Enterprise Risk Management

A Common Framework for the Entire Organization

Philip E. J. Green

• Publisher: Butterworth-Heinemann
• Year: 2015
• Print ISBN: 9780128006337
• eBook ISBN: 9780128006764
• Topic: Commerce
• Subtopic: Stratégie commerciale

Enterprise Risk Management: A Common Framework for the Entire Organization discusses the many types of risks all businesses face. It reviews various categories of risk, including financial, cyber, health, safety and environmental, brand, supply chain, political, and strategic risks and many others. It provides a common framework and terminology for managing these risks to build an effective enterprise risk management system. This enables companies to prevent major risk events, detect them when they happen, and to respond quickly, appropriately, and resiliently. The book solves the problem of differing strategies, techniques, and terminology within an organization and between different risk specialties by presenting the core principles common to managing all types of risks, while also showing how these principles apply to physical, financial, brand, and global strategy risks. Enterprise Risk Management is ideal for executives and managers across the entire organization, providing the comprehensive understanding they need, in everyday language, to successfully navigate, manage, and mitigate the complex risks they face in today's global market.- Provides a framework on which to build an enterprise-wide system to manage risk and potential losses in business settings- Solves the problem of differing strategies, techniques, and terminology within an organization by presenting the core principles common to managing all types of risks- Offers principles which apply to physical, financial, brand, and global strategy risks- Presents useful, building block information in everyday language for both managers and risk practitioners across the entire organization

1

Introduction to Risk Management Principles

Philip E.J. Green*

This chapter defines a common process and vocabulary for managing and implementing enterprise risk management in an organization. The process is common to all types of risks and is applied in the remaining chapters of the book. This eliminates semantic differences between chapters and topics so that the reader can focus on the substantive aspects of each type of risk and how it relates to other types of risk and enterprise risk management as a whole. The main elements of the process are establishing the context for risk management, risk assessment, risk treatment, risk monitoring, and risk review. Reasoning about probability, probabilistic reasoning, uncertainty, and likelihood, as well as the challenges of “measuring” risk, are also covered.

Keywords

risk management; risk assessment; risk mitigation; enterprise risk management; ISO 31000; probability; uncertainty; key risk indicators

Ultimately it is the business manager, not the risk specialist, who is responsible when things go wrong. The challenge the manager faces is that the many fields of risk management are dominated by specialists and jargon. The insurance broker, the safety manager, the cybersecurity specialist, the financial risk manager, and the engineer all use different language to describe risk. Even within each specialty there are variations in the way language is used, making it hard for a generalist to distinguish between what is particular about risk management in one field versus another—say, cybersecurity versus safety—and what is common, and thus what should be done by the specialist and by the generalist.

Another challenge is the seemingly infinite variety of risk management processes. If you search the Internet for “risk management process,” you will quickly see the wide variety of approaches favored by different consultants and experts. There are four-, five-, six-, and nine-step risk management processes. There are risk management cycles, flowcharts, pyramids, and decision trees. There is obviously value in the creativity of the human mind applied to risk. But there is also value in simplification and standardization.

This book aims to equip the reader to effectively manage an organization’s risks, to provide the reader with a common vocabulary and process for managing all types of risk and to provide insights into each of the particularities of several critical types of risk. The idea is to help readers focus on the substantive aspects of several risk specialties, rather than on the semantic and procedural.

This chapter sets out a vocabulary and risk management process common to the remaining chapters of the book (terms commonly used throughout the book are underlined in this chapter). All the authors have contributed to this chapter. In their own chapters, they have applied its concepts to their specific field of risk management. The terminology and the risk management process we have adopted for the book are inspired from an international risk management standard.¹ This book is respectful toward, but does not take a position on, that standard; nor does it blindly adhere to it. We do not claim that the words and the risk management process are novel. But what is novel is our use of them as a common approach applicable to the entire enterprise as well as to multiple types of risk—hence the title. This book cannot cover all types of risk that an enterprise faces. By showing that different experts use a similar thought process and language, but employed from different viewpoints, I hope that the common approach will be clear to readers, allowing them to extend principles covered in this and the other chapters to specialties not covered herein.

The idea of a risk specialty is somewhat fluid. A single event may have multiple consequences; sometimes they can escalate or cascade in a ripple effect. These consequences may even affect areas of the business considered to be under the domain of different risk specialties. For example, a pipeline spill may injure employees or the public (health and safety risk), kill fish and pollute a river (environment and sustainability risk), shut down operations (operational risk), harm a pipeline company’s brand or reputation (brand risk), disrupt supply chains (supply chain risk), increase insurance premiums and cost billions to clean up, causing share prices to drop (financial risk), change the political context in which the pipeline company is hoping to gain approval for a new pipeline (political risk), and disrupt the company’s growth strategy (strategic risk). Complicating matters, specialists often view risks through their own lenses: The safety manager might classify a pipeline spill as a safety risk, the marketing executive as a brand risk, and the loss control manager as a financial risk, and so on, all dealing with the risk with their own specialty’s tools and jargon. It is much better to have a common approach and an enterprise-wide risk management system.

What is Risk?

What is risk? The word contains two key ideas: uncertainty and outcomes. In common usage, people associate risk with negative outcomes more than with positive ones, but usually both are present. The idea of outcomes can be broadened to think of goals or objectives. A jaywalker may have two objectives: to save time instead of waiting for a green traffic light, and to cross the street without being hit by a car. There is uncertainty about whether he can jaywalk and meet those objectives. The first objective relates to a positive outcome (saved time), the second to a negative outcome (injury).

Risk can thus be thought of as the effect of uncertainty on objectives. This book expresses risk as the consequences of an event, such as being hit by a car while jaywalking, and the associated likelihood of that event.

There are several ways that people commonly use the word risk. Some use it to refer to the likelihood of an event’s happening, others to the consequences if it does happen. For example, when someone states that California has greater earthquake risk than New York, he or she could be saying that earthquakes are more likely in California. Or when someone states that XYZ Corp has greater risk, should a cyberattack occur, than another company does, he or she could mean that XYZ Corp would have a greater loss if a cyberattack were to occur. In fact, risk deals with both likelihood and consequences. People also commonly use the term risk to refer to unpredictability or variability in outcomes. For example, financial analysts will say that a high-tech stock has greater risk than a utility stock because the returns on the high-tech stock have greater variability or are thus more difficult to predict. In other words, there is greater uncertainty over the desired outcome of a return on the investment.

What is enterprise risk management? Enterprise risk management is a system in which managers are concerned with managing the risks of the entire enterprise. In a more traditional approach various specialists focus on specific or “pure” risks, which are not aggregated to provide a view of the risk the enterprise faces.

What is risk management? Risk management is the coordinated set of principles, processes, activities, roles and responsibilities, and infrastructure, combined into a system and used to control the actions of an organization in light of the risks it faces.

Enterprise risk management applies many of the fundamental principles of management; indeed, it is an integral part of management. The contributors to this book have emphasized these principles from different viewpoints, but two receive special attention: communication and accountability (or responsibility). The authors look at these issues through the perspective of their own risk specialty, but taken together, they provide useful insights that are applicable to other types of risk. For example, Chapter 5 discusses operational risk and describes a top-to-bottom communication process (illustrated by Figure 5–2 of that chapter) that melds nicely with the process described in Chapter 9 regarding the portfolio method of aggregating risks. A challenge with the portfolio risk approach is communication of the risks that should be included in the portfolio. It also melds nicely with the approach in Chapter 2 regarding internal communication processes of environmental risks. The principles outlined in these chapters apply to many other areas.

To manage the risks of the entire enterprise suggests that some individual, perhaps a chief risk officer or a group reporting to him or her, knows the risks of the entire enterprise. But this is impractical and bureaucratic. Or perhaps people on the top of the organization should manage the small number of large risks and the people on the bottom the large number of small risks. This has appeal, but because a small mishap, indiscretion, or malevolent act by a single employee can in some cases cause disaster for the entire enterprise, the top cannot just leave it up the bottom to deal with risk unsupervised.

The solution that emerges from the contributors is that communications is a mix. Top management must use its communications to set tone, direction, and policy for the enterprise in relation to risk. It should provide training about the risks the enterprise faces and how to manage them. It must seek out information to determine whether risks, big or small, are being managed systematically throughout the enterprise. And it must ensure that people know when to communicate significant risks they have identified to the top so that they can be aggregated and managed in an enterprise risk “portfolio.” These ideas are brought together in Chapter 13, on risk culture.

The contributors have addressed the issue of accountability and employee involvement by examining several questions: What should be done by people dedicated to risk management? What should be done by line management as part of regular responsibilities? What is the responsibility of top management? What are the responsibilities of the line organization? How should employees be involved? What should they be responsible for? Chapter 14 discusses the role of the board of directors in risk management and, in particular, whether there should be a dedicated risk committee. Chapter 2, on environmental risks, describes how this split in responsibilities between line and staff environmental experts changes with context. Chapter 3, on health and safety risk, graphically describes the responsibilities of management and employees for safety. Chapter 6, on cybersecurity, describes how all employees should be aware of their responsibilities for cybersecurity. Chapter 7, on brand risk, describes how, in a viral world, to embed a brand risk intelligence mindset across the entire organization—in other words, it addresses the central problem of getting everyone involved in managing the risks over which they have some influence.

Risk Context

Risk changes with context. It may help to think of context in terms of external context and internal context. The external context includes business, infrastructural, economic, social, cultural, and political context and the trends affecting—or that could affect—the organization. In the case of a jaywalker, it includes such things as the volume of traffic and the weather. The internal context includes the organization’s culture, processes, structure, strategy, policies and objectives, and methods. A jaywalker rushing to a hospital where his daughter is undergoing emergency surgery has a very different internal context than one who is trying to avoid a ten-minute wait for the next bus. Both share the objective of trying to save time, but understanding the context is vital to understanding the criteria they use to evaluate risk.

Part of internal context is risk tolerance...

Table of contents

• Cover image
• Title page
• Table of Contents
• Copyright
• Dedication
• Author Biographies
• 1. Introduction to Risk Management Principles
• Part I: Physical Risk Management
• Part II: Intangible Risk
• Part III: Financial Risk Management
• Part IV: Global and Strategic Risk
• Index