* Incorporate any changes to risk appetite, objectives,
strategies, etc.

* Identify any events not previously identified.

* Add/revise estimates for probability/frequency,
share/reduce cost, and/or cost impact estimates.

Consider Areas to Expand ERM Framework Based on
COSO's Integrated Risk Management--Integrated
Framework


Figure 4: Risk Appetite, Assessment, and Response for
"Company M"


PART A: RISK APPETITE ASSESSMENT

"Company M," a mature organization, is controlled by several
large retirement funds. The company's board of directors
and executives assess its risk appetite at a low enough
level such that reasonable rates of return and fairly steady
income streams result over time. Further, the organization
has a long-established brand name for quality and durability
of its products, dominates market share for its industry,
and operates in an industry with high entry costs. Accordingly,
the company sets its risk appetite such that its risk
preferences mainly are low-probability events with low to
moderate cost impacts. The line drawn diagonally through
Graph A and Graph B represents the organization's risk
appetite, and the organization will choose to manage risks
so that they are as close to the risk appetite line as possible.

[GRAPHICS OMITTED]


PART B: RISK ASSESSMENTS

Assume that the organization identifies its five most important
entity-wide risks.

Risk 1. The market share loss from a new entrant, which
the organization has assessed as significantly
below its risk appetite.

Risk 2. A reduction in product quality associated with the
replacement of its aging workforce, which is heavily
unionized.

Risk 3. Government approval of a new product line being
considered that includes use of a chemical that the

U.S. Environmental Protection Agency (EPA) has
targeted for investigation based on its potential for
contaminating the atmosphere.

Risk 4. Rising supply-chain costs associated with the distribution
of finished products from the organization's
plants to authorized dealers and distributors.

Risk 5. The cost associated with worker injuries from the
dangerous nature of the production process of the
organization's products. The organization has self-insured
in the past, but costs and liability exposures
have been rapidly increasing over the past
several years.

Graph A illustrates how these risks within the ERM framework
might be graphically plotted.


PART C: RISK RESPONSES

Assume that the organization wants to manage its risks
close to its risk appetite. The organization in this example
could choose a different response for each risk.

Risk 1. There is no need to consume resources to manage
the risk further, so Company M accepts the marketshare
risk.

Risk 2. Company M chooses to reduce the probability and
cost impact by investing in the human
resource business process such that a favorable
union contract and training programs
can be implemented to attract quality
employees who will continue the tradition of
quality.

Risk 3. Company M chooses to avoid it by opting
not to pursue the new product line until the
EPA resolves the issues surrounding the controversial
chemical.

Risk 4. Company M forms an alliance with a distribution
company that has a core competency
in distribution that can help reduce the probability
and cost impacts of distribution risks.

Risk 5. Because the probability of work-related incidents
has proven to be difficult to reduce,
Company M purchases worker compensation
insurance to reduce the cost impacts associated
with the risks.

Responses to Risks 3, 4, and 5 involve significant
costs associated with the control activity in Risk 3,
alliance in Risk 4, and policy premium in Risk 5. The
key to these decisions is that the risk response costs
plus remaining residual risk costs should be less
than the risk costs if the risks are accepted. The
adjusted plots in Graph B illustrate how the risk
responses impact the inherent risk assessments.

Brian Ballou, Ph.D., CPA, is an associate professor of accounting at Miami University in Oxford, Ohio. His teaching and research emphasis is on enterprise risk management, risk-based assurance, and performance measurement. You can reach him at (513) 529-6213 or balloubj@muohio.edu.

Dan L. Heitger, Ph.D., is an assistant professor of accounting at Miami University. His teaching and research emphasis is on new product development, activity cost estimations, incentive systems, and performance measurement. You can reach him at (513) 529-6208 or heitgedl@muohio.edu.

(1) Mary Pat McCarthy and Timothy P. Flynn, Risk From the CEO and Board Perspective, McGraw-Hill, New York, N.Y., 2004, pp. 152-153.

Insurance execs need better enterprise risk management

noreply@blogger.com (Prasetyo) — Tue, 26 Aug 2008 05:45:00 +0000

Insurance execs need better enterprise risk management

Insurance industry executives say their companies could be doing a better job of assessing enterprise-wide risk, especially operational risk.

That's one of the findings from a recent Tillinghast-Towers Perrin survey on enterprise risk management, which reveals that while almost all insurance industry executives believe a program to assess, mitigate and transfer enterprise-wide risk can help their companies, they are not satisfied with their current risk management tools, techniques and processes.

"Respondent do not think their companies are doing a good job of prioritizing risks from disparate sources or optimizing business and risk management strategies in light of risk/return requirements," says Jerry Miccolis, the principal of TillinghastTowers Perrin who conducted the survey "Additionally, executives are dissatisfied with their ability to accurately model risk impact on financial results. They do not believe a coherent framework exists to guide risk and capital management activities and clearly feel they need one."

Operational risk was an area in which survey respondents noted particular concerns. "High dissatisfaction levels were expressed with regard to such operational risk sources as people/intellectual capital, distribution channels, technology and catastrophes," Miccolis says.

"Dissatisfaction also was expressed with their ability to measure or stochastically model operational risk for inclusion in capital determination," he adds.

Enterprise risk management, or ERM, focuses on improving capital efficiency, supporting strategic decision-making and building investor confidence.

"ERM can improve capital efficiency by providing an objective basis for allocating resources, reducing expenditures on immaterial risks and exploiting natural hedges," says Miccolis. "It supports strategic decision-making by uncovering areas of high potential adverse impact on the drivers of enterprise value, and identifying and exploiting three areas of risk-based advantage. The process demonstrates proactive risk stewardship."

According to the survey, the top three business issues for respondents was earnings growth, revenue growth and return on capital. Survey participants also noted that ERM would be a valuable tool in helping companies achieve those business objectives.

Survey respondents accorded technology the highest importance among 16 risk sources-a 4.27 weighted average ranking on a five-point scale. Interest rate risk (4.08) was second highest, followed by distribution channels (4.03). Respondents were least concerned about currency capital market and catastrophe risks.

Copyright America's Community Bankers May 2000
Provided by ProQuest Information and Learning Company. All rights Reserved

Risk managers cover enterprise exposure

noreply@blogger.com (Prasetyo) — Tue, 26 Aug 2008 05:38:00 +0000

Risk managers cover enterprise exposure

Green, Paula

INSURANCE

ENTERPRISE RISK

Enterprise risk management is the latest tool corporate executives are using to help their companies ride out the financial losses on everything from economic recessions to droughts.

No longer a single manager sitting in a back office buying fire insurance for the factory and casualty coverage for accidents, the business of corporate risk management has evolved into a sophisticated assessment of companywide risks known as enterprise risk management. Analysts say the concept is luring more and more top managers intent on boosting shareholder value and satisfying their corporate boards and financial regulators.

"It [enterprise risk] is an overall plan that identifies a company's risks and then decides which ones a company should focus on," says Carl Groth, senior vice president and director of alternative risk transfer at Willis, an insurance brokerage and risk management consulting firm headquartered in London. "The concept is in its infancy but rapidly developing because it promises a new way to manage risk. It's also a new way of thinking and behaving. Most businesses can benefit."

In the old world of risk management, a company managed its risks separately. Traditional property and casualty risks were managed by the insurance manager in one department, while financial risks, such as fluctuations in foreign exchange and interest rates, were handled by the treasury officers. The attorneys handled lawsuits, and various business units handled their own risks, such as managing inventory. The goal of the various managers was to minimize risk.

"In the new world, risk is neither good nor bad.... You look at all risks like a portfolio from a central point. ... It opens up new possibilities," says Randy Nornes, a managing director at Aon Risk Services, part of the Aon Corporation. "In the old way, you had 10 departments looking at risk.At best, it was inefficient. At worst, it was like having 10 investment departments not talking to each other and then you find out they're all invested in oil stocks. By looking at one overall risk portfolio, you have a common language and better decision-making."

While some large corporations might do the work themselves, many are teaming up with an assortment of consulting firms that have created special enterprise risk management units.

After the risks are identified and assigned a priority, a plan for handling them is developed. The best risk management solution might be a single, integrated insurance policy to cover everything or a traditional insurance policy mixed with transactions placed in the capital markets, or perhaps no insurance at all for some risks.

"You can choose to have 60 days of inventory to minimize your risk, but that costs a lot of money" says Nornes, who works out of Aon's Chicago office. "And if you choose to have only six days of inventory, that's more risk but less capital tied up in inventory. You start to look at risk management as capital management."

Adds Ken Zignorski, managing director at MMC Enterprise Risk, an operating entity of Marsh & McLennan in New York City: "You want to optimize your risk. Risk can be good.You want to use risk creatively"

For United Grain Growers in Winnipeg, Canada, the answer, after an intense companywide review that began in 1997, was an integrated insurance program that covered all the company's risks-including drought.

While not a producer of grains, United Grain Growers culls 50% of its annual revenue from the volume of grain that passes through its system, says Mike McAndless, the company's corporate risk manager. The company, which now calls itself UGG, acts as a grain intermediary-buys grain from Canadian farmers and sells it to industrial users around the world. Less grain harvested means less grain flowing through its system.

Since demutualizing in 1993 and becoming a publicly traded company, UGG has taken the corporate governance guidelines of the Canadian regulatory agencieswhich require corporations to have a program in place to identify and manage risks-quite seriously, McAndless says.

"We decided we wanted to look at risk management in a broader way. So we ended up piling 20 people from all areas of the company from all over the country into a room and had a risk management love-in," McAndless says. "People from operations, insurance, treasury, audit-everywhere.We sat down and came up with a laundry list of 47 major risks. And at the top of it was the weather, which is another way of spelling drought. In a tight-margin business with high volatility in a fixed-cost environment, we thought we had to do something about it," he adds.

With analytical models and the data on grain production already maintained for decades by the Canadian government,Willis was able to analyze the financial risk that a drought created for UGG. Those numbers were enough to satisfy underwriters at Swiss Re, which underwrote an integrated insurance program for UGG that covered all its insurance needs-including losses stemming from weather-related risks.

Groth, who works in Willis's New York City office, says the program includes three basic pieces.The first layer of loss is retained by the company. A second layer of risk transfer covers losses above the two risk retention levels, one for losses stemming from low grain-handling volumes and the other level for other perils.A third layer of coverage is for catastrophic exposures, such as the destruction of one of the company's large grain storage silos.

The policy includes a predefined grain-handling threshold, or so-called strike price. If the company's total grain-handling volume falls below the strike price, the loss threshold is triggered, and the company is compensated dollar for dollar once its risk retention level is exceeded.

"The policy responds like a traditional insurance policy" Groth says. "This hadn't been done before. But it was possible because there was such a rigorous analysis of the risk"

McAndless says the company won't realize the true value of the policy, which became effective in December 1999, until the first drought hits. But it expects to benefit as it experiences less downside volatility in its revenues. "There's a drought every so many years, and up to now, we've been taking that right on the head," he adds. "Now we think we're lowering our average cost of risk going into the future!

Analysts say there are several factors bolstering the popularity of enterprise risk management among corporate executives in recent years, and a prime motivator is increased scrutiny by shareholders and corporate boards as well as government regulatory agencies. Another factor behind enterprise risk management's popularity is the technological advances of computer software and the growing sophistication of statistical and economic analytical models that can measure risks more precisely.

"There are now analytical models that can analyze the behavior of risk and the impact of risk," says Groth, adding that these models have been developed by the financial community over the past decade to manage interest rate, foreign exchange, and commodities risks for banks and other financial institutions.

A third factor is the breakdown in the regulatory barriers that formerly separated the insurance and capital markets for decades.

"There's a convergence of the capital markets and the insurance markets," says John Rathgeber, chief underwriting officer at St Paul Re, the reinsurance operation of the St Paul Companies in Saint Paul, Minnesota. "Now there's a layoff of insurance risk into the capital markets and a layoff of credit risk into the insurance markets.The concept makes sense. Risk is risk:'

Zignorski says that while many of his clients are in the Fortune 1000 range, MMC Enterprise Risk has helped smaller companies with $100-150 million in annual sales.

"Any organization should be looking at enterprise risk management for significant risks that impact its business.The scale of each company is different, so it makes it difficult to say what the cost of a study is, but a significant data-gathering and risk investigation would be on the six-figure side of the equation," Zignorski says.

Nornes says Aon has done some basic surveys for less than $100,000 that take 60 to 90 days, while more detailed studies can cost $200,000-250,000 and take a year to complete.

Paula Green is a New York-based contributor to Global Finance. E-mail: p/green I @msn.com

Internal Controls and Managing Enterprise-Wide Risks

noreply@blogger.com (Prasetyo) — Mon, 25 Aug 2008 10:25:00 +0000

Internal Controls and Managing Enterprise-Wide Risks

Farrell, John

In addition to complying with the sweeping reforms in corporate governance and financial reporting following the Sarbanes-Oxley Act, companies can benefit further by adopting a broader view that encompasses an enterprise-wide risk-management outlook. This approach is especially applicable to section 404 of the Sarbanes-Oxley Act, which deals with management's assertion regarding the effectiveness of its internal controls over financial reporting. As companies work to comply with these new rules, they can build their section 404 work into an opportunity to address other aspects of risk throughout the organization, including financial, legal, and operational.

The emerging trend of evaluating and monitoring the range of business risks-including those assessed in an internal control review-may help companies simultaneously meet strategic goals, boost shareholder and stakeholder value, and focus on good governance.

Self-Assessment

Fulfilling the mandates of section 404 need not be an obstacle to implementing an enterprise risk-management effort. Instead, the compliance process can enable companies to focus on enterprise-wide risks through a distributed evaluation-that is, a self-assessment of risk and control. This evaluation assigns responsibility for the assessment to those who are "closest to the action"-in other words, those most directly involved in the control over each process. Such an approach can help companies achieve a better-balanced risk and control status.

Conventional wisdom formerly held that responsibility for internal controls was delegated to an organization's financial group. According to current thinking, however, internal controls are owned by those within the business who manage daily operations and who depend on the controls for achieving their goals. These control process owners are well prepared to perform the distributed evaluation of identifying, evaluating, and managing pertinent risks to assist the business in achieving its financial goals. The Sarbanes-Oxley rules reinforce the value of such risk-based evaluations.

If a company looks ahead one year, how can it measure success beyond mere compliance with regulatory requirements? For multinational companies, one sign of success would be a worldwide standardization of internal controls that allows the organization to orient itself toward a widely accepted set of control criteria, such as the Committee of Sponsoring Organizations of the Treadway Commission (COSO) internal control framework or the COSO enterprise riskmanagement (ERM) framework issued in 2003. Coining a "controls language" shared throughout the organization can help a company take greatest advantage of its set of controls-deciding which key controls to keep and which it can discard because they do not add value or are otherwise unnecessary.

Process Improvement

In addition, companies may use the section 404 assertion rules to help them achieve a company-wide transformation of business processes. The internal-control assessment may produce several improvements:

* Greater use of automated, or system-based, controls;

* Better evaluation of process risks and mitigation of risk;

* More uniform controls throughout the organization; and

* Greater responsibility for controls assessment for the process owners.

The compliance procedures can also be used to weed out nonessential tasks and determine good practices within each business process:

* Comparing controls between different business units, or within a company's operations in different countries;

* Cutting the risk of error by using a more technology-based method of control rather than manual processes;

* Using key performance indicators to gauge the effectiveness of a process across a span of risks and time periods; and

* Getting feedback from control procedures on a worldwide basis, which can lead to better reporting capabilities.

In examining their sets of controls, companies may find it valuable and costeffective to consider an automated system rather than a manual review. The internal control assessment, performed through an automated self-assessment, is more than a simple questionnaire. It can gather information from control owners about the status of key controls. The assessment is based not on the frequency of the assertion but on the type of control-automated or manual-and how vulnerable to risk the controls may be.

Using an automated system for internal control assessment offers several other advantages. It consolidates internal control information and status, as well as being a repository of all organizational risks and controls. The repository is useful not only for section 404 reporting responsibilities but also for any ERM initiatives.

Role of the Internal Auditor

The internal auditor can play a vital role in linking internal control reporting with ERM. The internal auditor can foster an environment that allows the company to link the efficiencies of an ERM approach to the overall business aims of the organization.

In addition to articulating the linkage of internal control reporting with ERM to senior management, the internal auditor can perform a number of other important functions:

* Helping control process owners gain a better understanding of internal control assessment and testing.

* Becoming a purveyor of best practices within the organization. For example, if the internal auditor discovers that a particular business segment has adopted a more efficient approach to internal control reporting, she can share that knowledge with other business segments.

* Generally enhancing the organization's understanding of internal controls by imparting subject-matter knowledge in this area.

* Monitoring the organization's internal controls through testing and feedback on its control status.

Focus on Governance

While the distributed evaluation, or risk assessment, is properly assigned to the operations people with direct experience in their respective areas, the overall risks that an organization faces continue to be a corporate-governance priority for the board of directors and management. To help them better understand those risks, corporate leaders should consider the following questions:

* What types of analyses is the organization doing to identify risks?

* What is the organization doing to assess those risks and find the best way to take advantage of or mitigate them?

In response to the mandates and recommendations of Sarbanes-Oxley, senior management may consider several other measures to enhance corporate accountability:

* Assessing self-knowledge and knowledge of others in the organization.

* Ensuring that a uniform process exists and is followed by other members of the organization that provides internal certification.

* Assessing the impact of changes in the business that may have an effect on internal controls; for example, acquisitions or divestitures, and new accounting or SEC rules.

* Obtaining formal internal management representation letters, on a quarterly basis, from internal accounting personnel for domestic and foreign subsidiaries.

* Holding monthly or quarterly conference calls with accounting staff (including worldwide operations) to review new accounting pronouncements and other items that facilitate the closing process.

* Initiating a formal regular meeting with key process owners or segment leaders (including sales, purchasing, human resources, and legal) to discuss activities that may influence accounting and disclosure.

* Harmonizing these measures with any ERM initiatives.

Applying an ERM approach to the internal-control assessment process has costs. It may be more costly, however, not to seize the opportunity to implement this approach. The investment would include:

* Establishing a risk framework and common risk vocabulary;

* Establishing and maintaining a chief risk officer or risk committee;

* Continued measuring and monitoring; and

* Periodic updating of the risk assessment framework.

For many companies, a phased-in approach is the most practical way to deal with the cost issue. Initially, a company evaluates only the risks and controls over financial reporting, but it designs the evaluation tools and techniques so they can support ERM. Once the evaluations required by Sarbanes-Oxley are complete, the company can expand the assessment into the operational and strategic realms, until a complete ERM system is in place.

John Farrell, CPA, is a partner in the internal audit services practice of KPMG LLP, and is based in New York City. He can be reached at 212-872-3047 or at johnmichaelfarrell@kpmg.com.

Copyright New York State Society of Certified Public Accountants Aug 2004
Provided by ProQuest Information and Learning Company. All rights Reserved

A sustainable approach to ERM: as best practices begin...

noreply@blogger.com (Prasetyo) — Mon, 25 Aug 2008 10:18:00 +0000

A sustainable approach to ERM: as best practices begin to emerge, one company uses a phased plan to create a fully functioning, integrated enterprise risk management system

Arnold Schanfield

ON SEPT. 29, 2004, THE Committee of Sponsoring Organizations of the Treadway Commission (COSO) issued its long-awaited Enterprise Risk Management--Integrated Framework. Best practices have begun to emerge from some of the framework's early adopters.

At Weiser LLP, a professional accounting and consulting services provider, the overall objective is to help clients "institutionalize" the enterprise risk management (ERM) process within their organization so that the process can be self-sustaining. This provides companies with the ability to identify, assess, measure, monitor, and report on their business risks; determine the degree to which these risks are being mitigated in accordance with established risk tolerances; and respond appropriately to the various risks. In developing its methodology, Weiser took a phased approach to COSO's ERM framework by capturing the essence of its eight components--internal environment, objective setting, event identification, risk assessment, risk response, control activities, information and communication, and monitoring--and rolling it up into five distinct phases.

1. UNDERSTAND THE BUSINESS MODEL

In the first phase, the project team undertaking implementation of ERM (e.g., the risk management group, the heads of business planning/strategy and internal auditing, the treasurer, and outside consultants) obtains a comprehensive understanding of the organization, focusing on overall strategy, vision, mission, objective setting, risk appetite, risk tolerances, and the interrelationships therein. It is critical that the team clearly understand what the company does, how it buys, from whom it buys, how it sells, where it manufactures, etc. Objective setting and company background in conjunction with an understanding of the internal environment--tone at the top, board of directors, integrity and ethical values, human resource policies and procedures--provides perspective on the business so that the risk identification process can begin. In this phase:

* The internal environment is identical to the control environment section in the COSO internal controls framework with some add-ons. Specifically, key information needs to be gathered related to risk management philosophy, risk culture, board of directors, integrity/ethical values, commitment to competence, management's philosophy/operating style, risk appetite, organizational structure, assignment of authority/responsibility, and human resource policies/procedures.

* Objective setting includes the strategic and business objectives, risk appetite, risk tolerance, and the relationship of each of these to the company's overall vision and mission.

* Company background information usually is obtained through review of off-the-shelf material (e.g., business plans and U.S. Securities and Exchange Commission filings), but may also include interviews with key constituents.

2. IDENTIFY, ASSESS, PRIORITIZE, LINK, AND REPORT RISKS

In the second phase, the project team must determine how and from whom the risk information is to be gathered. There are many different options available, including one-on-one interviewing, facilitated sessions with key personnel, and dissemination of a risk universe questionnaire. Whatever the means, it is critical to gather the risk information and link the risks to the strategic objectives and the key business processes. Finally, the team must assess the risks for impact and likelihood so that they can be prioritized and communicated, enabling appropriate action to be taken. Key points in this phase include:

* Identifying risk participants in the risk assessment process, including a risk champion, key business process owners, senior and executive management, and key governance personnel.

* Evaluating options for gathering information, including questionnaires, surveys, one-on-one interviewing, or facilitated control self-assessment.

* Creating the risk universe--logical groupings of high-level risks (usually about 40 to 50). Start with a blank piece of paper. Use existing risk models, research the Internet for insurable risks, research professional and industry associations, brainstorm, and understand industry indicators.

* Defining risk universe terms for each of the logical groupings. For example, brand equity risk is defined as "failure to establish and maintain brand awareness, positioning, and strength. This may impair the company's ability to execute strategic growth objectives."

* Linking risk universe to strategic objectives. Cross-reference the risks (e.g., brand equity risk) to the various strategic objectives they could impact (i.e., unmitigated brand equity risk would impact accomplishment of the strategic objective related to maintaining the company's reputation).

* Understanding the risk characteristics of the risk universe. Is the risk a core risk, a driver, an indirect driver, or an external risk? Core risks may be direct strategic barriers. Their occurrence will result in inability to achieve key strategic objectives. They are internal to the company and are at the center of strategic success. Direct drivers are those that, if they occur, will likely result in a core risk occurring. Indirect drivers could cause occurrence of a direct driver but are unlikely to generate occurrence of the core risk. External risks are parts of the organization's business strategy that happen externally.

* Rolling up drivers, indirect drivers, and external risk into core risks across the businesses and processes. For example, product failure risk could be an indirect driver to brand equity risk, which could be a direct driver to loss of investor confidence, which is a core risk.

* Plotting risk characteristics of the risk universe against strategic objectives--an expansion of the "linking risk universe to strategic objectives" step. Prepare a chart that uses the descriptive characteristics of core (c), direct (d), indirect (i), and external (e) to cross-reference each risk to strategic objectives.

* Assessing significance of risks to accomplishment of objectives. Create scales to assess the impact/magnitude should the risk occur. There are several qualitative and quantitative techniques to assess significance. Ordinal measurement, which qualitatively assigns numbers corresponding to a specific situation, is most commonly used. For example, on a scale of one to nine, with nine being highly significant and one being not significant, nine indicates that the strategic objectives cannot be achieved, resulting in significant financial impact and questions about the company's future viability.

* Assessing likelihood of risk to accomplishment of objectives. Create scales to assess the probability of occurrence, either assuming no controls are in place (inherent risk) or considering controls known to be in place (residual risk). For example, on the same scale with nine being "definitely will occur" and one being "cannot occur," three would represent "unlikely to occur," meaning that the risk is not likely to occur in the specified time period (less than 25 percent probability).

* Assessing risk tolerance of each risk. Determine how much risk management has agreed to assume. This will impact the nature of the risk strategy response.

* Summarizing all risks. Multiply significance and likelihood of each risk to determine a risk score, rank the risks, and report to management with an analysis.

* Articulating risks on a visual display. Develop graphs and heat maps to compare the relative risk scores. These can be color-coded by red, yellow, and green, consistent with the urgency of management attention needed.

* Linking risks to business processes. Align the risks to the relative business processes so that the risk process owners can be identified and the process for monitoring risks can begin (i.e., brand equity risk is linked to quality assurance, distribution/warranty and repairs, and research).

3. DETERMINE THE APPROPRIATE RISK RESPONSES

There are choices to be made as to how risks will be addressed, and those choices have consequences (cost versus benefits). Management needs to determine how these risks should be mitigated. There are qualitative and quantitative considerations in determining how to mitigate risks. For example, under the following conditions, it is best to avoid the risk by eliminating the activity:

* A risk is significant to the overall company risk tolerances.

* The activity is not viewed as being core to the company's mission.

* Management believes that the risk will be difficult to manage.

Certain risk responses are obvious. For example, if data security is being compromised because passwords have not been changed, the response is to change the passwords. However, other risk responses are not so straightforward. For example, if a business ships contaminated waste, with minimal mitigation in place, what action is appropriate? Should it insure the freight at perhaps a significant cost? Should it stop the activity? Should it outsource the activity? Should it train its personnel in handling procedures? The most important goal is to achieve the necessary mitigation so that the resulting residual risk is aligned with the company's overall objectives.

Avoid, share, reduce, accept, and exploit are the various options available for management to consider in implementing risk responses (also known as risk mitigation strategies). There are qualitative and quantitative (cost versus benefit) considerations. It also may be necessary to use experts to expedite the process and ensure all issues are reviewed (e.g., actuaries or environmental experts).

4. DETERMINE CAPABILITIES TO MANAGE RISK AND IMPLEMENT RISK RESPONSES

The project team must evaluate the organization's capabilities and infrastructure to address the risks, implement risk responses, and remediate gaps. If an adequate infrastructure--strategies, processes, people, technology, and information--is not in place, the team needs to work with senior management to build the organization's capabilities. Each of these five areas must be evaluated as to how well they are being managed versus how well they need to be managed. Key points of this phase include:

* Determining current state of risk capabilities for strategies, processes, people, technology, and information--rate each of these areas from "poor" to "excellent."

* Determining management expectations of risk capabilities.

* Identifying gaps.

* Building additional capabilities/infrastructure, if necessary.

* Remediating gaps.

* Implementing corrective action/risk responses to the identified risks.

5. IMPLEMENT RISK MONITORING AND INTERNAL AUDIT PROGRAMS

Implementing an effective risk monitoring process involves several components, including internal audit projects, external auditing, and ongoing internal monitoring of key performance indicators. It is important to remember that internal audit projects are driven by the identified risks and the required level of assurance that the board/management would like to have in place. The ongoing risk monitoring needs to be instilled in the organization. Key performance metrics need to be built into the monitoring of the organization and triggered at the appropriate time for management follow-up. Key activities included in this phase include:

* Developing the necessary internal audit programs.

* Executing the programs.

* Identifying key performance indicators and implementing self-monitoring mechanisms.

* Implementing monitoring mechanisms (e.g., dashboard mechanisms).

FULLY FUNCTIONING ERM

Implementing a fully functioning, integrated ERM system can provide significant value to a company. The primary benefit is ensuring that business objectives can be accomplished and shareholder value can be maximized. Many lessons have been learned over the past few years by companies that have implemented such systems. Some best practices include using a risk champion to lead the project, using a common business language throughout the process, and "biting off" small manageable chunks to demonstrate specific measurable accomplishments at each step of the process. Enterprise risk management is an ongoing journey.

To comment on this article, e-mail the authors at aschanfield@theiia.org.

ARNOLD SCHANFIELD, CIA, CPA, CA, CFE, and MICHAEL MILLER, CISA, CRP, are directors of Internal Audit and Risk Management Services at Weiser LLP in Edison, N.J.

EDITED BY JAMES ROTH AND DONALD ESPERSEN

To share emerging risk issues and best practices from your own audit experiences, or to request coverage of a particular risk, e-mail jamesroth@audittrends.com.

Outlook on growth risks: auditors can help management assess...

noreply@blogger.com (Prasetyo) — Mon, 25 Aug 2008 10:09:00 +0000

Outlook on growth risks: auditors can help management assess the opportunities and problems the organization may encounter as it expands its business

Uday Gulvadi

WHILE ALL ORGANIZATIONS AIM TO grow, the path to achieving growth is anything but straightforward. Growth can be achieved through new products and services, geographic markets, customer segments, distribution channels, and lines of business as well as mergers and acquisitions. Each of these growth drivers represents different risks and opportunities for the business. The key to achieving sustainable growth lies in optimizing opportunities while balancing and containing the commensurate risks.

Growth risk management is a subset of enterprise risk management (ERM) that warrants senior management attention for organizations that are seeking aggressive growth. Although the chief executive officer (CEO) and senior management are responsible for managing growth risks, chief audit executives (CAEs) can enhance the quality of the process by facilitating the inclusion of growth risk management considerations in the organization's overall strategic planning process, providing an objective assessment of the related controls and monitoring processes, and recommending measures to enhance the design and effectiveness of controls.

Whatever growth strategies an organization relies on, three components are important to increase its chances of success: understanding market needs; crafting a challenging, yet achievable, growth strategy; and ensuring the organization is ready to execute the growth plan. CAEs can help CEOs focus on the key risks in each component by centering the discussion on the most fundamental issues and raising appropriate questions.

DOES MANAGEMENT POSSESS A SOLID UNDERSTANDING OF THE MARKET'S DEMANDS? Auditors can answer this question by analyzing how thoroughly market risks have been considered in management's growth plan. Inadequate knowledge of market conditions or customer preferences is a key growth risk. Many organizations have seen their growth strategies go awry because they misevaluated market potential. Analyzing competitor strengths and weaknesses and understanding market entry barriers are also part of a go-to-market strategy. In addition, the perceived poor quality of an organization's existing products can become an obstacle to the acceptance of new products. Lastly, management must consider its pricing strategy--whether to offer new products and services at premium prices or at competitive rates.

IS THE GROWTH PLAN CHALLENGING, YET ACHIEVABLE? Growth strategies need to inspire people to achieve organizational goals. People are often motivated when they lead and participate in ventures such as launching products and entering new markets, but this enthusiasm can turn into cynicism and declining morale if the growth targets are overly optimistic and not achievable. The growth strategy needs to be well thought out and based on a solid understanding of market requirements, prudent assumptions, and reasonable expectations to avoid these pitfalls and discourage unethical practices to make the numbers. Moreover, the strategy must be articulated and communicated throughout the organization to ensure understanding and consistent performance.

Sometimes an organization's weaknesses lie in the way in which financial projections are developed and plans and budgets are negotiated internally. These risks are particularly applicable when organizations have multiple business units that are managed as separate silos. Budgetary considerations that are impacted by internal politics can lead to turf wars and unrealistic budgets that are not in the organization's best interests.

Organizations also should consider suitable means of financing their growth initiatives. Internal funding can adversely affect an organization's cash flow and may not be viable for companies that need to make large capital investments that cannot be generated in-house. External sources of funding can introduce the risk of needing to manage to external stakeholders' expectations of earnings growth and returns.

IS THE COMPANY ORGANIZED TO ACHIEVE AND SUSTAIN GROWTH? A rapid growth strategy often necessitates the addition of employees at a rate that outpaces the capacity of the organization's training resources. This fast buildup can leave the organization with poorly trained staff who are not well versed in its policies, procedures, ethical values, products, and customers, thereby undermining the execution of growth plans. Companies also respond to growth by making internal organizational and process-level changes that move employees out of their comfort zones, such as creating new business units, product lines, and quality control procedures, or dismantling functional silos.

Creation of a technology infrastructure that is scalable to the needs of the growing business presents risks in terms of security and integration with existing systems. Organizations that plan to enhance e-business capabilities are essentially providing a gateway for customers and suppliers to log into their systems to place or collect orders and check delivery status, which exposes the organization to security risks that could compromise sensitive information. Additionally, technologies such as customer relationship management or enterprise resource planning software require careful planning to ensure they are seamlessly integrated with existing applications and infrastructure.

Growth can also have an impact on organizational hierarchy and decision-making. High-growth companies that are entering new markets or tapping new customer segments will need to be more agile compared to stable, low-growth businesses that sell their existing products to an established customer base. Being agile often requires decentralized decision-making and empowered frontline staff who can respond quickly to changing customer needs. However, this flexibility must be balanced with the risk of diluting controls in the absence of a structured review and approval process.

CONTROL CONSIDERATIONS

As the business risk landscape evolves, internal audit groups should evaluate the risks and challenges that growth creates. Some of the control and monitoring practices implemented by management that auditors should review include:

UNDERSTANDING MARKET DEMANDS Internal auditors should assess the quality of the market research studies conducted and relied upon by management and the credibility of the research agencies, their methods, and the reasonableness of their conclusions. Auditors can discuss with management whether proposed marketing actions are aligned with the market research conclusions. Also, they can look for evidence of dialogue with existing customers about the company's product and service quality and test marketing of new products to focus groups. Auditors should ensure appropriate changes have been made based on consumer feedback.

GROWTH PLANNING Auditors should assess whether a clearly articulated growth strategy has been created by management after thorough deliberations of all factors, including assumptions, key risks, and potential mitigating measures. They also should assess whether input was received from other managers who have a stake in the growth strategy so that there is buy-in at all levels of the organization.

Growth planning should consider various financing alternatives before selection of a suitable funding plan. Auditors should evaluate whether board approval was sought after members had held assiduous discussions and had questioned management's assumptions. They should also determine whether alternative plans have been considered. Additionally, auditors need to review the adequacy and quality of communications to employees about specific goals and targets and the roles they are expected to play. Finally, auditors should evaluate the establishment of periodic monitoring reviews by management to assess the achievement of milestones and make course corrections.

ORGANIZING FOR GROWTH It is essential for auditors to assess the organizational structure and its appropriateness to facilitate the achievement of growth objectives. Auditors should review the establishment of a secure and scalable technology infrastructure. They should determine whether there are procedures in place to scale up resources and staffing and provide adequate training. There should also be procedures to ensure product quality. Moreover, mechanisms are needed for handling customer inquiries, post-sales servicing, and complaint resolution. Auditors should also assess the quality and adequacy of the flow of information and communication between top management and front-line staff to provide sufficient monitoring oversight and feedback.

A ROLE IN GROWTH PLANS

Internal auditors have a key role to play in helping their organization manage growth risks. To perform this role, CAEs should build a multidisciplinary team and consider involving experienced line managers as guest auditors to enhance the practical business perspective of audits. A good starting place for CAEs is to recommend that management and the audit committee include an assessment of growth risks and controls in the annual internal audit plan. Moreover, internal auditors need to be involved at all stages--when growth plans are being discussed, implemented, and monitored--so that they can provide objective and timely feedback that can enhance the chances of success.

UDAY GULVADI, CIA, CPA, CISA, CA (India), is director, internal audit and risk management services, with Eisner LLP in New York.

To comment on this article, e-mail the author at uday.gulvadi@theiia.org.

To share emerging risk issues and best practices from your own audit experiences, or to request coverage of a particular risk, e-mail jamesroth@audittrends.com.

EDITED BY JAMES ROTH AND DONALD ESPERSEN

Step-by-step enterprise Risk Management

noreply@blogger.com (Prasetyo) — Mon, 25 Aug 2008 09:59:00 +0000

Step-by-step enterprise Risk Management

Brown, Benton A

The purpose of this article is to explain to CEOs and other senior managers the scope, mechanics and potential benefits of enterprise risk management. In addition, risk managers with a more targeted purview (i.e., credit risk managers, interest rate risk managers, insurance risk managers, insurance program managers) may find the article useful for evaluating the context and contribution of their activities.

Identify, Measure, Monitor, Control

A corporate risk policy facilitates a four-step process: identify the major risks faced by the company, and then create an organized approach to measure, monitor and control those risks.

Measuring is the process of assigning a value to a given risk level, either quantitatively or qualitatively. Monitoring is the process of tracking changes in that risk measure over time, often reported against a limit or benchmark. Controlling is the process of modifying the risk level to comply with the risk-taking appetite and policies set by the shareholders and board of directors, including transferring, eliminating, financing or reducing losses or potential losses.

This framework is applied to each classification of risk. The table below examines eight significant risks that fall into four categories: financial risk, operational risk, strategic risk and hazard risk.

This taxonomy demonstrates one approach to identification. All risks can be categorized into four subject areas. Financial risks are those that relate to treasury and investment activities. Operational risks are those that relate to the ongoing business activities (people, processes, technologies) necessary to produce and sell an entity's products. Strategic risks relate to the entity's decision-making process at the senior management and board of directors level. Hazard risks are unforeseen events that arise outside of the normal operating environment (often thought of as insurable risks). Any particular entity will face a unique set of component risks under these four categories.

By dissecting each category of risk, and explaining these processes to senior management, we take the first step in introducing enterprise risk management. That is, by defining the parts, we can eventually show how they all work together. The first step is elaborating on the taxonomy.

Financial: Market Risk

-Identification: Adverse movements in prices (such as stocks or commodities) or rates (such interest rates or foreign exchange rates).

-Measurement: Notional measures such as position values; sensitivity measures such as duration and beta relative to changes in benchmark risk factors; and optionality measures, such as delta, gamma, vega, theta and rho, which assess risk relative to small changes in a specific risk factor.

-Monitoring: Position reports, valueat-risk (VaR), scenario simulations and stress testing.

-Controls: Effective methods for controlling market risk involve establishing and closely monitoring a limit structure appropriate for the institution's level of risk. Such a limit structure would include limits on net positions, stop/loss limits, value-at-risk limits and other limits based on maturity or optionality. Such a limit structure should be closely related to credit and liquidity controls.

-Application: A bond trader uses a daily VaR report to monitor the market risk of his taxable bond positions. The VaR report shows the current potential losses embedded in his positions based upon historical volatility. When the potential losses exceed his limit, the trader will sell the more volatile assets and reduce his value-atrisk to acceptable levels.

Financial: Credit Risk

-Identification: Counterparty fails to perform as agreed under contract, due to either an unwillingness or inability to pay in a timely manner.

-Measurement: Credit risk is often measured with a relative value score such as a credit rating. Assessment factors include financial capacity such as current levels of earnings, cash flow and capital, as well as historical payment patterns and recent events.

-Monitoring: An annual review of the counterparty's credit file (with updated information), increased frequency of reviews for riskier counterparties, and spotting trends in economic and industry factors that may contribute to adverse credit migration (deterioration in the counterparty's credit score).

-Controls: Limits on exposure to individual counterparties, industry concentrations and product types, netting agreements across subsidiaries and products, third party guaranties, and credit swaps.

-Application: A load portfolio reviews several counterparty credit files. As a result of deteriorating economic conditions, operating profits have dropped for several companies. As a result, the internally assigned credit scores have dropped. In order to reduce the risk of default or slow payment, several unused lines of credit are cancelled. Restrictions are imposed on new lending to customers.

Financial: Liquidity Risk

-Identification: Liquidity risk includes funding-relating to an organization's inability to meet its obligations due to inadequate cash flow or liquid assetsand market liquidity-when an asset cannot be converted to cash without significant loss of value.

-Measurement: Cash-on-hand, working capital, lines of credit, assessments of unrealized losses on capital and the impact of early termination of derivatives and other contracts.

-Monitoring: The most important goal of any liquidity monitoring process is to provide credible advanced warning of a pending liquidity crisis. Components of liquidity monitoring can include daily position reports and cash flow forecasts. Daily net-open-position reports can be used to indicate overall liquidity. Cash flow forecasting can measure short-term liquidity positions.

-Controls: A critical control mechanism is the contingency liquidity plan. This plan can provide objective guidance during times of a liquidity crisis. A liquidity crisis can deteriorate rapidly, leaving management little to time analyze and implement a solution. Other components of liquidity risk control can include strict notional limits on illiquid financial instruments. In addition, minimum earnings and capital thresholds that trigger asset sales to raise cash can help maintain cash balances during periods of declining operating cash flows.

-Application: A property and casualty risk manager reviews cash flow forecasts- He observes that projected casualty losses in the next twelve months are increasing, and that the corporate cash position has remained stable but the value of the equity portfolio has declined. He instructs the investment manager to reduce real estate and venture capital holdings and to raise the level of short-term treasury securities.

Operational: Systems Risk

-Identification: The risk that an information technology system will fail to perform or be otherwise deficient such that the company is exposed to a significant avoidable loss.

-Measurement: Mean time between failures, average down time per period and processing error rates.

-Monitoring: Capacity utilization and other monitoring software should be installed to monitor system usage, load and capacity constraints.

-Controls: Well-developed business continuity and disaster recovery plans respond to major systems failures, addressing a range of possibilities including catastrophic loss of a critical location and major internal and external component failures.

-Application: The chief information officer reviews the monthly operating statistics and notices that the secure server has been knocked off-line more frequently due to system overloads. The system has been operating at 90 percent capacity for several months. He contracts with a service provider to handle peak operating loads and develops a contingency plan to move operations to another site in the event of catastrophic system failure lasting more than a few days.

Operational: Human Error Risk

-Identification: The risk that an employee, agent or contractor will fail to perform, or be otherwise deficient, such that the company is exposed to a significant avoidable loss.

-Measurement: Performance measures such as processing error rates measure mistakes that have occurred. Academic and professional qualifications assess the potential for human errors.

-Monitoring: Ongoing management testing of employee knowledge, specific audit programs, quality control programs.

-Controls: A well-written, comprehensive set of critical procedures covering all aspects of operations as well as an ongoing objective testing and training function represent effective controls for human error.

-Application: A project manager reviews the error rate of a document coding team. She notices that five weeks after initial training, error rates increase dramatically. She implements a mandatory refresher course at fourweek intervals.

Strategic: Legal and Regulatory Risk

-Identification: Legal and regulatory risks include the risk of both civil and criminal lawsuits, regulatory sanction, costs of compliance and other restrictions imposed by political authority.

-Measurement: Settlement costs, penalties and fines paid, and the operating budgets of the legal and compliance departments.

-Monitoring: Compliance testing.

-Controls: Corporate policies, internal audits, new product reviews, legal reviews and company training programs can help promote a clean operating environment.

-Application: A compliance manager at a brokerage firm receives a memo from the legal department indicating that lawsuits and settlement amounts are increasing as a result of new regulation. A team from compliance, legal and human resources develops an employee testing and training program for all employees involved.

Strategic: Business Strategy Risk

-Identification: The risk of loss associated with bad decision making by senior management, including mergers and acquisitions, product pricing, market entry and exit and new product development.

-Measurement: Earnings, capital and stock price. More sophisticated measures include economic value added (EVA) and risk adjusted return on capital (RAROC).

-Monitoring: An annual or quarterly benchmarking analysis of performance against a peer group's results.

-Controls: An independent, informed and active board of directors exercising appropriate oversight of management decision making and corporate operations is the primary control of strategic risk.

-Application: The chairman of the board is concerned about the performance of her company's stock. She orders a consulting firm to compare the stock market performance of similarly sized companies competing in the same market. She instructs the CEO to explain the differences in operating results for the company's different market segments on a risk-adjusted basis.

Hazard: D&O Risk

-Identification: The exposure of corporate managers to claims from shareholders, government agencies, employees and others, alleging mismanagement.

-Measurement: Litigation settlements, claims paid and the cost of insurance

-Monitoring: Monitoring of D&O liability is largely a matter of claims tracking and analysis. Additional monitoring can include tracking the time spent by directors on corporate matters and performance evaluations.

-Controls: Sophisticated corporate governance and related compliance programs can help control D&O losses. In addition, nominating committees should carefully evaluate the qualifications of new board members.

-Application: Concerned about rising shareholder litigation and settlement amounts, senior management conducts extensive quarterly briefings designed to educate the board of directors about the complex details of the company's operating strengths and weaknesses. New board members are evaluated on their knowledge of the industry and state of the art management techniques.

All Risk Is Linked

All companies are in the business of taking risk. Any approach to risk management, therefore, must incorporate competitive advantages. Viewing all segments of risk in the same frame facilitates this. In this process, consider the following:

1. Risk as a variable cost element. If return is the benefit then risk is the cost. Risk, like other costs, can be fixed or variable. Analyzing the risk profile reveals how risk levels vary with different business activities. This way companies can determine what risks they manage better than others. With this understanding, they can increase the business activities in which they manage risk well, and lower commitments to business activities with little or no risk management advantage. This may mean a strategic exit or an outsourcing opportunity.

2. Efficient risk taking. Another way to look at risk taking is to plot the efficient frontier of business activities. One approach is targeting commitments to business activities that offer higher returns and lower risks. This approach allows a company to manage its risk profile in such a way that reinforces its advantages in generating returns, as in managing risks.

3. The portfolio of risk approach. Larger and more diversified organizations, such as holding companies or conglomerates, can be considered portfolios of subsidiary companies. Each company has its own unique risk profile, yet the risk profile of the parent company may be completely different given corporate support and other synergies. From a portfolio management perspective, these companies should ask: How do the subsidiaries relate to each other, both operationally and financially? What is the level of support available from the parent? Under what conditions would the parent sell a subsidiary? Any company with more than one product line can be analyzed this way.

4. Mergers and Acquisitions. The risk is unknown liabilities in the target company. Inadequate information about a target's risk profile can raise the cost of financing the transaction or depress the selling price. Specific risks of concern include: environmental issues, product liabilities and warranties, class action litigation, and tax treatment. A well-developed enterprise risk management program can provide adequate information to a suitor or serve as a reference for evaluating the "goodness of fit" of a target.

Board of Directors

Once senior executives comprehend the different divisions of risks that are linked within the company, the next step is to make them aware of their role in risk management.

Ultimately, the board of directors needs to approve of the overall approach to risk taking. The company's risk management policies and procedures should provide guidance and operating parameters that allow for the identification, monitoring, measurement and control of the risks involved with its business lines and other significant activities. Additionally, the lines of risk-taking authority and accountability should be clearly defined.

The board must:

1. Create an annual review of risk policies and critical procedures. This is the most fundamental practice by which the board of directors can express its appetite for risk and its attitude toward risk management.

2. Be involved in approving the risk limits. Limits are an essential method for controlling risks. Limits are an explicit statement of the company's appetite for risk.

3. Create a new product development process. This is a key process in controlling future exposures. The board should ensure that all new products are subject to a comprehensive review by such areas as audit, legal, compliance, operations and risk management

4. Monitor policy exceptions. It is equally important for the board to ensure the proactive elements of risk management, as defined above, as it is to determine a reactive approach. Handling exceptions to risk policies should be well defined and strictly audited, and should be closely monitored by the board.

Testing ERM

Enterprise risk management has many drivers. In the banking industry the Federal Reserve and Office of the Comptroller of the Currency conduct "safety and soundness" examinations of the larger banks. For all practical purposes, these are enterprise risk exams. The National Association of Corporate Directors encourages audit committees to expand their scope of risk management reviews. A recent article on CFO.com noted that 41 percent currently have an ERM approach, 19 percent plan to implement an ERM in the next year and 13 percent plan to have an approach in place in the next two to five years. The spate of publicly traded corporate profit warnings over the last two quarters also suggests that there may be increased interest in exploring this opportunity.

The holistic movement is moving. Senior managers need to understand the costs and benefits of their risk-taking activities, and that unity of purpose is possible across completely different risk classes. They need to ask, at least annually, and preferably quarterly, "Are we getting the most out of our risk taking?" All companies may find that there is a hidden reserve of profit improvement and added shareholder value waiting to be tapped through improved risk management. An organized and methodical approach to enterprise risk management can exploit this wealth efficiently.

Do you use ERM?

Reader Forum at rmmag.com

Copyright Risk Management Society Publishing, Inc. Sep 2001
Provided by ProQuest Information and Learning Company. All rights Reserved

The New Face of Enterprise RISK

noreply@blogger.com (Prasetyo) — Mon, 25 Aug 2008 09:39:00 +0000

The New Face of Enterprise RISK

KÃ¼nzler, Simon

The old model of basing corporate strength on industrial might and production capacity is becoming a thing of the past. Information is the new currency of corporate success, and with that comes a new primary asset and source of risk people. In the last three years, managing threats has become at least as important as managing investment opportunities for most companies. The collapse of the new economy, corporate governance failures, terrorist attacks and a series of costly natural disasters are all high-profile events that have focused senior management's attention on risk mitigation. Enterprise value is usually not destroyed through these kind of spectacular events, however, but through more mundane, more common organizational risks.

The last ice age favored big animals with large weight-to-surface area ratios. As things warmed up, however, these big creatures became easy prey for the smaller, faster-moving carnivores of the open field. Many firms find themselves in a similar transition today, from managing stable, fixed-asset businesses to more fluid, knowledge-based organizations that bring their own set of dynamic risks.

The industrial revolution was the age of big capital, in which the most productive resources were efficient factories that used technical breakthroughs, new sources of energy and abundant, cheap labor to take advantage of growing consumer markets. Scale and competitive advantage were integrally linked by cost advantage, thus motivating ever larger and more specialized production facilities. These industrial platforms were not economically nimble, however, and were sensitive to demand fluctuations. Profits quickly evaporated when revenues dropped, since costs were largely fixed. Like receding glacial ice, however, these types of industrial risks have quietly shifted. Only 15% to 20% of employees produce goods in the industrialized world, and the remaining capital asset risks of most companies have been transferred through lease arrangements, securitization and interest hedges.

Creative, intelligent, team-oriented people are now the critical resources that generate wealth and risk today. An organization's "cultural platform" has replaced the capital platform as that which drives profits and determines success or failure in business. Or, according to renowned management theorist and business writer Peter Drucker, "Knowledge has become the central economic resource. The systematic acquisition of knowledge has replaced experience as the foundation for productive capacity and performance."

Hard facts support Druckers assertion. Nearly 75% of the Dow 30's value is now in intangible, peoplebased "assets" including knowledge, business processes and intellectual property that is not yet adequately reflected in financial statements. Various studies from consulting firms such as Marsh show that the leading causes of collapsing shareholder value, whether externally or internally driven, are strategic and operational in nature. Analyzing these findings in more detail, one finds that most collapses are directly or indirectly the result of human resource failures. Managing personnel risks therefore demands top management's utmost attention.

The value of harnessing the power of an organization's intellectual capital is many orders of magnitude greater than the incremental productivity gains from process improvements during the industrialist era. 3M's legendary success with the chance invention of the Post-it note, and Microsoft's Windows computer operating system monopoly are just two examples of the value growth potential of well-managed knowledge organizations.

A New Breed of Risk

Corporate cultures are slow to change following 250 years of successful industrialist tradition. Only now are they realizing the risk management implications of the knowledge organization. The key concern is whether corporate leaders recognize the growing importance of such people-related risks and what steps are being taken to mitigate them.

Personnel risks can be broadly divided into a few categories. Reduced productivity is the most common, subtle and measurable effect of people-based risks. Unlike production workers, whose productivity is largely dictated by external factors such as production line speed and quotas, knowledge workers largely determine their own productivity, driven mainly by their physical and emotional condition, education, and above all, motivation.

Shockingly, employee motivation surveys routinely report that most employees are not motivated. In many cases, this is driven by internal organizational issues such as poor communication, leadership problems, excessive workload stress or corporate restructuring. Obviously, external shocks such as a terrorist attack can also act to reduce motivation and productivity. These problems often result in poor morale and extensive absenteeism.

The loss and/or abuse of critical knowledge and information also represents a key threat to firm value. Modern, networked organizations and information technology have placed unprecedented volumes of sensitive information at the fingertips of more employees than ever before. Most companies' complete customer files, for example, can now be carried out the front door in a palm computer. Information risk can manifest itself in a number of forms in modern organizations. The salesman who never documented his sales contacts or the scientist who carries specialized knowledge only in his head are just two common examples. And the information threat goes beyond simple loss. In an increasingly competitive business environment, the damage caused by proprietary information falling into the hands of a new or existing competitor can be catastrophic.

Intellectual property rights management is another related area of subtle but very high risk Years of lost R&D investment, blocked market access, litigation costs and/or compensation payments threaten companies that fail to diligently and strategically manage their patent portfolios.

A company's decision-making processes also embody significant organizational and people-based risks. Power concentrations might be accepted for making quick decisions in an otherwise risky situation. They represent a risk themselves, however, for the longterm stability of networked, knowledge organizations. An overbearing or centralistic decision-maker not only tends to drive other talent away, but the negative consequences of losing such a leader can also be catastrophic.

Not being able to hire the right people or hiring the wrong people are two major personnel risks. A company that cannot attract and retain better talent than its current and future competitors is at risk. And, the damage that can be caused by a single dysfunctional hire, in today's networked organizations, is significant An emotionally unstable or insecure personality will not only likely make poor decisions, but can quickly drive many talented people out of the company before the situation is rectified.

Finally, expanded employer regulation in most developed countries and employees' increased will to wage lengthy court battles have resulted in a dramatic increase in employment litigation. Employment practices liability is a rapidly growing area of human resource risk that encompasses sexual and other forms of harassment, discrimination and wrongful termination. Employee fraud and dishonesty are also risks that are similarly landing in front of a judge with disturbing frequency.

Divining a Solution

So what can companies do to manage and mitigate personnel risks? Unfortunately, the answer is not as simple as mitigating foreign currency fluctuations with off-the-shelf hedge instruments. Mitigating personnel risks first requires a systematic understanding of the nature of the risks, their relationship relative to one another and to other enterprise risks. Each company has unique personnel risks based on its industry, culture, internal processes, organization and the people it employs. And these must be examined within the broader context of its overall enterprise risk management process.

Nevertheless, there are a few general measures companies can employ to mitigate personnel risks. Hiring and organizational planning are among the most important In particular, the development of a robust organization which avoids over-dependence on one or just a few people for decision-making is paramount. The greater the leadership role and influence of a position, the more care needs to be taken in selecting candidates who understand the risks and have the skills and emotional maturity to mitigate them. Clearly, this is more difficult in smaller companies, and it places a premium on hiring people with collaboration skills. Conducting thorough assessments and interviews with multiple team members is an essential step toward selecting the right people.

An open, constructively critical corporate culture also helps to mitigate decision-making risks. Tolerance and the need for critical inputs from different points of view on important corporate issues is more likely to lead to better, safer decisions than those based on a narrow input of a few like-minded employees. It also broadens the base of critical thinkers in the company, thereby reducing "key man" risks. In addition, an open culture minimizes stress, which can otherwise lead to the abrupt departure of talent or on-the-job disengagement.

Systematic leadership processes, such as employee goal-setting and feedback, are important mechanisms for minimizing personnel risks at all levels. To be effective however, feedback processes must be transparent and avoid power concentrations that often lead to dysfunctional behavior. They must separate private friendship from professional performance and force a discussion on alignment of individual with firm goals. Clearly linking objectively measured individual performance with compensation and promotion opportunities is a powerful force to maintain motivation. In addition, it provides an early warning on personnel issues and reduces high-risk employee behavior, even in turbulent times.

Evolve or Perish

Organizational changes and re-alignment with business goals are becoming constant features of corporate survival. Organizations that have been successful in the past, however, often resist change for the future. Personnel risks are therefore greatest at times of intense organizational change such as rapid growth, restructuring or downsizing. This contradiction represents a key challenge for corporations and places a risk reduction premium on their ability to effectively manage the people aspects of change. A sad but all too common example is poorly managed personnel reductions. They may not only miss cost reduction targets but also endanger the long-term viability of an organization if critical people and skills are lost, or a company's image is irreparably damaged in the process.

Organizational change is highly nonlinear because it is very human. Perception quickly becomes reality. It is therefore imperative to systematically assess potential personnel risks prior to initiating changes, and prepare a plan ahead of time for mitigating them. Once change is initiated, it is often too late to give adequate consideration to the important and time-critical decisions which could have been anticipated.

It is also easy to underestimate the degree of communications needed to make an organizational transition smooth. Not only those employees directly effected require individual communications, but also, simultaneously, all other stake-holders-the noneffected employees, customers, partners and the media. Inconsistencies in the message to any of these constituencies can quickly throw an evolving process off course and place a company's value at risk.

Managing personnel and organizational risks in networked, knowledge-based organizations is a new and difficult challenge for corporate leaders. It will require reconciling the complexity of human behavior and turbulent markets, with the objective of achieving stable financial returns. The creative new solutions which emerge from this selection process are likely to shape the fundamental structures, organizations and processes of tomorrow's most successful corporations. Those companies which can adapt will not only survive, but also generate superior enterprise value growth. For those that fail to adapt, the cold, Darwinian fate of the woolly mammoth likely awaits.

Simon KÃ¼nzler is the head risk consultant of Kessler Consulting Inc. in Zurich, Switzerland.

Andres Poyne is CEO of Humatico AG, also in Zurich.

Copyright Risk Management Society Publishing, Inc. 2007
Provided by ProQuest Information and Learning Company. All rights Reserved

Managing Market Risk in the Investment Portfolio

noreply@blogger.com (Prasetyo) — Mon, 25 Aug 2008 08:49:00 +0000

Managing Market Risk in the Investment Portfolio

DeMasi, Jim

The April edition of this column reviewed the implications of enterprise risk management for the investment portfolio. While risk factors vary by type and magnitude from bank to bank, market risk is a universal consideration for all portfolios. Given its broad relevance, this article explores the management of market risk in greater detail.

Market risk refers to the sensitivity of the portfolios market value to changes in key variables such as interest rates, volatility, and credit spreads. The level of market risk in the investment portfolio can influence several aspects of a banks financial condition. Depending on accounting classifications, market value fluctuations for securities may affect a banks earnings or equity capital balances. From an economic perspective, price changes in the portfolio may lead to volatility in a banks market value of equity calculations. On the regulatory front, market risk in the investment portfolio is incorporated into a bank's "sensitivity to market risk" rating, which is one of six components that determine a bank's overall composite rating.

For these reasons, a robust enterprise risk management program should include an effective process for addressing the market risk that arises from a banks investment activities. A centerpiece of this process should be an analytical system capable of identifying, measuring, and reporting market risk. Whether developed in-house or provided by an outside vendor, a bond analytic system should have these basic capabilities:

* Calculation of base-case risk/reward indicators, including tax-equivalent book yield, effective duration, and convexity.

* Portfolio composition analysis, where individual holdings are categorized into sectors and risk/reward indicators are provided for each sector.

* Stress tests at the bond-level and portfolio-level that reveal price sensitivity across a range of scenarios. At a minimum, the stress tests should calculate average life, effective duration, and market value in each scenario.

* "What-if " simulations that show the impact of proposed strategies on key portfolio statistics prior to impiementation.

* Detailed cash flow projections that account for potential calls and prepayments under various interest rate scenarios.

Ideally, the analytic system should be capable of performing these functions at various levels of data aggregation, offering risk insight for individual instruments, for the portfolio as a whole, and for the overall institution. The systems reporting features should provide the board and management with a summary of investment activity, the portfolio's risk exposures, and compliance with policy limits.

Due to the high cost of these systems, many community banks choose to outsource analytics to a third-party provider. While this may be a cost effective alternative, the quality of the analytics should not be compromised. The following points should be considered when selecting a third-party provider:

* Qualifications of the personnel who will be running and analyzing the portfolio.

* Quality control processes employed by the third party.

* Ability to provide results in a spreadsheet format that can be incorporated into other functions within the bank, including budgeting, management reporting, and asset/liability management.

* Commitment to client education and the ability to help management understand the results and to use the information to effectively manage the banks portfolio.

* Willingness to provide custom reports on an ad-hoc basis, which are tailored to meet the bank's specific needs.

* Access to investment professionals who can assist management with turning raw data into feasible portfolio strategies.

Regardless of whether an in-house system or third-party provider is selected, management should periodically request that analytics be prepared by an independent source. This step should be a valuable part of the banks independent review program and will help to identify bonds that have not been modeled properly and to reveal weaknesses in assumptions.

Once market risk has been accurately measured, strategies should be developed for maintaining risk levels within policy limits. Ideally, strategies should be implemented at a macro level, taking into account the net market risk exposure of the bank as a whole. Focusing on the portfolio in isolation could be counterproductive, since it ignores offsetting or balancing risk positions that may exist in other areas of the balance sheet. For example, an asset-sensitive bank may intentionally structure its investment portfolio to carry an above average duration and relatively high level of market risk. In a rising rate environment, the decline in the market value of the investment portfolio would likely be more than offset by the positive impact on the bank's current and future earnings from higher resets on floating rate loans.

For many institutions, the investment portfolio is used to balance the risk exposure that emanates from customer-driven business lines such as lending and deposit taking. In these cases, the duration and convexity of the portfolio are managed to target levels in the context of the bank's overall risk profile. Duration management strategies require careful security selection, with an emphasis on the cash flow characteristics of the portfolio. When evaluating prospective bond purchases, the potential effect of the security on the duration and price sensitivity of the portfolio are primary considerations and take precedence over yield. Portfolios constructed to manage duration tend to emphasize bonds with stable cash flow profiles across a range of scenarios.

Liability-based strategies may also be employed to manage the market risk from the investment portfolio or elsewhere on the balance sheet. Wholesale funding options, such as advances and structured repurchase agreements, allow for a high degree of customization. For example, the duration and convexity of the liability can be tailored to match the corresponding characteristics of the investment portfolio. If structured properly, the change in market value of the liability should offset the change in market value of the portfolio for a given shift in interest rates.

In addition to the more traditional asset/liability matching approaches, derivative instruments can be useful risk management tools. Interest rate swaps, where two counterparties agree to exchange interest cash flows on a predetermined notional amount, are the most common type of derivative used by community banks for hedging purposes. For example, a bank that wanted to reduce its market risk exposure to rising interest rate scenarios could enter into an interest rate swap and agree to pay a fixed interest rate in exchange for a floating rate. While derivatives possess useful hedging properties, they are subject to complex accounting rules and should only be used by banks that have a full understanding of the associated risks and with risk management systems capable of accurately monitoring and valuing the instruments.

Jim DeMasi is a pnncipai and first vice president with Stifei, Nicolaus & Company Inc.

Risk: Keeping Ahead of the Curve-A conference summary

noreply@blogger.com (Prasetyo) — Sun, 24 Aug 2008 18:48:00 +0000

Risk: Keeping Ahead of the Curve-A conference summary

Cahill, Richard C

The Chicago Fed's Supervision and Regulation Department, in conjunction with DePaul University's Center for Financial Services, sponsored a conference on March 6-7, 2008. The conference brought together bankers, supervisors, and academics to focus on comprehensive risk management, an extremely timely topic given the recent financial turmoil.

After William A. Obenshain, DePaul University, opened the conference and welcomed participants, Cathy Lemieux, senior vice president, Federal Reserve Bank of Chicago, described how management of all major banking risks has become much more complex and sophisticated in recent years.1 This evolution includes the development of comprehensive, firmwide approaches to managing risk. While some banks used the long period of stellar bank performance before the summer of 2007 to invest in improving risk management, other banks allowed risk management to become a lower priority than it had been. Despite the challenges of the current environment, Lemieux encouraged banks to continue to focus on long-term improvements to risk management. Doing this should reduce downside risks in the near future and promote greater financial stability in the long run.

Richard C. Cahill, then vice president, Federal Reserve Bank of Chicago, provided an overview of the recent subprime and credit market turmoil. He also posed a series of key questions to set the stage for the conference, including: What is the role of chief credit officers?, Is quantitative risk management getting too clever for its own good?, Can stress testing proride useful input to decision-makers?, Do current accounting practices still make sense?, What is the future of rating structured products?, Can confidence in the financial system be restored?, and Will risk management keep ahead of the curve?

Comprehensive risk management

Cahill also moderated a panel on comprehensive risk management (also known as enterprise risk management, or ERM), composed of three banks' chief risk officers and an attorney. The chief risk officers were James W. Nelson, Huntington Bancshares Inc.; Stephen V. Figliuolo, Citizens Republic Bancorp; and Beth D. Knickerbocker, Marshall and Ilsley Corp. According to Figliuolo, the purposes of ERM are to promote regulatory compliance without impeding the sales process; to identify, measure, monitor, and manage a comprehensive set of risks; to manage risk through process improvement, a proactive approach, and heightened awareness; and to make risk management part of the corporate culture. Nelson provided additional goals: to proactively address risks arising from a changing environment; to identify and communicate risks in an actionable manner; and to improve risk/return dynamics.

The three banks have adopted different structures to implement ERM. On the one hand, Huntington and Citizens Republic have opted for a centralized approach. On the other hand, Marshall and Ilsley uses a more decentralized approach, with "risk leaders" and corresponding subject matter experts embedded in business units, accompanied by a small riskmanagement staff at the corporate level.

The panelists identified a number of benefits from adopting comprehensive risk management. Some of these are improved risk reduction through earlier risk mitigation, increased coordination between business units and risk disciplines, and strengthened regulatory compliance. They also identified a number of challenges to successful adoption. Senior management across the company must support and "buy in" to the approach. In addition, staffing is difficult-i.e., obtaining personnel with both the technical skills and the softer skills necessary to influence the organization. Finally, the subjectivity and uncertainty of risk, compared with the certainty of return, make risk mitigation inherently difficult.

David M. Simon, an attorney with Wildman, Harrold, Allen, and Dixon LLP, concluded with a presentation on two litigation risks that lenders should manage: lender liability claims and the preservation of electronic information in connection with litigation. Some of the lessons learned from the 1980s and 1990s about lender liability claims are to adhere to internal policies relating to the transaction, to ensure contracts are carefully drafted and signed, and to adhere to standards of personal and corporate integrity.

Industry use of risk-management instruments

Beverly Hirtle, Federal Reserve Bank of New York, led a session on the banking industry's use of risk-management instruments. James T. Moser, Commodity Futures Trading Commission, documented a direct relationship between interest rate derivatives use by U.S. banks and growth in their commercial and industrial (C&I) loan portfolios.2 More specifically, the aggregate use of derivative instruments-in particular, interest rate options, interest rate futures, and interest rate forwards-is associated with higher growth rates in C&I loans. This positive association is consistent with earlier research findings that derivative contracting and lending are complementary activities. Engaging in derivative activities allows banks to lessen their systematic exposure to changes in interest rates, so they can increase their lending activities without increasing their total risk.

It is uncertain how much banks actually use credit derivatives to manage risk and whether their credit derivatives positions reduce or increase systemic risk. Bernadette A. Minton, Ohio State University examined the extent to which larger U.S. bank holding companies (BHCs) use credit derivatives to hedge.3 Only 23 larger BHCs out of 395 used credit derivatives. In addition, the typical position in credit derivatives was for dealer activities rather than for hedging credit exposures from loans. Overall, the use of credit derivatives by banks to hedge loans is limited because of adverse selection, moral hazard problems, and the inability of banks to use hedge accounting when using credit derivatives.

Use of derivatives can decrease the effects of internal funds volatility on loan growth, allowing users to grow loans faster. Timothy P. Opiela, DePaul University, examined the relationship between loan growth and internal funds for BHCs that were categorized as users and nonusers of derivatives.4 Opiela showed that the loan growth of users is weakly related to fluctuations in internal funds compared with that of nonusers. Additionally, the internal funds-loan growth relationship for users is less responsive to macroeconomic shocks relative to that for nonusers. Past research has shown that BHCs that use derivatives have higher loan growth than those that do not. Opiela's results showed that an advantage of derivatives use is that it weakens the relationship between volatile internal funds and loan growth. That is, derivatives usage can cushion the effects of adverse macroeconomic shocks on this relationship.

Blurring of credit and capital markets

Brian D. Gordon, senior technical expert, Federal Reserve Bank of Chicago, discussed the blurring of credit and capital markets with panelists Kathryn Dick, Office of the Comptroller of the Currency; Jeff Phillips, BMO Capital Markets Corp.; and Coryann Stefannson, Federal Reserve Board. Gordon began by describing how the rise of the "originate-to-distribute" model-under which banks originate loans for the sole purpose of selling them to others-has undermined the traditionally clear distinction between credit risk and market risk. Now credit assets are common in trading books, greatly complicating risk management.

Phillips outhlined the various factors contributing to the recent financial turmoil, including excess global liquidity, the subprime mortgage bubble, and banks' creation of structured finance products and off-balance-sheet vehicles. He also described the "tsunami effect" of investors recoiling from risk, as well as the ongoing process of deleveraging (i.e., the reduction of financial instruments or borrowed capital previously used to increase the potential return of an investment).

Dick described how, in response to changes in the industry, her agency several years ago merged previously distinct units dedicated to credit risk and capital markets. She argued that this would improve the quality of supervisory policies as well as examiner skill sets. Stefannson noted other ways in which bank supervision was responding to market developments, such as the Basel II capital accord.5 The panel discussion centered on the uses of ratings by investors and regulators and how these might be improved.

One example of the blurring of credit and capital markets is the "dual marketmaker." As Linda Allen, City University of New York (CUNY), explained, this refers to a financial intermediary that simultaneously serves as a lead arranger for a syndicated bank loan and acts as an equity marketmaker for the borrowing firm's stock.6 Theoretical models imply that in a competitive market, the informed dual marketmaker becomes a natural liquidity provider and helps reduce the bid-ask spread in both the equity and the loan markets. However, when the dual marketmaker becomes an information monopolist, exploitation of an informational advantage could drive out other, less informed marketmakers and increase spreads.

Allen said that equity markets are more liquid in the presence of a dual marketmaker. Her research found evidence for a liquidity enhancement effect in the more competitive equity market and a negative liquidity effect in the less competitive syndicated bank loan market with the presence of dual marketmakers. Overall, the likelihood of a dual marketmaker increases with profitable trading opportunities in both markets.

Securitization and the mortgage market

Douglas D. Evanoff, vice president, Federal Reserve Bank of Chicago, moderated a panel on securitization and the mortgage market. James D. Shilling, DePaul University, analyzed moral hazard and adverse selection for subprime lending and securitization.7 The fact that the firstloss position in subprime mortgage securitizations is no longer necessarily kept by the loan originator raises the potential for moral hazard and adverse selection. This raises the possibility of tiered pricing in the subprime asset-backed security (ABS) market-a process where the market attempts to separate originators with higher-quality loans from diose with lower-quality loans.

Shilling noted that his research used high loan denial rates to identify subprime lenders with good underwriting practices and low loan denial rates to identify those with less stringent underwriting. When these data were matched to yields on subprime ABSs and to spreads on credit default swaps for home equity issuers, the results provided evidence of tiered pricing.

Christopher J. Mayer, Columbia University, studied agency conflicts in securitization, based on analysis of data from commercial mortgage-backed securities.8 Under securitization, agents perform functions that would alternatively be performed by a vertically integrated lender with ownership of a whole loan. To alleviate agency conflicts in managing troubled loans, underwriters often sell the first-loss position to special servicers, who handle delinquencies and defaults. When holding the first-loss position, special servicers appear to behave more efficiently. They make fewer cosdy transfers of delinquent loans to special servicing, and they liquidate a higher percentage of loans.

Despite the advantages of this practice, it is not used in residential mortgagebacked securities, including those backed by subprime mortgages. As a result, servicers of subprime mortgages are seriously conflicted. They earn low fees and have no "skin in the game." To mitigate incentive problems, Mayer recommended that servicers should be encouraged to sell mortgages whenever possible. In addition, he argued that the government should help in restarting the residential mortgage market and refinancing as many viable loans as possible. Finally, when the securitization market returns to normal, servicers and originators must be given a stake in the outcome of their work.

According to Joseph R. Mason, Drexel University, many of the current difficulties in residential mortgage-backed securities and collateralized debt obligations arose because of a misapplication of agency ratings.9 The large ratings agencies often have an array of conflicting incentives. Furthermore, the process of creating these securities requires the rating agencies arguably to become part of the underwriting team, leading to legal risks and even more conflicts. In addition, there are fundamental differences between rating structured finance products and rating traditional products such as corporate debt. One of Mason's policy recommendations is to remove the quasi-official status given to the agencies' structured finance ratings by the Employee Retirement Income Security Act (ERISA) and the Basel II capital standards; the ratings' current status encourages investors to rely uncritically on them. Another recommendation is to increase supervision of the rating agencies as a condition for relying on their ratings.

Looking ahead

In a keynote address, Eric S. Rosengren, president and CEO, Federal Reserve Bank of Boston, offered some "early lessons" from the ongoing financial turmoil.10 He suggested that markets need to differentiate ratings on assets such as corporate securities from ratings on assets whose ratings histories and price drivers may be quite different (and less well understood), e.g., certain mortgage-related securities. He also suggested that, if housing prices continue to fall, policy-makers will need to increasingly consider programs for those with negative as well as positive equity in their houses. Finally, in light of recent difficulties in pricing complex financial instruments, he questioned whether such complexity was necessary and whether some instruments should be more standardized or possibly moved from dealer markets to exchangetraded instruments.

Another keynote speaker, Craig S. Donohue, CEO, CME Group, highlighted the risk-management advantages of exchange-traded products that utilize central counterparty clearing services. He linked the recent financial turmoil and the large loss announced by French bank SociÃ©tÃ© GÃ©nÃ©rale to certain common characteristics. These include opaque markets; biased or subjective valuations; a limited, bilateral trading model that limits liquidity during market stress; and a weak control environment. According to Donohue, these problems exist in part because investment banks have resisted a more centralized, transparent execution system for these products.11

The final conference panel featured Edward Kane, Boston College, who placed some of the responsibility for the current financial turmoil on the breakdown of supervisory and counterparty incentives along the entire chain of structured securitization.12 He analyzed how regulatory competition encouraged supervisors, with conflicted incentives, to outsource much of their disciplinary role to credit rating firms. At the same time, this competition encouraged banks to securitize their loans in ways that pushed credit risks into areas of the financial markets where supervisors and ratings firms could not see them. He called for establishing accountability for measuring and managing the size of safety-net subsidies as a way to remedy breakdowns in supervisory ethics.

According to Jason H. P. Kravitt, of Mayer Brown LLP, while the securitization market is now massive in asset size, it consists of a relatively small group of people. As in most capital market segments, many who work in this area are young and lack historical knowledge. Many compensation incentives are biased toward the short term. Dispersion of risk has kept individual banks from failing, but it has exposed the financial system as a whole to risks that used to be concentrated in a smaller number of financial institutions. Going forward, Kravitt predicted a return to credit basics and a more transparent, less complex market, with a smaller (but still highly important) role for securitization.

Stuart I. Greenbaum, Washington University, outlined some features of a "new age of risk management." He expects ERM, which was encouraged by the Sarbanes-Oxley Act of 2002 and other accounting requirements at publicly held companies, to become increasingly prominent at companies of all sizes. He also called attention to the roles that the U.S. budget deficit, trade deficit, and monetar)' policy played in creating a context for recent events.

In concluding comments, moderator Arthur G. Angulo, Federal Reserve Bank of New York, highlighted the challenge for supervisors to simultaneously mitigate short-term aspects of the financial turmoil and determine lessons learned for the longer term. He predicted the following issues would play a key role in the months ahead: mortgage origination, the role of the chief risk officer, disclosures to investors, and capital regulations (including their potential procyclicality).

1 We thank Audrey McQuillan, supervision analyst, Federal Reserve Bank of Chicago, for assistance with this article.

2 Research conducted with Fang "Jenny" Zhao, Siena College.

4 Research conducted with Elijah Brewer III, DePaul University and the Federal Reserve Bank of Chicago, and Sanjay Deshmukh, DePaul University.

5 See www.federalreserve.gov/ GeneralInfo/basel2/.

6 Research conducted with Aron A. Gottesman, Pace University, and Lin Peng, CUNY.

7 Research conducted with Jonathan Dombrow, DePaul University, and Gail Lee, Credit Suisse.

8 Research condrrcted with Yingjin Hila Gan, Lehman Brothers.

9 Research conducted with Joshua Rosner, Graham Fisher and Co.

10 This speech, also presented to the South Shore Chamber of Commerce in March 2008, is available at www.bos.frb.org/rrews/ speeches/rosengren/2008/030608.htm.

11 Donohue made similar points in an address to the Managed Funds Association Network in February 2008; see http://cmegroup. mediarOom.com/frle.php/196/Dorrohue+ MFA+Speech+2122008.pdf.

by Richard C. Cahill, vice president, Credit Risk Department, Federal Reserve Bank of New York; Elijah Brewer III, associate professor of finance, DePaul University; Caroline Riley, senior risk project manager, Enterprise Risk Management; and Steven VanBever, lead supervision analyst, Supervision and Regulation

Supplying answers: it's impossible to eliminate every risk...

noreply@blogger.com (Prasetyo) — Sun, 24 Aug 2008 18:40:00 +0000

Supplying answers: it's impossible to eliminate every risk in the global supply chain but it is possible to minimize them. Supply strategies for managing the top five supply chain risks

Bob Stoffel

[ILLUSTRATION OMITTED]

Summary

* How a company manages its warranty process can affect its reputation for years to come.

* The Holy Grail of supply chain management is to match supply with demand.

* Manufacturing "postponement," that is, delaying the final assembly of a product until a company actually receives the order, is a good strategy for inventory control.

**********

Supply chain managers aren't necessarily known for being the life of the party, something Alexander the Great noted more than 2,000 years ago. Alexander's conquering army relied on an ancient form of supply chains--"supply trains" that moved with the soldiers--to feed and supply his troops, and his logisticians had to manage the effort.

"My logisticians are a humorless lot," Alexander once famously said. "They know if my campaign fails, they are the first ones I will slay."

Today's logisticians usually don't fear for their lives, but they do have to carefully recognize and manage a number of potentially crippling supply chain risks. In the April 15th issue of this magazine, we described five main areas of supply chain risks: disruptions in supply, changing demand, financial risks, legal and security risks and risks to corporate brand and reputation.

There's no way to completely avoid these risks. But there are some important strategies for managing risks in each of these five areas.

Three out of four supply chain executives at major U.S. enterprises have experienced a supply disruption in the last five years, according to an Accenture study. These disruptions can be caused by any number of factors, including: natural disasters, infrastructure failures and congestion, labor unrest, and failures of distant suppliers to fulfill their commitments. Sometimes, even geopolitical events can intervene.

The 2008 Summer Olympics, for example, threaten to complicate supply logistics in China from mid-July to early September. To limit the amount of smog that might harm the performance of Olympic athletes, the Chinese government plans to temporarily close some factories and limit trucking around Beijing. Companies and carriers that do business in China are already making contingency plans around the delays these actions will cause.

Regardless of the nature of supply disruptions, stock-outs and missed deliveries are risks that must be minimized. Companies doing business globally know that things can go wrong quickly and often unexpectedly. Therefore, smart companies do two things: They draw up detailed contingency plans. And they form ongoing relationships with full-service, integrated logistics providers.

Contingency planning starts with the basics, including identifying where your products are sourced and manufactured, who distributes them and to whom they are ultimately shipped. The next step is to partner with alternate suppliers in different regions of the world that are able to ramp up on a moment's notice. Contingency plans should also include provisions for building strategic safety stock, scenarios for switching transport modes--say, from ocean to air--and arrangements for hiring secondary transportation and distribution partners.

Companies can certainly assemble these contingency networks in piecemeal fashion on their own. But the best way to for companies to leverage their logistics capital and optimize total distribution costs is to let integrated third-party logistics providers, or 3PLs, do the work.

Why rely on outside experts? 3PLs often own and operate their own integrated global, multimodal networks, meaning that they have the flexibility to switch among transport modes and the control to keep shipments moving in the face of disruptions. 3PLs are also major customers for transportation assets that they don't own, such as ocean cargo lines, so they have the clout to book extra space when everyone else is clamoring for it. 3PLs also offer single source accountability so your management efforts are simplified when problems occur.

The time to create relationships with full-featured 3PLs, it's important to note, is before things go awry. This way, when disaster strikes, 3PL clients can get in the front of the line for contingency shipping and expedited services.

DEMANDING TIMES

Supply disruptions cause stock-outs. Changes in demand can cause the opposite problem: excess inventory. And inventory isn't cheap. Carrying costs, interest and taxes can represent a significant slice of overall logistics costs. And the longer products sit in warehouses, the more value they lose. That's particularly true in the high-tech industry, where products can depreciate about 1 percent a week. The Holy Grail of supply chain management is to match supply with demand. That's not always possible, but there are two strategies that help companies move closer to the goal. One is the just-in-time fulfillment model that's been the preferred approach for many companies for a couple of decades. With just-in-time fulfillment, supply is generated only on demand, and safety stock is minimal. Inventory costs are kept low and so is the risk of obsolescence.

Just-in-time fulfillment relies, of course, on tightly aligned supply chains that synchronize the flow of goods, information and funds. Access to a multimodal global network and sophisticated tracking systems are prerequisites for this approach.

A second strategy for minimizing the impact of falling demand and the resulting excess inventory is an approach called postponement. With postponement, companies recognize that they can't always accurately forecast demand for specific product variants. So they postpone the final phase of manufacturing until they receive actual orders.

What postponement means practically is that companies can store product components that can be mixed and matched for kitting or light assembly at points just before the final products are sent for delivery. Instead of, for example, producing individual stock keeping units of cell phones that have the same basic guts but differ as to handset color, faceplates and straps, cell-phone providers might store the components and kit the phones according to individual purchase orders. This way, the company can better match supply with demand and isn't stuck with inventory of product variants that might not sell well.

Today's longer cross-border supply chains present greater financial risks. Establishing a global logistics network can devour capital. It can take longer to get paid by overseas buyers--120 days or more. It can be more difficult for companies without strong credit to find financing based on international inventory as collateral. And greater distances mean greater risks of damages.

Capital is always limited, and companies are constantly looking for innovative ways to free it up. One common strategy is to outsource supply chain logistics to 3PLs. Instead of investing millions of dollars in fixed costs to build and operate their own logistics networks, companies can piggyback on the networks of integrated providers that offer pay-as-you-go services and a variable cost structure. Regardless of who owns and operates the logistics networks, maximizing cash flow and accelerating order-to-cash cycles requires creative financing approaches when global transactions are involved. One common strategy to accelerate cash flow involves discount payables. Integrated carriers have an advantage when it comes to discount payables services, because they have physical custody of the goods in transit as well as visibility systems to tell them exactly where the orders are in the supply chain. Carriers like UPS offer discount payables services that can send payments to sellers within two or three days of confirmation that the buyer has agreed to purchase the goods. In exchange for the benefit of getting paid so quickly, the seller agrees to receive discounted payments. Accounts receivable factoring is a similar approach to payment acceleration.

Global asset-based lending is another strategy to finance global supply chains. Companies need financing to buy raw materials, meet payroll and get additional working capital to expand trade. Traditionally, it's difficult for companies to obtain collateral financing for inventory that is in transit, as is the ease with international shipments that can take 30 days to cross the ocean. Because full-service 3PLs like UPS have control and visibility over the shipments, they can provide additional working capital using overseas inventory as collateral--as soon as the shipments cross the dock at the port of origin. Similar asset-based financing services, like container finance, are available for smaller, more infrequent shippers.

For U.S. companies that sell to buyers in other countries, the Export-Import Bank of the United States offers financing to these foreign customers. Master agents of the Export-Import Bank can help American companies connect their customers to these financing sources.

Yet another financial risk mitigation strategy involves purchasing various forms of insurance. Companies can, for instance, take out credit insurance in cases where they're not comfortable with the creditworthiness of a new customer that might be located overseas. Cargo insurance is an important option for international shipments that can be damaged on ships, in airplanes or in drayage. And flexible parcel insurance can provide compensation for time-sensitive or perishable small package shipments that aren't shipped on time as promised.

Complying with all the legal, security and environmental requirements that affect global logistics ultimately hinges on one thing: information visibility across the entire supply chain.

Customs security measures after Sept. 11, 2001, have certainly raised the level of scrutiny and the need for information systems that transmit detailed shipping manifest information to customs officials. In fact, U.S. Customs and Border Protection is in the process of implementing its "10+2" initiative, which requires 10 new pieces of information from importers and two additional pieces of information from carriers. The risks of having goods held back for inspection which can destroy just-in-time commitments--have led many importers to get accredited as trusted shippers so their shipments can enter the Customs fast lane.

There are additional risks at the border: When it comes to paying import duties, importers must correctly classify their products or face stiff fines.

All importers need to ensure that their accounting and logistics systems serve up the right level of detailed shipment information at the right time to satisfy customs and regulatory agencies. The right time often means transmitting detailed shipment--down to the SKU level--hours before the shipment crosses the border, regardless of how many times the shipment has changed hands along the way.

To make matters even more complicated, regulatory and security compliance is a moving target, with new requirements arising every year. One key option is to turn to outside experts who specialize in trade compliance and customs brokerage to help keep a company's operations on the right side of the law.

To manage the kind of risks that can damage a company's brand and its overall image, sometimes it's just as important to know how to retrieve products from customers as it is getting products to customers in the first place.

When products break, how a company manages warranty processes can affect the company's image for years to come. Then there are the myriad environmental regulations around the world that hold product manufacturers liable for things like improper disposal of hazardous materials in landfills.

Companies cannot wash their hands of responsibility once their products are sold. In the ease of product recalls, companies need to create contingency plans that lay out precisely how the company will use supply chain information systems to identify, who might have purchased its products. One way is to have a well-established disaster scenario plan between suppliers, transportation companies and end-market channels.

Importantly, companies should also have access to reverse logistics networks that enable them to collect defective or dangerous products from customers and dispose of them properly.

Reverse logistics planning is also important for handling of warranty repairs. Where do customers take products to get repaired? Who pays for shipping, who makes the repairs, and how quickly can the company get repaired products back in the hands of customers?

Companies also have to identify the varying environmental requirements for product manufacturing, distribution and end-of-life disposal around the world. When a product with materials that can be hazardous to the environment reaches end-of-life, how should customers properly dispose of it?

One doesn't have to manage these risks alone. Both integrated logistics providers and specialists in warranty repair and environmental compliance offer reverse logistics services that can help a company preserve its brand value while protecting its customers and the environment.

Risks are a part of doing business. Unlike those who coordinated Alexander the Great's military campaigns, logistics managers today don't have to fear for their lives. But how they manage the five main areas of supply chain risk can mean the difference between serious business setbacks and marketplace victories.

@ On the Web

* An excerpt from our supply chain survey, done in conjunction with Marsh, along with a link to the full report.

* Access to the Accenture and FM Global supply chain study.

* 10 + 2 =? for your supply chain.

www.riskandinsurance.com

BOB STOFFEL is senior vice president of engineering, strategy and supply chain at UPS. He can be reached at riskletters@lrp.com.

The secret weapon for ERM implementation...

noreply@blogger.com (Prasetyo) — Sun, 24 Aug 2008 18:36:00 +0000

The secret weapon for ERM implementation: training team members in risk management is not enough. The successful risk officer takes on the role of coach: building the right team and passionately exhorting members to do their utmost

Diana Del Bel Belluz

[ILLUSTRATION OMITTED]

Summary

* Valuable input in creating and implementing a risk management program can sometimes come from employees or managers most staunchly opposed to implementing the program.

* The key to becoming a great coach of risk management in an organization is to become a great communicator. In addition to listening skills, that means crafting messages that take into account employee needs and other motivations.

* Collaboration is essential for a risk manager seeking buy-in. The implementation of a successful risk management program is going to require many partners within the organization.

Risk management is often characterized as a narrow, highly technical field that is largely divorced from the mainstream operations of most businesses. Looking at the various books, presentation and Web sites created within this profession, it is easy to see how one could fall into that mindset.

It's not difficult to find a how-to guide for almost any technical problem in many professions, yet rarely will one find within the risk management profession literature that addresses the arts of influencing, change management and political navigation.

Of course, mastering technical skills is absolutely necessary to be successful. These technical skills are crucial when designing your risk management program on the white board. However, sooner or later, your ERM program must be put into practice within the organization for which it was designed.

While it would be nice to believe that upon seeing a solid, common-sense proposal from risk management, everyone from senior management down to line workers would offer their complete support. The reality is that many offer indifference, resistance or even outright hostility. Overcoming this is as essential as mastering the technical aspect.

A risk manager certainly will not succeed without being able to traverse the complex personal and political challenges that arise when introducing any change into an organization's culture. As a risk management professional, you can only be successful through others. That is, you'll have achieved success when decision-makers in your organization actually use the risk management program and tools you have designed and apply them habitually.

To implement a new program such as enterprise risk management within a large organization, you need to add people skills to your technical skills. To be successful as a risk manager, you need to embrace the role of coach and cultivate in your people the skills and mindset they need to make risk management live and breathe in the organization. This means you need to develop (or acquire in your group) the skills to inspire, influence and motivate people; to teach new ways of doing things; and to facilitate change.

To inspire others, first and foremost, you need to exude passion and enthusiasm. Just saying the right words is not enough. To be credible to others, you need to believe in what you are selling, and that passion for ERM needs to be palpable. You need to communicate through your actions and body language that risk management is valuable and important.

More importantly, you need to let your people know you believe in them, in their potential to apply risk management in new ways and to ultimately achieve better outcomes than any of you would have dreamed possible. Your team members need to believe that you think they can do risk management well if they put their mind to it.

To develop your influencing skills, you need to become a highly effective communicator. One of the most important and obvious, but also the most overlooked, communication skills is listening. While it may sound simple, many programs fail to generate the buy-in they need because the message is not tailored to the managers who need to adopt the program. If you want to "sell" the managers in your organization on the benefits of ERM, you need to listen to what each "buyer" says his/her needs are and craft your ERM "sales" message to speak to those needs.

Good communication is never about manipulating people. Rather, it is about understanding their goals and desires and then clearly showing them how risk management can help them to attain those goals, faster and with less effort. A good teacher or coach will come up with different ways to explain a concept so that their "student" gets it.

Another fundamental skill that is often an afterthought in the risk management world is communication planning. You need to be constantly communicating your message, and you need to be sure that the organization's leaders and risk management champions are also reinforcing key messages. A common mistake is to think that the communication job is done when the ERM program is announced. Situations change, people get distracted or forget. Revisiting and revising your communication plan needs to become an ongoing process.

An essential risk management implementation skill is motivation. If you think the implementation task is complete when you've trained everyone, think again.

Research demonstrates that productivity improve from 22 percent for training alone to 88 percent when coaching is added. You need to motivate your people at every step of the learning process.

At first, you have to motivate your people to get over their fear of failing so that they will try out the risk management tools and skills you're offering. Then, you need to encourage them to stick with it long enough to actually become proficient at using those tools. Once they've got the hang of enterprise risk management, you need to help them make it a habit to routinely use the risk management discipline in their decision-making processes.

There is still one more essential skill for success: facilitation. Because a risk management program, especially ERM, by its very nature affects many parts of the organization, one will need a lot of partners. Therefore, the ability to facilitate collaboration is essential. For example, an ERM program cannot be seen as a one-way street. In addition to making a pitch to others, one has to be willing to accept input and adapt the program to fit the needs and expectations of others. This means that even resistance should be used as an input into the program.

Cass Stein, program manager of Ball Aerospace, notes that often those who resist the most also offer the most value.

"Understand that others in the organization may have viewpoints which, although contrary to the new initiative, may hold key improvements which enhance the effectiveness of the plan," he says. "Many of the best suggested improvements for our risk efforts have come from folks initially opposed to the risk initiative."

That a risk manager will encounter resistance in driving change is a given. Most seasoned risk professionals will readily admit that the most challenging aspect of this profession is learning how to convince others to accept new ways of doing business. Improving one's technical acumen, while important, will not solve this problem.

To become a truly effective risk manager, one has to expand the skill set beyond the technical into the softer, subtler skills of coaching and change management. While this might seem at first blush to fall more under the job description of human resources, it is equally essential to the risk management professional.

On the Web

* Why you should consider a coach to master risk skills.

www.riskandinsurance.com

DIANA DEL BEL BELLUZ is a risk management expert who helps executives in large organizations to implement systematic and sustainable risk management practices. She can be reached at riskletters@lrp.com.

Board-Level Risk Committees

noreply@blogger.com (Prasetyo) — Sun, 24 Aug 2008 18:29:00 +0000

Board-Level Risk Committees

Atkinson, William

Implications and Opportunities for Risk Managers

Traditionally, senior risk executives have overall responsibility for risk management in their organizations at the operational level. The boards have responsibility for risk at the board level, but usually only oversee it in general terms and task their audit committees and/or finance committees with various and sundry risk responsibilities. For most boards, the traditional audit committees and finance committees are simply too overwhelmed with other responsibilities to add risk issues to their plates.

But with the increasing popularity of enterprise risk management (ERM) strategies, the realization that audit committees already have a full plate, and New York Stock Exchange listing requirements that boards oversee managements policies and practices for managing risk associated with major financial exposures, more and more boards are creating separate board-level risk management committees to remove the burden from audit and finance committees.

In some organizations, these new committees are called "risk management committees." In others, they are combined "audit and risk management committees" or "finance and risk management committees."

Richard Steinberg, CEO of Steinberg Governance Advisors sees the wisdom of the strategy. "Many boards have learned that there is way too much on the plates of audit committees, including financial reporting and Sarbanes-Oxley requirements." Steinberg is a believer in the value of separate risk management committees. "A lot of boards are asking the question: 'How does management know whether it has its arms around all of the significant risks?'" He has found that answering this question generally leads to the implementation of an ERM process. Boards then find it more effective to have a risk committee oversee the ERM process. "As such, there is a trend toward stand-alone risk committees," he points out. "It is still in its infancy, but I think it will gain steam."

The boards of a number of Canadian, European and Australian companies were among the first to move in this direction, followed by U.S. financial institutions, and, most recently, some nonfinancial U.S. companies, especially in the energy and utility industries.

Will such committees continue to be created by other boards? It seems to depend on the industry, the size of the business and the specific risk exposure. "I think the concept will tend to flourish in companies that are highly-regulated and large," says Mary Barnes, senior managing director, forensic and litigation consulting practice, for FTI Consulting. "These include financial institutions, pharmaceuticals, health care and even manufacturing, which is becoming more regulated."

Creating Perspective For Board Oversight

In terms of conceptual focus, KPMG looks at risk in two ways. One is risk content. The other is risk process. Understanding these two concepts is important for boards considering a stand-alone risk committee.

Risk content: "Companies need to determine the specific enterprise-level risks that threaten the organization's existence, strategy and business model," says John M. Farrell, who is the national partner in charge of enterprise risk management, for KPMG. "These risks will be those that gain visibility to the board and the senior management team."

Risk content tends to have more widely distributed concerns and ownership. One example is infrastructure risk. The content for this risk would be distributed among many different people and locations, who would be responsible for protecting the organization against negative related events happening. Those responsible - risk owners with facility or operations roles - would also manage through an event, should one occur.

Risk process: This focuses on the ways and means in which the organization identifies risk content, evaluates the content, assigns responsibility for the content, reports the content and structures itself around the content.

"While risk content tends to be distributed, the process aspect tends to be more centrally thought about and conveyed in terms of how one articulates what risk is and reactions to risk, including any form of measurement and quantification," says Farrell. "It also includes communicating and reporting about risk."

By and large, according to Farrell, organizations are waking up to the fact that they need to focus on risk, especially on the process side. "Since you can't centralize risk content responsibility, boards tend to focus on the risk process," he says. More specifically, boards are waking up to the fact that risk content for their organizations is quite varied and requires a number of different skill sets.

As such, not only are some boards setting up risk committees to oversee risk process, they often set up their committee structures as a whole so that various committees have appropriate allocation for the risk content. For example, according to Farrell, regulatory risks, compliance risks, financial risks, operating risks and product risks will be allocated and delegated to various board committees, based on the people on the committees who know the most about these risks. "Long-term, the risk committee will take on process oversight, and all committees will take on content oversight," he says.

According to Farrell, the risk executive creates a special risk committee. "[The board] tends to elevate the role of the risk manager, whether that be a vice president of risk or a CRO," he says. "When it is done well, the risk manager becomes almost a broker and a driver of change, to both the management team and the board." He or she pulls the information together so both bodies -the board and the management team -can perform their functions and make the right decisions.

Who does the risk manager report to in this structure? It depends on the industry. In the financial sector, it has become clear that the risk manager or CRO needs to report direcdy to the CEO. In the non-financial sector, the risk manager may still be reporting to the CFO or legal. In this sector, the board-level risk committee concept is just developing.

Do risk managers report directly to the boards? "This depends on the personality of the board," says Farrell. "In some organizations, board members prefer to be very interactive with the various risk people in the organization."

ERM programs: Board-level risk committees also have implications for ERM initiatives, according to Farrell. In general, risk managers and CROs tend to own risk process. They are the ones driving ERM change in the organization. In organizations where boards have become more involved in risk, by creating risk committees (for risk process), and/or giving more responsibility to other committees for risk (for risk content), this drives two things. One is a stronger governance stream in the risk management work. "Second is probably some form of redesign to the monitoring function, such as internal audit and compliance," he says.

Risk Boards In Action

One entity with a strong and successful board-level risk committee is National Penn Bancshares. In this organization, the Executive ERM Committee (management-level) reports to the Directors ERM Committee (board-level), which reports to the board of directors as a whole.

Its charter document, revised in April 2007, notes that, "As a committee of the board, the directors Enterprise Risk Management Committee will assist the board in its responsibilities under this policy to ensure that risk management activities are within policy and risk tolerance levels. The committee is responsible to review and, where required, approve the reports and information presented by management for these purposes." In addition, "the board, based on management's recommendations, will establish the organization's tolerance levels for the various forms of risk as defined by the Office of the Comptroller of the Currency, and management."

Having the committee has helped in a number of ways, according to Garry D. Koch, group executive, vice president and director of risk management of National Penn Bancshares. One relates to detail. "We are actually able to discuss various approvals with the committee, as the designee of the full board," says Koch. "That is, we are able to talk to a committee empowered by the board in a lot more detail about certain risk issues." A typical board meeting is filled with a lot of agenda items. By having a separate committee, Koch and his colleagues find that they have more time to discuss important risk issues.

The risk committee at National Penn Bancshares is composed of chairs from the other board committees. "As such, they are experienced bank directors and have a good understanding of the various forms of risk," says Koch. "However, there is also a learning process, in that all of us are still learning what enterprise risk management entails and how to manage the process."

The bank has found significant value in the committee over the last two years. One issue that recently arose was whether the bank was looking at tech- nology properly and allocating suffi- cient resources to it. As a result of some discussions that the risk team had with the Directors Enterprise Risk Management Committee, the committee went to the corporate governance committee and requested the creation of a technology risk committee, which is now a subcommittee of the risk committee. "This subcommittee is looking at our use of technology, whether we are employing it correctly, whether we have the right security in place, and so on," reports Koch. "I am very hopeful that, out of that, will come a better solution for some of the technology issues that we face."

Another entity with a successful board-level risk committee is Duke Energy, whose board created its risk committee about 10 years ago. At Duke, the risk management department reports to the treasurer, who reports to David L. Hauser, group executive and CFO. "The committee was set up to look at the risk exposures of the company and what mitigations are being put into place, look at financing requirements of the company and approve the financing plan, and look at and approve deals that the company might be doing," says Hauser.

The simplest piece of the risk, according to Hauser, is insurance, and historically, this would have been the primary focus of the committee. "However, the world has evolved a lot over the years, and now the committee reviews the assessment of company risk that we provide to it," he says. Examples include how much collateral the utility might have to put up if it were down-graded or whether sensitivity associated with the sale of its product (such as not being able to get the coal it needs for its power plants).

According to Hauser, every member of the board risk committee has a different background and set of skills. "Some of them are well-versed in derivatives and the financial market," he says. "Others are more versed in real estate markets. As such, when we make presentations, we make things as straight-forward as we can." In addition, there is also a lot of question and answer, which Hauser believes is a good thing to encourage dialogue and additional information-sharing.

The committee has been a benefit to Duke over the years. "The board committee wants to make sure that someone is monitoring risk from a total company basis," says Hauser. "The board then gets to understand the positions that cost the company and how they are mitigated at the corporate level."

The simple fact that the committee's existence puts a discipline into the risk process that is very positive. "Overall," says Hauser, "the board's awareness of risk issues has been hugely worthwhile and has kept us from making some mistakes that we might otherwise have made."

William Atkinson

"Board-Level Risk Committees" pg. 42

Atkinson is a freelance writer based in Carterville, Illinois.

Managing All of Your Enterprise's Risks

noreply@blogger.com (Prasetyo) — Sun, 24 Aug 2008 18:16:00 +0000

Managing All of Your Enterprise's Risks

Shaw, Jack

In 1962, Canadian risk management pioneer Douglas Barlow, an executive with equipment manufacturer Massey Ferguson, famously said, "All management is risk management." Nearly half a century later, the vision first expressed by Doug Barlow finally is coming to fruition.

Historically, corporate management of risks of various types has been handled in isolated "silos." Traditionally insurable risks such as automobile and general liability might be handled in an insurance department. Product liability might be managed by legal. Supply chain risks would be dealt with in logistics or procurement. And market risks could be addressed in the sales or marketing organizations.

The problem with this prototypical approach is that it entirely misses two critical aspects of risk management from a corporate, or enterprise risk management (ERM), perspective. The first is the corporate risk appetite. The second is the management of emergent risks.

Risk Appetite

The concept of risk appetite is actually a very important capital allocation issue. A company's risk appetite is the amount of risk a company is willing to absorb for the returns it expects to gain. Every company has a risk appetite, although in most cases it is implicit, and only vaguely understood, rather than being explicitly stated by senior management.

Ultimately, it is the financial markets who evaluate the prospective returns a business promises and weigh them against the risks to which it exposes itself in order to gain those returns. If the return-to-risk ratio is deemed appropriate by the markets, the value of the firm goes up. If not, it goes down.

Clearly, it is then important for a company to ensure that the degree of risk to which it is exposed stays very close to its desired risk appetite. Figure 1 shows a simple ERM tool called a risk appetite graph. Here, we see an illustration of how the risks found within various business areas of a representative company might vary with respect to one another and the company's risk appetite.

By reviewing such a graph, one can quickly see that while most areas of the business seem to have risk exposures under control, there seems to be a problem in operations. Whether its origin is a difficulty in the supply chain, a safety exposure in manufacturing or a retail location, or some other operational predicament plainly the company must correct the situation. If uncorrected, the risk could turn into an actual loss that could not only be expensive for the business but could also cause a punishing drop in valuation by the financial markets.

Many executives, however, might miss the second risk management problem highlighted by this same figure. That is, in one area of the business, the risk exposure is too low.

Many executives' initial response to this idea is "Preposterous! How can any area of risk be too low? Isn't that the point of risk management-to eliminate as much risk as possible?"

The answer, in a word, is no. There is only one way to eliminate all the risk in your business. That is to shut the doors and go home. But, no risk, no reward. So, if you are going to be in business you are going to have risk. The objective is not to eliminate risk altogether, but to manage it to an appropriate level-not too high, and not too low.

A common example of where risk can be too low is in the credit department. All too often credit managers become obsessed with having the lowest possible credit losses. Unfortunately, they may achieve this by turning down otherwise profitable business that has even the slightest credit risk associated with it. While credit losses are indeed reduced, it may be at the cost of much greater losses in profits associated with the rejected sales.

So risk in some areas really can be too low. It is not that additional risk in and of itself is desirable. As mentioned above, it is really a capital allocation problem. In this case, the company may benefit by shifting risk management resources from one area to another.

The principles underlying risk appetite are straightforward and the diagram is simple to understand. It is important to bear in mind, however that, as described below, risk is a six-dimensional problem. As a result, comparing risks across various facets of your business, and, even more importantly, managing those risks effectively is a very complex undertaking. This is a key aspect of why ERM has not yet been widely implemented. The existing tools and technologies to support it to date were not designed to manage such complexity well.

Emergent Risks

The second aspect of risk management often overlooked by executives in companies that do not have ERM is combinatorial or emergent risk. Emergent risks arise from actions taken in multiple areas of the company that, by themselves, do not increase risk. In fact, these individual actions may reduce risk, but combined, they can dramatically increase it.

A classic example of emergent risk took place in the 1990s at Ford Motor Company. For the past 30 years or so, automobiles sold in the United States have been equipped with catalytic converters to reduce air pollution. One drawback of these catalytic converters was that they required such rare metals as platinum, palladium and rhodium. In the early 1990s, two different areas at Ford recognized that a significant price increase in some or all of these rare elements could have a devastating impact on Ford's profitability. Each set out to do something to reduce this risk.

The purchasing department took a commodities hedging approach to solving the problem. It reduced the risk by entering into a series of long-term contracts to purchase these rare metals at prices locked in to the acceptable prices in the market at the time.

The research and development department took a research-based approach to solving the problem. They were determined to develop new catalytic converters that required only a tiny fraction of the rare and expensive metals in question.

You can probably see where this is going. Five years later, Ford had new catalytic converters that no longer required the metals they had committed to purchasing. Unfortunately, at that time, an oversupply of these metals in the marketplace had brought about a price drop. As a result, Ford had to take a write-off of almost a billion dollars on their rare metals purchase contracts.

The frustrating problem for Ford in this case was that each department did exactly what they were supposed to do to reduce risk-but only from their limited perspective. It was only the combination of actions that ultimately caused Ford the great loss it incurred. Had it had an ERM system in place, Ford could have recognized much earlier that the actions being taken by the two departments were counterproductive. It then could have taken steps to correct the situation and probably significantly reduced, if not eliminated, the loss.

Other companies expose themselves to many kinds of emergent risks on a regular basis. The marketing department rolls out a new promotional program without realizing the impact on the supply chain. Product development comes up with a new product without seeing how it might affect the company's product liability. Manufacturing builds a new plant in a third-world country to take advantage of low labor costs but fails to recognize the effect on the company's foreign exchange positions. In an increasingly complex, interdependent world, the number of emergent risks businesses face is growing exponentially.

None of these problems can be solved, or even effectively addressed, with the traditional risk management tools in place in most organizations today. To solve these problems requires businesses to put in place a well-designed enterprise risk management process and the systems to support it. For these purposes, enterprise risk management can be defined as the identification of and appropriate response to events and trends, both internal and external to the enterprise, which may impact the value of the enterprise or its ability to execute its strategy to increase that value.

Notice that ERM does not solely address those risks that may negatively affect value. It also deals with opportunities that may have a positive impact on the enterprise.

Implementing Enterprise Risk Management

There are seven steps to implementing an effective ERM program for your organization: 1) assemble and educate a cross-functional team representing each significant functional area of your business, 2) identify your risks and opportunities, 3) determine your risk tolerance, 4) identify correlations among your risks and opportunities, 5) prioritize your risks and opportunities, 6) determine appropriate actions for mitigating risks or exploiting opportunities as necessary and 7) put an enterprise risk management system in place to monitor and respond to events and trends on a continual basis.

As referred to in this issue's previous story, "Where Are You on the Journey to ERM," you could start by purchasing copies of the COSO "Enterprise Risk Management-Integrated Framework." Developed over the course of several years by the inter-industry Committee of Sponsoring Organizations (COSO) of the Treadway Commission, it is a set of well-thought out recommendations on how organizations in any industry should address ERM.

It also can be very helpful to have a risk management consultant assisting you in this process. However, if you do decide to hire a consultant, be sure they are there to consult with you and not simply to sell you insurance. An experienced ERM consultant can provide objective advice uncolored by the desire to increase their revenues by selling insurance policies.

Identify your risks by starting with your company's business plan. This is why it is important to have representatives from each major area of your business participating in the process. Consider each of the activities your business has planned and identify internal and external trends and events that might significantly affect that activity-either positively or negatively.

Determining your risk tolerance can be tricky because it can be difficult to compare risks from one part of your business to another. One simple way to compare risks of different types is through a risk assessment chart cross-referencing the likelihood and potential severity of risks. Different risks can then be placed on the chart for ready visual comparison.

When assessing risks, it is important to keep in mind the potential relationships between various risks. Many risks are positively correlated with other risks. That is, as the likelihood of one risk increases, that of an associated risk also increases. This means that the impact of a risk may be accompanied by additional effects that could catch you by surprise if you fail to recognize these correlated risks. At the same time, it may mean that steps taken to mitigate one risk also could positively impact another risk.

Risks may also be negatively correlated. This means that as the likelihood or impact of one type of risk increases, that of an associated risk decreases and vice versa. For example, a company may choose to invest in both variable interest CDs and bonds. As interest rates increase, the value of the bonds generally drops, but the return on the CDs improves. If interest rates fall, the return on the CDs does also, but the value of the bonds typically increases.

Figure 2 (see p.26) shows a risk assessment chart. Note that the color distribution is not perfectly balanced. This is intentional. The more likely an event is, the easier it is to plan for. As the likelihood of an event approaches certainty, it actually becomes less of a "risk" in the traditional sense of the word, and instead becomes simply an actuality that must be planned for.

By looking at the four corners of the chart, you can see four basic types of risk. On the upper right are the critical risks. These are the "drop everything else and fix this problem" risks that threaten the very survival of the organization. One key objective, and potential benefit, of risk management is to avoid risks ever reaching this state. On the opposite corner, in the lower left, are those risks that are insignificant-at least for the moment. While they should be monitored, they rarely require immediate action.

Perhaps the most interesting sets of risks are those in the other two corners. Historically, most risk management has centered on those predictable risks of minimal to moderate magnitude that could either be absorbed or could be addressed by purchasing insurance. These are reflected in the lower right corner.

However, history also has shown that, for most businesses, the most devastating risks have been those that emerged unrecognized from the upper left corner of the chart. These are the severe to catastrophic risks that, however unlikely or remote they may seem, can jeopardize a business's existence. This is why the colors in the risk assessment chart indicate that those risks in the upper left part of the chart are more significant than those in the lower right.

These low-likelihood, high-impact risks may be manmade, such as terrorist attacks or rogue financial trading, or natural, such as hurricanes or the tsunami that struck the Indian Ocean at the end of 2004. And while, if disregarded, they have potential to do the greatest harm to organizations, these are the risks that traditional approaches to risk management, and most of the risk management systems in the market today, most completely fail to address.

The Dimensions of Risk

There are actually six dimensions to any risk. These are 1) the likelihood of a relevant trend or event, 2) the magnitude of the effects of the trend or event, 3) the degree of uncertainty in the estimate of event likelihood, 4) the degree of uncertainty in the estimate of the magnitude of the effects, 5) the ability to influence the trend or event's likelihood and 6) the ability to influence the magnitude of the effects.

We have already discussed the likelihood and magnitude of risk. Often, though, these can not be as accurately estimated as we would like. The degree of uncertainly in these estimates is one reason why traditional statistical models of risk may be limited in their effectiveness.

Even more significant is the ability the organization has to influence the likelihood or magnitude of a trend or event. This is the essence of risk mitigation, and it is the very area where most risk management systems today fall on their faces.

It is fine to identify and prioritize risks. And there is no doubt that the financial markets are very unforgiving of corporate management that fails to recognize the risks facing them. At the same time, it is obviously unacceptable to go to the Board of Directors or the financial markets and say, "We have clearly identified and ranked our risks; we just are not going to do anything about them."

For many risks, the likelihood of occurrence can be significantly reduced. For example, increasing lighting and security at facilities in areas showing a trend of increasing crime can reduce the likelihood of crime-related risks. For others, the magnitude of the effects can be affected. You might not be able to influence whether a hurricane is going to hit your area of operations, but you can certainly take steps to minimize the damage if it does.

So, a project to identify and prioritize risks and determine steps to mitigate them is an excellent start. But a one-off ERM project does not conslitute an effective enterprise risk management program for your business.

For your organization to benefit from ERM in the long run, you must put into place an ERM process to help you continuously monitor and respond to risk on an on-going basis. To do this cost effectively means you will also need to use the most appropriate information technology to support your ERM process.

Automating Enterprise Risk Management

In the October 2004 issue of Risk Management magazine, Brian Warren noted some of the critical shortcomings of current risk management information systems. These included:

* The ability to contend with operational risk as well as traditional financial and credit risks

* The ability to collect all the relevant data needed to manage risk from both internal and external sources

* The ability to employ analytical tools that address not simply historical data, but that can project risks and impact for events that have never previously occurred

* The ability to identify a chain of events that may follow an initial loss event and accurately project the impact of the "ripple" effects emanating from that event

Warren is absolutely correct in identifying the limitations of current technologies in the ERM marketplace. In order to effectively manage enterprise risk on an on-going basis, you must address two problems. First, you must continuously gather information from all relevant sources. Then you must analyze that information to determine the risk priorities and assess appropriate risk mitigation actions to undertake.

Until the past few years, gathering relevant information in an automated way was not practical. However, with the emergence of the Internet, web services, enterprise service buses and other services-oriented architectures, the task has become far easier. By leveraging these technologies, businesses can now integrate information from systems throughout their own organizations with important, relevant data from external sources.

While gathering the requisite data is a challenge, at least the necessary technologies are currently deployed in the commercial marketplace. This makes this aspect of automated risk management somewhat easier. A handful of the leading ERM systems in the marketplace can do this today.

A much more challenging task is what to do with all this information. If a company could afford to staff its risk management organization with a large enough number of people and assuming that they could communicate very efficiently among themselves, they could keep up with the flood of data, identify key risks and recommend appropriate risk mitigation actions.

Clearly though, this is not financially feasible. For an ERM system to be truly effective it must not only gather relevant data. It must also analyze that data, identify crucial risks, determine appropriate risk mitigation actions, and, in some cases perhaps, even execute those risk-mitigating activities.

A six-dimensional problem such as ERM is a very complex one to solve. This is why so few organizations have implemented truly effective ERM systems today. The existing technology in the commercial information technology marketplace is simply not up to the task.

This existing technology falls into three categories: statistical models, rules-based or expert systems, and neural networks.

Statistical models. For a limited range of risk management problems, statistical modeling can be very effective. The challenges to statistical models, though, are significant. Is all the historical data available? If available, is it really relevant? The biggest problem with statistical modeling approaches is that they are virtually useless when it comes to projecting risks for which there is no prior history.

Rules-based or expert systems. These can be helpful for solving certain small-scale problems. For example, a rules-based system might very effectively recommend which of a limited number of product configurations might be most appropriate for a particular use. But rules-based systems do not handle uncertainty well, and uncertainty is the very basis of risk management.

Also, rules-based systems do not scale well. Since there is no inherent structure to rules-based systems, once you get beyond a few dozen rules, they can no longer handle the complexity. They begin to give bizarre and inappropriate results. Efforts to change the rules to correct these problems invariably result in different, equally peculiar errors.

Neural networks. These are an intriguing and highly touted emerging technology. Again for a certain class of problems, they can be very useful. Neural networks are good at solving problems where we do not understand the thought processes people use to solve the same problems. For example, we can look at a bush or a tree and tell which is which at a glance although only a trained botanist would be able to explain the differences explicitly. However, even a four-year-old can accurately distinguish trees from bushes even though he or she would never be able to explain exactly how they can tell the difference.

A neural network, presented with many photos of trees and bushes, and provided with feedback as to the accuracy of its guesses, will eventually "rewire" itself to be able to identify trees versus bushes with a very high degree of accuracy. However, its "reasoning" process is totally opaque. You can no more get a neural network to "explain" how it arrived at its conclusions than you could get a four-year-old to explain how they reached theirs.

In an area as important as enterprise risk management, it is critical that the people carrying out risk mitigation activities recommended by an automated ERM system have complete confidence in those recommendations. This means they must be able to clearly understand the chain of reasoning the system used in arriving at its conclusions.

A Solution to the ERM Technology Problem

Fortunately, there is technology new to the commercial marketplace which solves the risk management "reasoning" problem very effectively. This technology is explicit causal modeling.

Causal modeling uses a series of advanced knowledge engineering tools to solve complex, real-time problems that are intractable by other means. Causal modeling accurately simulates the ERM objectives of the firm within the context of its broader strategic goals. A causal modeling approach to ERM not only can gather all the relevant information, it can use that information to recommend optimal risk mitigation actions. And the chain of reasoning it uses to do so, while complex, is completely clear and understandable to people considering its recommendations.

An ERM system based on causal modeling can identify the relationships (including both positive and negative correlations) among trends and events that could impact the enterprise. Thus it will automatically recognize and take into account the "ripple effects" that may come about as a result of a specific loss event. An ERM system based on causal modeling can even reason about events without historical precedence. This makes this approach uniquely effective for managing operational risk.

While none of the ERM systems on the market today leverage causal modeling, the technique shows great promise for addressing a ranged if highly complex problems-including ERM. Causal modeling, combined with the sophisticated web-based information access tools developed in the past few years, can provide the basis for enterprise risk management systems that, at last, allow businesses to manage all risk on a consistent, coherent basis across the organization. Thus finally, after nearly half a century, Douglas Barlow's insight that "All management is risk management" can come to pass.

Jack Shaw, vice president of commercial systems for Applied Systems Intelligence in Roswell, Georgia, is recognized as a leading expert on business and technology. He is the author of several books on business technology.