ERM Challenge Series: #6: Relevance of Risks to Owners; The Importance of Creating 2 Layers of Risk

ERM Challenge #6: Relevance of Risks to Owners; The Importance of Creating 2 Layers of Risk


ERM Objective:
Create relevant risks for your executive and middle management alike


The Trap:
Creating a single set of risks for both your organization.
 
The Solution:

The Solution:
Your executive owns your organization's corporate objectives. Identifying the risks associated with these objectives will create Management’s risk universe (typically 20-35 risks)


Similarly, each department will have its own set of objectives and related risks. (typically 10-20 risks per department)

Aggregating these 2 distinct layers of risk into a single risk group is counter-intuitive. Management regards the list as “in the weeds” and middle management considers the risks to be “bigger than my department’s mandate”.

Allow each level to own the risks that are related to their objectives.