ERM Challenge Series: #6: Relevance of Risks to Owners; The Importance of Creating 2 Layers of Risk

ERM Challenge #6: Relevance of Risks to Owners; The Importance of Creating 2 Layers of Risk


ERM Objective:
Create relevant risks for your executive and middle management alike


The Trap:
Creating a single set of risks for both your organization.
 
The Solution:

The Solution:
Your executive owns your organization's corporate objectives. Identifying the risks associated with these objectives will create Management’s risk universe (typically 20-35 risks)


Similarly, each department will have its own set of objectives and related risks. (typically 10-20 risks per department)

Aggregating these 2 distinct layers of risk into a single risk group is counter-intuitive. Management regards the list as “in the weeds” and middle management considers the risks to be “bigger than my department’s mandate”.

Allow each level to own the risks that are related to their objectives.

ERM Challenge Series: #5: Integrating ERM into Routine Processes

ERM Challenge #5: Integrating ERM into Routine Processes


ERM Objective:
All relevant stakeholders in your organization embrace the risk management process because they understand its link to desired performance.


The Trap:
The ERM process is designed layered on top of the business. If your ERM advisor wants to document a stand-alone ERM process your program is not destined for success.


The Solution:
Build upon existing processes and use existing documentation:
Asking people to suspend their “day job” to engage in a risk management process does not work. It is the responsibility of the ERM team to integrate every step of the new ERM process into existing processes and documentation.

This does not suggest that the ERM team cannot create a multitude of new documents and tools for their own team to facilitate the program and generate reports. However, risk owners will be far more likely to embrace a risk program that is woven into their current daily routines.

ERM Challenge Series: #4: Risks as Events; The Importance of Documenting your Risks Correctly

ERM Challenge #4: Risks as Events; The Importance of Documenting your Risks Correctly

ERM Objective:
Draft risks that are easily understood, unambiguous, and interpreted the same way by all who view them.

The Trap:
A majority of companies create confusion or frustration with their ERM program by drafting risk statements poorly. Risks beginning with the following phrases are not risk events, and will result in a frustrated group of executive risk assessors and risk owners:

• “An inability to…”
• “…leading to…”
• “And / or”
• “A lack of…”
• “…as a result of…”

The Solution:
X May Happen:  This process is intuitive and the outcome is a risk register that is easily interpreted by all of your stakeholders. It is as simple as “X may happen”.

Another insight – your risk register should not contain a risk such as, “Reputational damage may occur”. Reputational damage is a component of your Impact assessment. Over half of your risks can lead to reputational damage, so don’t consolidate all reputational considerations into just 1 risk.

ERM Challenge Series: #3: Designing a Risk Management Culture; The Benefits of Participating in the ERM Process

ERM Challenge #3: Designing a Risk Management Culture; The Benefits of Participating in the ERM Process


ERM Objective:
Generate support for ERM from the board through to the front lines.

The Trap:
There is a negative cascading effect when the ERM team cannot generate management support for the program. If there is no tangible link between the ERM process and the organization’s performance, then ERM is regarded as a cost centre rather contributing to achieving targets. When middle management regards ERM as a departure from their day job, or as a compliance or audit, then they will be reluctant participants.

The Solution:
The KEY question is, “What’s the benefit for me to support risk management?” Answers to this question include:

• Board, “I will have greater assurance that management understands and manages their risks effectively”
• Executive, “To increase the likelihood of achieving my performance targets”
• Risk Owners, “To make a logical argument to management about the resources that I need allocated in order to achieve my targets”

ERM Challenge Series: #2: ERM Reporting; Why Management Cannot Relate to the Reports they See

ERM Challenge #2: ERM Reporting; Why Management Cannot Relate to the Reports they See


ERM Objective:
Create a high degree of relevance between risks and key stakeholders within your company (i.e. The board, executive team, and middle management)

The Trap:
ERM team report lists of risks that have been separated from their strategic priorities (See Challenge #1). As a result management regards the risk reports as a “disembodied list of reasons why the organization will fail”. Most companies report their risks under siloed categories such as IT, HR, or Safety. Management works hard to break down silos, so why do we report risks by them? It’s a reporting flaw that prevents ERM from being strategic.

The Solution:
Risks are always reported beside the objective, process, project, IT system, or supply chain element that they are related to. As a result risks are correctly regarded as a natural part of the strategic focus of the organization.

Integrate your risks into your balanced score card. This continually positions the risks within the context of the strategic plan. Management can view the entire landscape as follows:

Strategy | Target | Risk | Risk Response = Performance

ERM Challenge Series: #1: Relevance to the Board & Management; Aligning ERM and Strategy

ERM Challenge #1: Relevance to the Board & Management; Aligning ERM and Strategy

ERM Objective:
Align the ERM process with management’s priorities to ensure it consistently creates value for the organization. The board and management view ERM as essential to achieving annual targets.

The Trap:
The ERM process is perceived as an audit or assurance exercise, rather than as a PERFORMANCE-focused process. Identifying risks via traditional categories (e.g. IT, HR, Finance, etc.) loses the relationship between objective and risk. Mapping risks back to objectives after the fact is ineffective. The key question is, “If this is our objective, what will prevent us from achieving it?”

The Solution:
ALL risks are identified for each of your organization’s strategic priorities. There is direct line of sight between performance targets and the risks you must manage to achieve them.  Risks are not identified by traditional siloed categories.  When you report your risks, ALWAYS list the risks beside the relevant objective.

The importance of measuring ERM performance

In my experience I have found that a key challenge companies face is motivating various departments to adopt the ERM process. The root cause for this is often that ERM teams layer their processes and tools on top of the business, rather than integrating them into existing processes. A good example of this is risk mitigation planning. For illustration purposes consider the Customer Retention department. A VP of Retention has just confirmed her annual plan with Management, and has a list of initiatives that her department needs to accomplish this year. Human Resources has also confirmed her performance metrics and bonus structure based upon this annual plan.

A week later, the ERM team facilitates a risk assessment workshop that includes the risks related to Customer Retention objectives. The VP of Retention is asked to document a mitigation plan based upon the outcome of the workshop. ERM provides her a standalone ERM Mitigation Form. She completes the form and submits a copy to the ERM department. At the end of that year the VP of Retention successfully completes all initiatives in her annual plan and receives her bonus. The risk mitigation plan, which was not incorporated into her annual plan, remains incomplete. Not surprisingly, the VP of Retention focused on the initiatives upon which she is measured.

This inability to motivate participation in the ERM process is a very common situation. My advice for ERM teams is to work diligently with the Strategic Planning department to integrate risk mitigation plans into department leaders’ annual plans. This annual plan already contains the key initiatives that they need to complete, and risk mitigations are simply additional initiatives that require equal focus and attention.

Bottom line, people do what they are measured upon.

Don't Overcomplicate ERM

A well designed ERM program supports many complex challenges, such as:
• Achieving corporate and departmental objectives;
• Strengthening compliance processes;
• Increasing corporate security and reducing fraud;
• Protecting reputation;
• Safeguarding assets;
• Building value;
• Enabling the Board and Management to make risk informed decisions; and
• Sustaining high levels of confidence in the organization across all stakeholders.

The final challenge for the ERM Team, however, is providing a practical, achievable process for all participants to use. A strong ability to read your audience is critical. Too many ERM practitioners impose complex, abstract processes on the business. For example, there are only a select few in any organization who embrace the concept of assessing risk on an inherent basis. For an Internal Audit scoping process it is a valuable metric. For the head of Sales, Customer Retention, Product Development, or any other non-assurance function it provides more confusion than value. As a result, I recommend that all operational risk assessments simply employ residual risk assessments. Risk assessors will appreciate the practicality of the process and will be more likely to buy-into the results.

Demonstrating ERM Value

A significant part of my role is helping my client ERM teams build strong working relationships with other stakeholders in their company. This can involve reversing previous perceptions about the role of ERM, which has often been positioned as more of an audit or compliance activity. While audit and compliance are essential processes, there is no need to duplicate these with the ERM process. Alternatively, ERM can focus on assisting Management, and each department, to achieve their objectives. The process provides value by routinely helping objective owners prioritize the key challenges (risks) they face, and then identifying the resources necessary to address them.

In my experience I have found that when the Management team and other departmental leaders recognize the valuable process that the ERM team offers, they are much more interested in embracing the process. This situation is further supported if the ERM team can guide the Board and Management to build a risk culture where identifying risks is rewarded, rather than rebuked.

As key stakeholders recognize the way a performance focused ERM program supports their goals, they will increase their trust in both the process and the ERM team.

Ensure every action contributes to your objectives

The risk management industry has done itself a disservice. The term ERM usually conjures up images of compliance, assurance, and unwanted processes that slow down productive business activities. Too many CEOs, referring to poorly executed ERM processes, ask: “Aren’t we doing this already?” In my experience what they are really saying is: “You have presented me with a list of risks, but I don’t understand how they relate to our performance, and I think we are managing many of them well already.” Let me explain why the ERM process they have been presented is leading them to this correct conclusion.

The baseline for all well-designed ERM activities is the annual strategic plan, which contains all strategic priorities that the ERM process must support. The question, “What keeps you up at night?” is out-dated as it lacks relevance to the company’s goals. The fundamental question that the ERM program must continually ask is, “For each corporate and departmental objective, what are the barriers that will prevent us from successfully achieving these targets?” Every risk must find its roots in a key objective.

This process of linking objectives to risks challenges the process of traditional risk categorization (e.g. HR, IT, Financial, Environmental etc.). Management teams have been breaking down these types of silos for decades. So why do ERM Teams so often group their risks this way? In my former CEO role, I always insisted that risks be reported alongside the objectives to which they were related. This ensured that the risks were always presented in the context of my company’s performance. In other words, the company’s objectives were the risk categories. It was a continual reminder to all stakeholders that risk management was a performance activity. Simply stated, risks that were not related to corporate objectives didn’t make the list.

This repositioning of the role of ERM has been a revelation to the more than 40 companies that I have worked with and advised over the past decade. A year ago, when I began advising a prominent Canadian CEO about risk, he conveyed a great deal of scepticism about ERM based upon the lack of value he had witnessed to date. After building this performance-focused ERM process, he describes it as, “A significant competitive advantage” for his company. I have since relabelled this methodology Performance Risk Management to help companies appreciate its focus on what matters most – ensuring every action contributes to your objectives.

$peak management's language... $

If we manage risk to help organizations achieve strategic objectives set forth by management, then risk managers should communicate to management using a similar set of metrics and language.  Too many operational risk managers use an entirely different set of measures.  Management speaks in terms of revenue, profit, and cost, while operational risk managers report likelihood, impact, and controls.  While the latter 3 metrics are important to assessing risk, you are well advised to translate risk management metrics into management's language.  Without a common set of metrics management often dismisses risk management's value to the organization - it is seen as either a "nice to have", or worse a compliance effort.

The good news is that you may not have to change your current process, but rather add a few more steps to your risk analysis and reporting.  You can also apply some practices from the credit risk world.  "Risk adjusted" performance metrics will translate your current risk reports into something that management can relate to more closely.  For example;

• Risk Adjusted Revenue (RAR) shows management what the predicted revenues are when you account for the residual financial impact of the risks you are currently managing
• Risk Adjusted Profit (RAP) shows (similarly to RAR) the relative impact to profit
• Risk Adjusted Costs (RAC) predicts costs factoring in residual operational risk impacts (not the cost of risk management, the cost of risk exposures)

When risk management teams add this perspective to their efforts, conversations with senior management will be more relevant to your audience.  The risk adjusted reports you generate will include some subjective assumptions, however you will still be engaged in a conversation about how you are helping the organization to perform better.  That's a conversation they are prepared to have.

[Rich]
richard.m.wilson@ca.pwc.com

SEC’s new rules = half the risk management story

The US Securities and Exchange Commission (SEC) recently approved “new rules to enhance the information provided to shareholders so they are better able to evaluate the leadership of public companies.” Their focus is on corporate governance, compensation, and risk. While the SEC has made progress creating transparency for governance and compensation, they are still struggling to properly reveal a company’s risk management profile.

The SEC is striving to make corporate leaders act in an ethical, accountable manner. They are effective at legislating corporate transparency, disclosure, and exposing conflicts of interest. However, regulating a company to disclose how it manages risk is trickier. Highly effective risk management identifies and manages risks that can prevent an organization from achieving its key objectives. Therefore disclosing your key risks will also disclose your strategic secrets. Publishing your detailed corporate objectives would be tantamount to competitive suicide, hence the SEC’s challenge.

The SEC’s approach as a result remains limited to revealing the board's role in the risk oversight of the company. It’s an arm’s length view of the company’s risk profile. Understanding the Board’s role in risk oversight is a long way from understanding how much risk a company is adopting or how it is addressing its risks. The SEC is now distinguishing between good ethics, and sound strategic risk management. The former is appropriately disclosable, the latter is not.

The SEC is only one oversight body who is trying to increase risk management in companies. For example, Standard and Poor’s is beginning to apply high level risk management analysis to the companies it covers. But ultimately, risk management is about ensuring corporate performance, and maintaining stakeholder confidence in your company. Don’t rely on third parties to manage public expectations about your company’s risk management program. Use your website and other corporate communications to instill confidence that you are effectively managing risk.

[Rich]
richard.m.wilson@ca.pwc.com

How to identify your hidden catastrophic risks

I was talking to a client recently about the bigger risks that could seriously harm their company.  He cited a recent example where a newly acquired small entity almost caused the parent company to be delisted from their exchange.  The acquired company refused to share some of their financial information with the parent and as a result they weren't able to file quarterly reports until the subsidiary was sold.  They came within a inch of being delisted.

Every company has hidden liabilities such as this.  Some are obvious such as having too much reliance on a single customer for revenue, or too much reliance on a single supplier for goods or services.  In other cases the problem is equally risky but not as obvious.  An effective way to get visibility on ALL of these major risks is to combine business continuity planning (BCP) with risk management.

Risk management tries to determine the likelihood of uncertain events occurring, while BCP assumes these uncertain events occur and plans alternate routes and recoveries.  During your risk identification process you will inquire about events that may prevent your company from achieving its objectives.  Try reverse engineering this process to say, "assume that this objective fails - what events could cause this to happen?".  The answers you receive will include catastrophic risks that no one assumes will happen.

For example, asking about risks related to loosing a big revenue stream may result in a limited list of risks due to optimism about how the company is operating.  However, assuming that the big revenue stream just disappeared, and asking for potential causes, will uncover new potential risks.  The optimism that blinds you to potential risk will be replaced by creative thinking about previously unconsidered risks. 

A case in point is the recent volcanic eruption in Iceland that grounded entire fleets of planes.  If you asked what risks would ground an entire fleet, volcanoes may not have been identified.  But assuming the entire fleet has just been grounded, and asking for potential reasons why, will prompt potentially uncreative people to think more broadly.

[Rich]
richard.m.wilson@ca.pwc.com

Why "What keeps you up at night?" is the wrong question

When identifying risks, the question often asked is "What keeps you up at night?". Let me explain why this is a, well... risky question to ask.

Consider that the principle goal of risk management is to ensure that an organization performs as expected.  In other words, it achieves its objectives.  Therefore the risks that you identify need to be directly related to your organizations objectives.  Risks not related to the achievement of corporate goals are off strategy - a distraction.

"What keeps you up at night?" is a disembodied question that will result in both relevant and irrelevant risks.  Here is the question to ask...

"Considering the objective to... (describe a key objective), what events may prevent the organization from achieving this objective?".

The result will be risk events that are well aligned with management's goals.  Feel free to present your interviewee with a list of potential risk internal and external risk categories to refer to when answering the question.  For example, economic, competitive, strategic, HR, financial, technology, information, and corporate integrity are some of the major categories.  There are up to 100 subcategories that fall under these major categories as well (business is complex!).

This objectives-focused question will ensure that your risk management process is strategic and focused on corporate performance.

[Rich]
richard.m.wilson@ca.pwc.com

Positioning Risk management at the C-Level

In 2010 it's not uncommon for a Board to give their management team a mandate to implement a risk management capability.  I'm seeing it more and more.  In this situation the internal or external consulting team engaged to implement the mandate will need to approach the management team in a very specific way.

Firstly, expect that the CEO or CFO may not fully understand the benefits of risk management and may interpret this as a challenge to their corporate governance.  It is important to communicate the benefits of an ongoing risk management process upfront.  Clarifying to management that this is a value sustaining or value creation activity is critical. Here are several key benefits:

• Increase the likelihood that your organization will achieve its objectives (by integrating risk management with the strategic plan)
• Lowering business volatility by increasing visibility on events that can derail your performance
• Treating risk as "neutral" so that opportunities can also be identified and pursued
• Creating a centralized view or risks and creating efficiencies in risk identification and treatment
• Closing the gap between risk management and capital allocation
• Etc...

Secondly, position it as a process, as opposed to a project.  Processes get dedicated resources, projects don't!

Thirdly, demonstrate how a well run risk management program creates a culture of accountability across the organization for identifying and managing risk.  This will result in higher product/service quality, fewer incidents, and better planning overall.

Finally, show your CEO how the market rewards companies with sound risk management practices.  Ratings agencies, capital markets, and creditors are all starting to differentiate risk-informed companies from the rest of the competition.

These are just some of the tangible benefits that you should communicate to your management team to ensure they are supportive of your risk management program.

[Rich]
richard.m.wilson@ca.pwc.com

Don't Confuse Risk Assessment with Risk Management

Let me overstate the obvious.  Risk management is about managing risk. But if it is so obvious, why do many risk management professionals focus primarily on the assessment side of the equation?

Perhaps they are treating it as a project, as opposed to implementing an ongoing process. It could result because the consulting resources engaged to help with the up front risk identification and assessment often don't participate in the follow-on risk treatments.  Or finally it could result from the challenge of harnessing the necessary internal resources to treat risks thoroughly.

Remember that all the work that leads up to the risk treatment phase, albeit important, is only providing you with business insights which you will use to prioritize your risks.  Schedule the appropriate time and resources to develop and execute your risk treatments.  Only once your risks are addressed will you derive the desired link between risk management and corporate performance.

[Rich]
richard.m.wilson@ca.pwc.com

Risk Appetite - more than just a concept

I recently met with a senior management team to establish a risk appetite statement.  It was the first time they had been through this type of exercise.  I drafted a proposed statement in advance that in 2 sentences described how much risk the company should typically take on in any transaction.  Once confirmed by management, this simple statement could be communicated to everyone in the company as another way of to heighten consistency of risk taking.

For example your a risk appetite statement for a bank could state that every transaction in the bank must follow standard procedures governed by internal controls to ensure the risk is minimized and to protect shareholder value.  Whereas a more risk-oriented company might state that to ensure aggressive growth in new markets risk-informed decisions will guide decision making to maximize return to shareholders.

At the beginning of our meeting the exercise was met with some skepticism - it felt too academic for some.  But when I asked each participant to state what the company's risk appetite on a scale of 1-5 (1 being highly risk adverse and 5 being risk accepting), their answers ranged from 1 to 4.  A 2 hour discussion followed where a great deal of consensus was created around how the company considers and manages risk.  in the end the skeptics became the greatest supporters of the process as it aligned a myriad of opposing opinions about the company's approach to risk.

In short, if management isn't aligned on how much risk to adopt and how to manage it, then the same will follow for front line management as well.  As one participant stated, "If we aren't in agreement about managing risk can you imagine how confused our employees will be?"

The simple act of drafting a risk appetite statement can be very effective in aligning everyone in the company to manage risk in a consistent manner.  Later it can tactically translate into specific risk tolerances for each area of risk.  It's simple and very effective.

[Rich]
richard.m.wilson@ca.pwc.com

The "Management" in Risk Management

Once your risks have been assessed and prioritized, how do you develop your risk treatment plan?

A company can do an excellent job of identifying and assessing risk, but ultimately, if the organization doesn’t do anything with what you’ve learned, it isn’t actually risk management yet.

There are many different ways that an organization can respond to risk. For instance you can terminate the risk area if you decide that the risk is higher than your company would prefer to tolerate.

Another response is to transfer the risk. Most commonly companies accomplish this through insurance —you pay another organization to assume their risk. Alternatively, you can contractually transfer or outsource some of those activities to a third party and have them assume both the activity and much of the risk as well.

A third response is the approach many people think of first mitigate risk. In this situation, you apply controls to lower the likelihood of the risk occurring, or lower the impact if it does occur. There are a few different ways to mitigate a risk. First, there are preventative controls which attempt to prevent the situation from happening in the first place. There are also detective controls which alert you that a risk has occurred. If the magnitude of a risk is lower, a detective control can be a fine solution if the impact of the risk is lower.

Another response is to exploit the upside of a risk by capitalizing on new opportunities. By embracing and adopting risk, a company may find that there is a larger business opportunity there than was previously considered.

A final response is to tolerate the risk as it currently exists because it fits within predefined tolerance levels. It is important that management publish within its risk management policy a statement about the company’s risk appetite. The risk tolerances should be aligned with the corporate risk appetite.

These risk treatments constitute the “management” in risk management. Engage risk owners to develop their risk treatments so that they take responsibility for the execution of them as well. Finally, make sure these treatments are reported upon to celebrate successes and ensure accountability.

[Rich]
richard.m.wilson@ca.pwc.com

Ask the people on the ground first

Over the past few years I have uncovered a terrific approach to operational risk assessments. There are a few ways in which to gather risk assessment data. The first source of good information can be gathered through online risk assessments with key process owners. This information enables you to look for risk trends across the organization. Try aggregating all of the risk scores from all departments to create a risk profile at the corporate level. Then drill down to see the risk profile of each department. Finally, segment your data by level to see how senior managers score risks versus middle management.

Once you have the broad risk assessment picture conduct an executive-level risk self-assessment (RSA) workshop. Use software, such as Resolver*Ballot, to anonymously gather the impact and likelihood scores for each risk. This risk assessment software allows you to gather that information free from the typical peer pressure and politics that naturally exist in senior level meetings since the results are anonymous.

In the executive workshop gather their first set of risk scores. Then show them how the rest of the organization scored the risks in the online risk assessment. Typically about 75% of the scores will be similar, but there are often a few surprises. If the executive team scored a risk lower than the online assessors then it tells them that they need to take it more seriously than previously expected.

The result of this two tiered assessment is a higher confidence by senior management that they understand the risk profile in the company. It also creates wider buy-in to the risk treatment phase outside of the C-suite.

[Rich]
richard.m.wilson@ca.pwc.com

Risk: It's how you word it

One of the greatest risk management challenges I have seen over the years is wording risks properly. It sounds simple enough (and it is!). So why is there such inconsistency in wording risks? The first reason is that there is no universal standard to follow. The second is that there are too many interpretations about what risk is. Finally, risk carries a negative connotation in many organizations, (sadly), so people try to describe their risks in a positive way to position them more favourably.

Well worded risks are a cornerstone to a successful risk management program. If people across your organization end up with multiple interpretations about your risks, the credibility around your risk scores will fall. Getting the wording right is pretty important.

Allow me to suggest an easy and reliable way to word your risks. To begin with, remember that a risk is an event. Secondly, it is an event that may prevent you from achieving your objectives. Therefore, the simplest way to word your risk is" X may happen". For example, "Sr. executives may leave the company", or "Production at the plant may fall by 20%", or "Interest rates may rise above 5%". All of these risks are clear, and since they are worded in the future, should not be threatening to newly emerging risk management cultures.

Follow each risk with "context bullet-points". These are the data points about the risk that people should consider. For example:

Production at the plant may fall by 20%

• our packaging supplier is in financial trouble
• our competitors are trying to hire away plant staff
• our plant wages are not competitive
• unpredictable weather patterns in that region are expected
• etc...

Here is a test to see if your current set of risks need rewording:

• Do any of your risks begin with "A lack of...", or "The inability to..."? (If so, they are describing situations within which a risk may occur and not the event itself.)
• Do any of your risks contain the words "and", or "or"? (If so, you have combined two events which will be difficult to score.)
• Are your risks worded as objectives in the positive? For example, "Retain our senior executives". It's a great objective but doesn't describe the effect of uncertainty on objectives.
• Is the risk tied to one or more objectives so that it is clear where the challenge to the organization lies?
• Do your risks have contextual data points attached to them?

Following this approach will clarify your risks and heighten the likelihood of a common interpretation. It's really that simple!

[Rich]
richard.m.wilson@ca.pwc.com