Enterprise Risk Management Integrated Framework

1
Enterprise Risk Management Integrated Framework

• Internal environment
• Tone overall attitude about risk
• Objective setting
• Organizational goals best developed by a
  strategic planning process

• Event identification
• Specific risk exposures
• Risk assessment
• Probability of occurrence inherent or residual

2
Enterprise Risk Management Integrated Framework

• Risk response
• Avoid, accept, reduce, share
• Control activities
• Procedures for enacting risk responses

• Information and communication
• Keeping the organization informed about the plan
  and results
• Monitoring
• Periodic review and update

3
Implementation suggestions

• Internal environment
• Leadership from the top
• Steering committee implementation team
• All organizational levels and functions
• Opinion leaders
• Collective bargaining input, if applicable
• Released from some part of regular duties
• External consultant?
• Regular reporting and feedback sessions

4
Implementation suggestions

• Objective setting
• Structure discussion in terms of categories, but
  not slavishly
• Strategic, Operations, Reporting, Compliance
• Develop SMART goals
• Specific, Measurable, Attainable, Realistic,
  Timely
• Bear in mind the iterative nature of the process
• Strategic plan may provide a starting point

5
Implementation suggestions

• Event identification
• Use a taxonomy (such as Browns) to stay focused
• Limit the initial list to five to nine items
• Consider the Delphi technique to narrow down to
  that many

6
Implementation suggestions

• Risk assessment
• Identify probabilities as low, medium or highnot
  as numeric
• Focus initially on inherent risk (not residual
  risk), not assuming any actions on the part of
  others
• Return to event identification as necessary

7
Implementation suggestions

• Risk response
• Keep in mind four generic responses avoid,
  accept, reduce, share
• Each risk may have more than one response
• Connect responses to objectives
• Consider monetary and non-monetary costs

8
Implementation suggestions

• Control activities
• Focus on how to operationalize the generic
  responses
• Risk sharing
• Insurance
• Strategic alliances
• Performance-based pay systems
• Start small and simple
• Avoid the we already do that syndrome

9
Implementation suggestions

• Information and communication
• During and after development
• Team members represent constituencies
• Monthly reporting (up to 18 to 24 months for
  project completion)
• Multiple methods
• Newsletters
• E-mail
• Posters
• Web site

10
Implementation suggestions

• Monitoring
• Establish a clear, dedicated position to the
  extent possible
• Schedule structured semi-annual reviews for the
  first two years at least
• As risks and objectives change, modify the plan

11
Implementation suggestions

• Other
• Consider a form, such as the risk-control matrix
  in your handouts, to organize and summarize
  efforts.

12
Case study
www.dreamboxcreations.com
13
Case study

• Internal environment
• Top management reading and seminars
• All-hands kickoff meeting
• What is the initiative?
• Why / how is it different from the past?

• Objective setting
• Expand into one new market within one year
  (strategic)
• Increase customer satisfaction by 25 within one
  year (operations)
• Increase server capacity by 50 within six months
  (operations)

14
Case study

• Event identification
• Server capacity
• Insufficient cash on hand (liquidity risk)
• Accidental / intentional damage (human error
  risk)

• Risk assessment
• Insufficient cash on hand high
• Accidental / intentional damage medium

15
Case study

• Risk response
• Insufficient cash
• Reduce
• Damage
• Avoid
• Share

• Control activities
• Insufficient cash
• Cash reserves
• Line of credit
• Aggressive collection of receivables
• Damage
• Physical and electronic security
• Policy procedures manual
• Insurance

16
Case study

• Information and communication
• Comment period for each element of the plan
• Water cooler discussions
• Focus groups
• Internal web site

• Monitoring
• Risk management officer
• Anonymous comment area on internal web site
• Graphs and charts to illustrate progress toward
  objectives

17
Application

• Working on your own or with colleagues from your
  organization, complete the tasks on the
  associated handout. Well have time for small-
  and large-group discussion near the end of the
  session.