Enterprise Risk Management

A Methodology for Achieving Strategic Objectives

Gregory Monahan

• Publisher: Wiley
• Year: 2008
• Print ISBN: 9780470372333
• eBook ISBN: 9780470447468
• Edition: 1
• Topic: Business
• Subtopic: Decision Making
• Index: Business

Written for enterprise risk management (ERM) practitioners who recognize ERM?s value to their organization, Enterprise Risk Management: A Methodology for Achieving Strategic Objectives thoroughly examines operational risk management and allows you to leverage ERM methodology in your organization by putting author and ERM authority Gregory Monahan's Strategic Objectives At Risk (SOAR) methodology to work. A must-read for anyone interested in risk management as a strategic, value-adding tool, this no-nonsense book shows you how to use ERM and SOAR to empower your company to go from stuck to competitive.

CHAPTER 1

Defining Enterprise Risk Management

Atrusted colleague and friend advised me that I should not begin with a definition of the term "enterprise risk management.” After much deliberation, I have decided to include my definition, because I feel it is imperative that you and I share a common understanding of what I am writing about in this book. If you accept my definition, then you can consider everything else I espouse within the context of this definition. If you prefer some other definition, you probably should consider whether the other things I say need to be adjusted for your preferred definition. That said, and with respect and thanks to my friend for his advice, I begin with definitions gleaned from Merriam-Webster’s Eleventh Collegiate Dictionary of each of the words in the phrase:

Enterprise A unit of economic organization or activity; especially: a business organization

Let us proceed on the basis that an enterprise is a group of legal vehicles, divisions, business units, and so forth that make up an organization. I like the term "organization,” because it seems to carry less connotation about the nature of the organization than, say, "company” or "business.” In my view, "organization” carries no connotation of size, operation, or objective; it could just as easily be a local symphony orchestra as it could be the U.S. Federal Reserve or Barclays PLC. So an "enterprise” is an organization.

Risk Someone or something that creates or suggests a hazard

Here we need to move away from the dictionary definition (with all due respect) and consider a more professional, as opposed to casual, definition. What we are really talking about is variability; that is, risk is anything that produces a distribution of various outcomes of various probabilities. From here on think of "risk” as meaning "uncertainty,” and imagine that we can represent that uncertainty as a distribution of possible outcomes of varying probabilities. I know we cannot always do that with a great deal of certainty or ease, and I am not suggesting we need to be able to. I am hoping that each time you read the word "risk” you will visualize a distribution of outcomes and associated probabilities. It might look like a typical normal (bell-shaped) distribution, or it might not; it does not matter.

In addition to defining risk, we need to consider those things that go hand in hand with risk. The SOAR (Strategic Objectives At Risk) methodology views risk in this context: Risk thrives on risk drivers or causes and manifests itself in events that have consequences (or outcomes). Let me repeat as this is an absolutely vital element to our definition of risk: Risk manifests itself in events that have consequences. Once you recognize that you are faced with a particular risk, you have to accept the fact that an event can happen and that it will have consequences. The SOAR methodology defines a process that (1) enables you to determine whether to take the risk and (2) prepares you for the consequence of an event. The other element in the risk universe is risk mitigation, or controls. The risk universe can be viewed in Exhibit 1.1.

EXHIBIT 1.1 RISK UNIVERSE

In the exhibit, you can see what you often hear—for example, you might hear someone talk about:

• The risk of being hit by a car (being hit by a car is an event.)

• The risk of serious injury (serious injury is an outcome.)

From an organizational point of view:

• In key man risk, the event is someone of perceived importance leaving.

• In the risk associated with entering new markets, an event might be failure to adhere to local regulations.

I do not want to focus on the definition of risk, but I feel it necessary to comment on the definition of "risk” offered by Deloitte in "The Risk Intelligent Enterprise”:

Risk is the potential for loss caused by an event (or series of events) that can adversely affect the achievement of a company’s objectives.¹

Despite the fact that the definition recognizes only losses and adverse effects, Deloitte then goes on to say:

The Risk Intelligent Enterprise views risk not just as vulnerability to the downside, but also preparedness for the upside.

I ask you this: Why would anyone who accepts the Deloitte definition of "risk” be prepared for upside? Consider also this definition: "The key is not to predict the future, but to be prepared for it.”² The author, Pericles, fails to address the obvious question: "Prepare for what?”

It is sometimes difficult to articulate certain risks. The best way to get around this problem is to use the type of language employed in the examples given earlier. Let us say you are building a tunnel for a road under an existing structure (e.g., a city), and someone asks you to identify the risks you face. Do you say something like "tunneling risk”? Or "inaccurate measurement risk”? These are not very helpful responses. A more meaningful answer might be something like: "We might do something wrong that causes the tunnel to collapse and the stuff on top falls in, destroying buildings and killing people.” Without really giving any definition of or name to the "risk,” you have clearly articulated a driver (do something wrong), a possible event (collapse of the tunnel), and a couple of outcomes: Buildings collapse and people die. The truth is, it does not really matter what you call the risk, or even whether you can clearly articulate it. However, it is absolutely essential that you are able very clearly to define those things around the risk: the drivers, the controls, the possible events, and the possible outcomes.

Let us work backward through the risk paradigm starting with one of our strategic objectives as the desired outcome. In this case, the outcome we seek (or objective we aim to achieve) is to be recognized as the country’s best employer. Let us imagine that our distribution of possible outcomes includes us being rated as the worst, the best, or something in between. For ease, we will limit the outcomes to best, good, middle of the pack, poor, and worst. Our role, as enterprise risk management officers, is to manage a process that will provide the people responsible for the outcome (s) the best chance of achieving their desired outcome(s). The focus of that process must be on those elements that can influence the outcomes. From Exhibit 1.1, we can see that the elements that influence outcomes are (working backward from right to left):

• Events

• Risks

• Risk drivers

• Controls

Risks

I have defined "risk” as meaning "uncertainty,” and I have proposed that the presence of risk (uncertainty) is evident in the distribution of possible outcomes. I think it is easy to fall into the trap of spending way too long trying to determine a clear definition of each risk associated with an objective. Take, for example, the case where your objective is to increase total revenues by at least 10% over the next year. You could, quite simply, summarize all of the risks you face as "the probability that we do not increase total revenues by 10% over the next year.” Is that sufficient for application of the SOAR process? Absolutely.

In truth, I have included "risks” in my view of the risk universe only because I thought everyone would expect to see it there and that great numbers of readers would rebel if I did not include it. For the application of the SOAR process, I advocate that risks be stated as in the previous example (i.e., the one about increasing total revenues), for three reasons:

1. By simply defining risk as the probability of not obtaining your objective, you maintain your focus on the fundamental concept of the SOAR methodology: You face a distribution of possible outcomes of varying reward and probability.

2. You do not waste time debating possible (and completely academic) definitions of the risks you face.

3. You have a much higher likelihood of identifying all of the possible influential factors—namely drivers and controls—and this is where your focus should be.

Risk Drivers

Risk drivers and controls are factors that influence the outcome. I distinguish between them as follows: Risk drivers are factors that increase uncertainty while controls are factors that are intended to reduce uncertainty or help soften the blow of an adverse outcome. It is useful to think of drivers and controls in terms of their impact on the distribution of possible outcomes. Take the case where there are no risk drivers; that is, the outcome is certain. In this case, the (certain) outcome could be represented as a single value on a graph (see Exhibit 1.2).

EXHIBIT 1.2 CERTAIN OUTCOME

In the presence of risk drivers, the distribution of possible outcomes might look something like Exhibit 1.3.

EXHIBIT 1.3 SIMPLE DISTRIBUTION OF OUTCOMES

Without any form of analysis whatsoever, let us assume that the greater the number of risk drivers, the greater the number of possible outcomes and that increasing the number of risk drivers flattens and broadens the distribution. This (assumed) effect can be seen in Exhibit 1.4.

EXHIBIT 1.4 DISTRIBUTIONS OF OUTCOMES INFLUENCED BY A DIFFERENT NUMBER OF RISK DRIVERS

The fact is, of course, that our assumption is not always true. It will not always be the case that more risk drivers leads to a flattening and broadening of the distribution of possible outcomes. Furthermore, a single driver of risk A may produce a different distribution of possible outcomes than a single driver of risk B; the driver of risk A may produce something like the tall, thin distribution in Exhibit 1.4 while the driver of risk B may produce the shorter, wider distribution. Which would you rather face?

Controls

As discussed earlier, risk drivers and controls are factors that influence the outcome. I stated that controls are intended to reduce uncertainty or soften the blow. The term "intended” is used for a reason—to highlight the fact that controls are created with thought, as opposed to drivers, which simply exist. In addition, the term "intended” implies that the reality may differ from the idea; that is a control may not have the intended effect.

Similar to the difference between distributions of outcomes influenced by few risk drivers and those influenced by many risk drivers, distributions influenced by controls should be taller and narrower than distributions not influenced by controls. That is really the primary responsibility of the enterprise risk management office—to raise and narrow the distribution (of possible outcomes) around the desired outcome. The identification and application of controls is the most critical element of the SOAR process and the main reason for the enterprise risk management office to exist. Controls do not always soften the blow; often they are designed to avoid the hit altogether. In language more suitable to the context, controls are measures that are put in place to reduce the probability or severity of an adverse outcome. It is unusual for a control to be designed to reduce both frequency and severity. The brakes on a car are a good example of a control that reduces both frequency and severity. If you did not have brakes, you can be pretty sure you would crash more frequently than if you did have brakes. If you had an accident without braking, you can be pretty sure the damage would be worse than if you had braked. An airbag, however, can reduce the severity, but it is not intended to address the likelihood of an accident. A quick word of caution on the use of controls: Be careful they do not incite recklessness. To continue the car theme a moment, have you ever been in a car when the driver has said something like "strap in” as he accelerates? The implication is that the driver thinks he can take more risk if the control is in place. In the context of application of the SOAR process, there is probably little to...

Table of contents

• Title Page
• Copyright Page
• Wiley & SAS Business Series
• Dedication
• Preface
• Acknowledgements
• Introduction
• CHAPTER 1 - Defining Enterprise Risk Management
• CHAPTER 2 - Strategic Objectives
• CHAPTER 3 - At-Risk Concept
• CHAPTER 4 - SOAR (the Methodology): Strategic Objectives at Risk
• CHAPTER 5 - SOAR (the Process)
• CHAPTER 6 - Set Metrics for Defined Strategic Objectives
• CHAPTER 7 - Observe Metric Values
• CHAPTER 8 - Analyze Movements in Metrics
• CHAPTER 9 - React to the Metric Analysis
• CHAPTER 10 - SOAR Dashboard
• CHAPTER 11 - Existing Enterprise Risk Management Approaches
• CHAPTER 12 - Regulation and Compliance
• CHAPTER 13 - Application of the Concept of “Shifting the Distribution”
• CHAPTER 14 - Implementing the SOAR Methodology
• CHAPTER 15 - SOAR in Action Example
• Conclusion
• APPENDIX - SOAR Methodology FAQ
• Resources
• Index