Enterprise Risk Management

Today's Leading Research and Best Practices for Tomorrow's Executives

John R. S. Fraser, Rob Quail, Betty Simkins, John R. S. Fraser, Rob Quail, Betty Simkins

• Publisher: Wiley
• Year: 2021
• ISBN:
  9781119741459
• Edition: 2
• Topic: Business
• Subtopic: Finance
• Index: Business

Unlock the incredible potential of enterprise risk management

There has been much evolution in terms of ERM best practices, experience, and standardsandregulation over the past decade. Enterprise Risk Management: Today's Leading Research and Best Practices for Tomorrow's Executives, Second Edition isthe revised and updated essential guide to the now immensely popular topic ofenterpriserisk management(ERM).With contributions fromleading academics and practitioners, this book offersinsights into what practitioners are doingandwhatthe future holds. You'll discoverhow you canimplement best practices, improve ERM tools and techniques, and even learn to teach ERM.Retaining the holistic approach to ERM that made the first edition such a success, this new edition adds coverage of new topics including cybersecurityrisk, ERM in government, foreignexchangerisk, risk appetite, innovation risk, outsourcing risk, scenario planning, climate change risk, and much more.In addition, the new edition includes important updates and enhancements to topics covered in the first edition; so much of it has been revised and enhanced that it is essentiallyan entirelynew book.

Enterprise Risk Management introduces you to the concepts and techniquesthat allow you toidentifyrisks and prioritize the appropriate responses. This invaluable guide offers a broad overview, covering key issueswhile focusing on the principles thatdrive effectivedecision making anddeterminebusiness success. This comprehensive resource alsoprovides a thorough introduction toERMas it relates to credit, market, and operational risk, as well as the evolving requirements ofthe board of directors' role in overseeing ERM.

Through the comprehensive chapters and leading research and best practices covered, this book:

• Provides a holistic overview of key topics in ERM, includingthe role of the chief risk officer, development and use ofkeyrisk indicatorsandtherisk-basedallocation of resources
• Contains second-edition updates covering additional material related to teaching ERM, risk frameworks, risk culture, credit and market risk, risk workshops and risk profilesand much more. Over 90% of the content from the first edition has been revised or enhanced
• Reveals how you can prudently apply ERMbestpracticeswithin the context of your underlying business activities

Filled with helpfulexamples, tables, andillustrations, Enterprise Risk Management, Second Edition offers a wealth of knowledge on the drivers, the techniques, the benefits, as well as the pitfalls to avoid, in successfully implementingERM.

PART I
Overview and Drivers of Enterprise Risk Management

CHAPTER 1
Enterprise Risk Management: An Introduction and Overview

JOHN R.S. FRASER, FCPA, FCA

Former Chief Risk Officer, Hydro One Networks Inc.

ROB QUAIL, BASc

Principal, Robert Quail Consulting

BETTY J. SIMKINS, PhD

Department Head of Finance, Regents Professor of Finance, and Williams Companies Chair of Business, Spears School of Business at Oklahoma State University

It's not the strongest of the species that survives, nor the most intelligent, but those that are the most responsive to change.

—Often attributed to Charles Darwin, British naturalist

Prediction is very difficult, especially if it's about the future.

—Niels Bohr, 1922 Nobel Laureate in Physics

WHAT IS ENTERPRISE RISK MANAGEMENT?

We begin this chapter and the book with the above two quotes to highlight the importance of organizations being able to adapt to change and to being prepared for the uncertain future. We believe this book is crucial to organizations being ready for change, survival, and success and would like to see more organizations adopt enterprise risk management (ERM). ERM is about preparing the organization to survive and thrive in the future, as the Charles Darwin quote implies about living organisms, and we extend to our context. We believe that the organizations that are successful are the ones that are best able to adapt and adjust to the changing world they find themselves. History has shown this for both species and organizations. The Niels Bohr quote reminds us how difficult it is to predict the future. ERM prepares us for this!

In 2017, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) defined enterprise risk management as: “The culture, capabilities, and practices, integrated with strategy-setting and performance, that organizations rely on to manage risk in creating, preserving, and realizing value.” This COSO definition is intentionally broad and deals with risks and opportunities affecting value creation or preservation. Similarly, in this book, we take a broad view of ERM, or what we call—a holistic approach to ERM.

The purpose of ERM is not only to minimize risk exposure. It is to assist in finding the ideal level of risk for an organization to take in order to maximize opportunity. As in the past, many organizations continue to address risk in “silos,” with the management of insurance, foreign exchange, operations, credit, and commodities each conducted as narrowly focused and fragmented activities. Under ERM, all risk areas function as parts of an integrated, strategic, and enterprise-wide system. And while risk management is coordinated with senior-level oversight, employees at all levels of the organization are encouraged to view risk management as an integral and ongoing part of their jobs.

The purpose of this book is to provide a blend of academic and practical experience on ERM in order to educate practitioners, academics, and students alike about this evolving discipline. The leading experts in this field clearly explain what enterprise risk management is and how you can teach, learn, or implement these leading practices within the context of your business activities. Furthermore, our goal is to provide a holistic coverage of ERM, and, in this process, provide the what, why, and how of ERM to assist firms with the successful implementation. Our companion volume, Implementing Enterprise Risk Management: Case Studies and Best Practices (2015), consists of numerous case study examples of how companies have actually implemented ERM in their organizations.

We believe that the implementation of ERM is not a one-size-fits-all exercise. Effective ERM implementations can include a broad range of activities, tools, and processes. Prudent practitioners will select and adapt common ERM practices to suit the culture, structure, and role of risk in value creation for their organization. Enterprise Risk Management introduces you to the wide range of concepts and techniques for managing risk in a holistic way, by correctly identifying risks and prioritizing the appropriate responses. It offers a broad overview of the different types of techniques: the role of the board, risk appetite, risk profiles, risk workshops, and the allocation of resources, while focusing on the principles that determine business success. This comprehensive resource also provides a thorough introduction to ERM as it relates to numerous specific risks such as credit, market, operational, climate change, cybersecurity, foreign exchange, and project management risks. As well, it offers a wealth of knowledge on the drivers, the techniques, the benefits, and the pitfalls to avoid in successfully implementing ERM.

DRIVERS OF ENTERPRISE RISK MANAGEMENT

There are theoretical and practical arguments for the use of ERM. As outlined in Chapter 2, “A Brief History of Risk Management,” and Chapter 39, “A Review of Academic Research on Enterprise Risk Management,” there has been an increasing consciousness in risk literature that a more holistic approach to managing risk makes good business sense.

External drivers for ERM's implementation have been studied, such as the Joint Australian/New Zealand Standard for Risk Management,¹ the Committee of Sponsoring Organizations of the Treadway Commission (COSO),² the Group of Thirty Report in the United States (following derivatives disasters in the early 1990s),³ CoCo (the Criteria of Control model developed by the Canadian Institute of Chartered Accountants),⁴ the Toronto Stock Exchange Dey Report in Canada following major bankruptcies,⁵ and the Cadbury report in the United Kingdom.⁶

Major legal developments such as the New York Stock Exchange Listing Standards and the interpretation of the Delaware case law on fiduciary duties, among others, have provided an additional force for ERM.⁷ In addition, large pension funds have become more vocal about the need for improved corporate governance, including risk management, and have stated their willingness to pay premiums for stocks of firms with strong independent board governance. ERM has also increased in importance due to the Sarbanes-Oxley Act of 2002,which places greater responsibility on the board of directors to understand and monitor an organization's risks.

For more information on the latest additions to regulatory requirements and recommendations for improved risk governance, please refer to Chapters 2 for highlights and to Chapter 6, “The Role of the Board in Risk Management Oversight,” for more details on the changes.

Finally, it is important to note that ERM can increase firm value.⁸ Security rating agencies such as Moody's and Standard & Poor's include whether a company has an ERM system as a factor in their ratings methodology for insurance, banking, and...