Paul Hopkin. Fundamentals of Risk Management

Подождите немного. Документ загружается.

224 Risk response

provide practical examples of the control of selected hazard risks, including risks to •

ﬁ nances, infrastructure, reputation and marketplace;

describe the importance of insurance and the circumstances in which insurance is pur- •

chased, including the involvement of a captive insurance company;

explain the importance to the insurance purchasing process of cost, coverage, capacity, •

capabilities, claims and compliance.

Part 5 Further reading

Association of Insurance and Risk Managers (2006) Insurance Buyers Guide, www.airmic.com.

COSO Enterprise Risk Management – Integrated Framework (2004) Executive Summary, www.coso.org.

HM Treasury (2004) Orange Book: Management of Risk – Principles and concepts, www.hm-treasury.gov.uk.

Vance and Makomaski (2007) Enterprise Risk Management for Dummies, Wiley Publishing,

www.wiley.com.

Enterprise risk management

Enterprise-wide approach

In the past few years, there have been important developments in the practice of risk man-

agement. Firstly, there has been the development of specialist branches of risk management,

including project, energy, ﬁ nance, operational risk and clinical risk management. Secondly,

organizations have embraced the desire to take a broader approach to the practice of risk

management.

Various terms have been used to describe this broader approach, including holistic, integrated,

strategic and enterprise-wide risk management. It is the term enterprise or enterprise-wide

risk management (ERM) that is now the most widely used and generally accepted terminology

for this broader approach. The fundamental idea behind the ERM approach is to move away

from the practice of risk management as the separate management of individual risks.

ERM takes a unifying, broader and more integrated approach. The ERM approach means that

an organization looks at all the risks that it faces across all of the operations that it undertakes.

ERM is concerned with the management of the risks that can impact the objectives, key

dependencies or core processes of the organization. Also, ERM is concerned with the manage-

ment of opportunities, as well as the management of control and hazard risks.

There has also been consideration of the fact that many risks are interrelated and that tradi-

tional risk management fails to address the relationship between risks. With the ERM approach,

the relationship between risks is identiﬁ ed by the fact that two or more risks can have an

impact on the same activity or objective. The ERM approach is based on looking at the objec-

tive, key dependency or core process and evaluating all of the risks that could impact the item

being evaluated.

An example of the ERM approach is to consider a sports club where the core process is to

maximize attendance at games. This process is made up of several activities, including market-

ing, advertising, allocation and sale of tickets as well as logistical arrangements to ensure that

225

226 Risk response

the experience at the game is as good as possible. Part of maximizing attendance at games will

be to ensure there are adequate parking and transport arrangements, together with suitable

catering and other welfare arrangements in the ground.

By identifying the key activities that deliver the selected core process, the club is able to identify

the risks that could impact both these activities and the core process. Targets can then be set for

increased attendance at future games and responsibility for the success of this core process has

been allocated to the Commercial Director of the club. A consideration of the opportunities for

increasing attendance at games can also be included in this broader approach.

Deﬁ nitions of ERM

Table 25.1 presents a number of suggested deﬁ nitions of enterprise risk management. There

are three components that are required in a comprehensive deﬁ nition of ERM. These are: 1)

the description of the process that underpins enterprise risk management; 2) identiﬁ cation of

the outputs of that process; and 3) the impact (or beneﬁ t) that arises from those outputs.

Table 25.1 Deﬁ nitions of enterprise risk management

Organization Deﬁ nition of enterprise risk management

BS 31100 Enterprise risk management is the approach to managing all of an

organization’s key business risks and opportunities with the intention of

maximizing stakeholder value.

ACT

(Association of

Corporate

Treasurers)

Enterprise risk management is designed to enhance corporate decision-

making with tools being developed and implemented to support actions

ranging from optimization of the insurance programme to analysis of

overseas expansion plans, business mix or capital allocation.

COSO

ICAEW

(Institute of

Chartered

Accountants in

England and

Wales)

Enterprise risk management is a process, effected by an entity’s board of

directors, management and other personnel, applied in strategy setting

and across the enterprise, designed to identify potential events that may

affect the entity, manage risk to be within its risk appetite and to provide

reasonable assurance regarding the achievement of entity objectives.

IIA (Institute of

Internal

Auditors)

A rigorous and co-ordinated approach to assessing and responding to all

risks that affect the achievement of an organization’s strategic and

ﬁ nancial

objectives.

HM Treasury

All the processes involved in identifying, assessing and judging risks,

assigning ownership, taking actions to mitigate or anticipate them and

monitoring and reviewing progress.

Enterprise risk management 227

Many of the deﬁ nitions concentrate on the process by describing the activities that make up

the ERM approach. This is a good starting point, but the outputs from that process are more

important than the process itself. Some of the deﬁ nitions do include reference to the outputs

from the process, such as being able to manage risks within the risk appetite of the organiza-

tion and provide reasonable assurance regarding the achievement of objectives.

To be comprehensive, however, the deﬁ nition must also consider the intended impact of those

outputs. In summary, the intended outputs from ERM are that better decisions will be taken,

correct processes will be identiﬁ ed and introduced, possibly by way of projects, and operations

will be efﬁ cient and free from unplanned disruption. This list of outputs can be described as

compliance, assurance, decisions and efﬁ ciency/effectiveness/efﬁ cacy (CADE3).

The following is offered by way of a comprehensive deﬁ nition of ERM:

ERM involves the identiﬁ cation and evaluation of signiﬁ cant risks, assignment of own- •

ership, completion and monitoring of mitigating actions to manage these risks within

the risk appetite of the organization.

The outputs are the provision of information to management to improve business •

decisions, reduce uncertainty and provide reasonable assurance regarding the achieve-

ment of the objectives of the organization.

The impact of ERM is to improve efﬁ

ciency and the delivery of services, improve allo- •

cation of resources (capital) to business improvement, create shareholder value and

enhance risk reporting to stakeholders.

ERM in practice

The developing role of the risk manager has been discussed in Chapter 9. It was mentioned

that the seniority of the risk manager should be proportionate to the risks that the organiza-

tion faces. For many organizations, including those in ﬁ nance and energy, a board-level risk

manager is often appropriate.

Where it is appropriate and proportionate, the risk manager at board level is often referred to

as a chief risk ofﬁ cer (CRO). To date, these appointments have been almost exclusively in the

energy and ﬁ nance sectors, although this may change as ERM becomes more clearly estab-

lished in a wider range of organizations.

The seniority of the CRO is just one example of how ERM should be achieved in practice. The

principles of risk management set out as PACED are fully applicable to the practice of enter-

prise risk management. The principles of risk management are that it should be proportion-

ate, aligned, comprehensive, embedded and dynamic (PACED).

228 Risk response

By taking a comprehensive approach to enterprise risk management, a wide range of beneﬁ ts

can be delivered and these are set out in Table 25.2. It is for each organization to decide how

the enterprise risk management initiative will be structured and how these beneﬁ ts will be

achieved.

The key feature of ERM is that the full range of signiﬁ cant risks facing the organization is eval-

uated. The interrelationship between risks should be identiﬁ ed, so that the total risk exposure

of the organization may be compiled. Having measured the total risk exposure of the organi-

zation, that level of risk exposure can then be compared with the risk appetite of the board and

the risk capacity of the organization itself.

Table 25.2 Beneﬁ ts of enterprise risk management

FIRM risk scorecard Beneﬁ ts

Financial Reduced cost of funding and capital

•

Better control of CapEx approvals •

Increased proﬁ tability for organization •

Accurate ﬁ nancial risk reporting •

Enhanced corporate governance •

Infrastructure Efﬁ ciency and competitive advantage •

Achievement of the state of no disruption •

Improved supplier and staff morale •

Targeted risk and cost reduction •

Reduced operating costs •

Reputational Regulators satisﬁ ed •

Improved utilization of company brand •

Enhanced shareholder value •

Good reputation and publicity •

Improved perception of organization •

Marketplace Commercial opportunities maximized •

Better marketplace presence •

Increased customer spend (and satisfaction) •

Higher ratio of business successes •

Lower ratio of business disasters •

Enterprise risk management 229

ERM and business continuity

There is an important relationship between enterprise risk management (ERM) and business

continuity management (BCM). The risk assessment that is required as part of the risk man-

agement process and the business impact analysis that is the basis of business continuity plan-

ning (BCP) are closely related.

The normal approach to risk management is to evaluate objectives and identify the individual

risks that could impact these objectives. The output from a business impact analysis is the

identiﬁ cation of the critical activities that must be maintained for the organization to continue

to function.

Based on the deﬁ nition of enterprise risk management set out above and the fact that enter-

prise risk management should be applied to the evaluation of core processes, it can be seen

that the ERM approach and the business impact analysis approach are very similar, because

both approaches are based on the identiﬁ cation of the key dependencies and functions that

must be in place for the continuity and success of the business.

The next stage in the process differs between ERM and BCP, because the former is concerned

with the management of the risks that could impact processes, whereas business continuity is

concerned with actions that should be taken to maintain the continuity of individual activi-

ties. The business continuity approach, therefore, has the very speciﬁ c function of identifying

actions that should be taken after the risk has materialized in order to minimize its impact.

Business continuity planning relates to the damage-limitation and cost-containment compo-

nents of the loss control, as described earlier.

ERM in energy and ﬁ nance

Risk management in the energy and ﬁ nance sectors has become a well-developed specialist

branch of the discipline. In the ﬁ nance sector, the objective of an ERM initiative is to enhance

shareholder value by:

improving capital and efﬁ ciency by providing an objective basis for allocating resources •

and exploiting natural hedges and portfolio effects;

supporting ﬁ

nancial decision making by considering areas of high potential adverse •

impact and by exploiting areas of risk-based advantage;

building investor conﬁ

dence by stabilizing results and protecting them from distur- •

bances and thus demonstrating proactive risk stewardship.

ERM in the energy sector is often dependent on the treasury function and the specialist exper-

tise of hedging against the price of a barrel of oil. This area of ﬁ

nancial risk management has

230 Risk response

become well established, with very large departments being set up in many energy companies.

However, the practice of ERM in energy companies still remains very closely related to the

management of treasury risks.

One of the drivers for risk management in the ﬁ nance sector is the regulatory environment.

Banks have been subjected to Basel II for some time, and the insurance sector in Europe is

about to be subjected to similar requirements set out in the Solvency II Directive. This gives

rise to the obligation on ﬁ nancial institutions to measure their exposure to operational risk.

The output of operational risk management (ORM) activities in ﬁ nancial institutions is the

ability to calculate the capital that should be held in reserve to cover the consequences of the

identiﬁ ed risks materializing. The impact of these ORM activities is that risks will be better

identiﬁ ed and managed, so that the capital required to meet the consequences of the risks

materializing is lowered. ORM within ﬁ nancial institutions can be seen as a particular applica-

tion of the ERM approach.

The failure of the world banking system called into question the effectiveness of risk manage-

ment activities in banks and, in particular, the effectiveness of operational risk management.

One of the consequences of the world ﬁ nancial crisis is that the news reports now routinely

state that: 1) risk is bad; and 2) risk management has failed. In fact, taking risk is essential for

the success of organizations.

The statement that risk management has failed in banks is more difﬁ cult to contradict.

However, the reality is that it was not the failure of risk management principles that caused the

banking crisis. It was the failure to correctly apply those principles. Many banks made two

simultaneous mistakes:

An accurate risk and reward analysis was not undertaken, so that banks made decisions •

on the basis of the rewards available, rather than taking a more balanced view of the

risks involved in seeking those higher rewards.

Quantiﬁ

cation of the level of risk involved was not accurate, because the banks were •

taking such a risk-aggressive approach that certain events were considered to be so

unlikely that they could be ignored.

Detailed analysis of the banking crisis in 2008 is outside the scope of this text. However, it

appears that the crisis was caused by the failure of two different sets of risk analysis models.

Firstly, the banks had assumed that re-packaged debts, including sub-prime mortgages, would

continue to be tradable commodities in the market, but this proved not to be the case.

Secondly, the banks assumed that short-term borrowing on the wholesale money markets

would continue to be available. This short-term money is used by banks so that they can con-

tinue to lend money on a long-term basis, at a more proﬁ

table rate. The collapse of the whole-

sale money markets was not anticipated by the credit models used by most banks.

Enterprise risk management 231

Future development of ERM

The COSO ERM cube represents a framework for undertaking enterprise risk management,

although there is insufﬁ cient description in the COSO model of the risk management process

itself. However, the COSO approach is becoming more widespread because the COSO Inter-

nal Control framework (1992) is the preferred approach for compliance with the require-

ments of the Sarbanes–Oxley Act. US companies that have subsidiaries around the world fre-

quently require that their subsidiaries adopt the COSO approach.

Other important developments in risk management are the publication in 2008 of British Stand-

ard BS 31100 and the publication in 2009 of the ISO risk management standard, ISO 31000. ISO

31000 was adopted by Standards Australia to replace the previously available and well-estab-

lished Australian Standard AS 4360 (2004) that was ﬁ rst published in 1995. The approach in ISO

31000 is very similar to the approach described in British Standard BS 31100.

Future developments in the practice of ERM are likely to be focused on two key areas: ﬁ rstly,

ensuring risk management activities are fully embedded in the business processes of the organ-

ization; and secondly, demonstrating measurable ﬁ nancial beneﬁ ts associated with the imple-

mentation of an enterprise risk management initiative. The embedding of ERM in the

organization is achieved by leadership, involvement, learning, accountability and communi-

cation (LILAC). Developments in the practice of operational risk management are probably

leading the way in the measurement of the total risk exposure of an organization.

In summary, the discipline of enterprise risk management has become established and is here

to stay, but it has to be able to demonstrate signiﬁ cant and measurable ﬁ nancial beneﬁ ts.

These ﬁ nancial beneﬁ ts need to be demonstrated in the form of increased proﬁ t in private

sector organizations and in the form of the enhanced efﬁ ciency and/or value for money deliv-

ery of services in the public sector. The box below suggests the keys to success in ERM.

Successful ERM initiatives

How leading organizations develop an ERM programme; deﬁ ne a governance model

and support structure; collect, analyse, and share ERM information; and gauge success.

The following were the keys to success:

Maturity of ERM capabilities enables partner organizations to be more agile •

and ﬂ

exible in responding to business needs.

ERM is not a stand-alone or discrete activity, but a part of everyday life – a •

performance improvement effort.

Effective ERM is conducted at the corporate level in order to communicate •

policy and provide support to the entire organization.

232 Risk response

ERM is successful when championed at the enterprise level and owned by the •

CEO and board of directors.

Formal ERM is provided in ERM, so that risk management is part of the •

strategic planning process and everybody becomes a risk manager.

Mature ERM practices leverage technology to automate data capture and report •

risk measures.

Measurement frameworks provide a comprehensive understanding of the value •

of ERM.

Importance of risk appetite

Risk capacity

Many commercial organizations make adequate proﬁ ts, but take too much risk or make inap-

propriate use of the risk capacity of the organization. Risk capacity, or the capability of the

organization to take risk, is not the same as the cumulative total of all of the individual values

at risk associated with the risks facing the organization. This cumulative total is the risk expo-

sure of the organization.

By contrast risk appetite is the total value of the corporate resources that the board of the

organization is willing to put at risk. Most organizations have not determined the value they

should risk (risk appetite), nor calculated how much value is actually at risk (risk exposure),

nor the capability of the organization to take risk (risk capacity).

An organization should be able to decide how much it wishes to put at risk. Agreeing the risk

appetite will ensure that the organization does not put too much (or too little) value at risk.

The risk capacity of the organization needs to be fully utilized to ensure that risk taking is at

the optimal level and delivers maximum beneﬁ t. Similarly, the organization should not put

more value at risk than is appropriate, given the sector in which it operates and prevailing

market conditions.

Figure 26.1 represents the relationship between risk and uncertainty. It illustrates the typical

range of outcomes for hazard risks, control risks and opportunity risks. By including all

three types of risk in a single ﬁ gure, it is possible to demonstrate that the three types of risk

are related, interdependent and form a continuum. The sum of all of the hazard tolerances,

control acceptances and opportunity investments will represent the total risk appetite of the

organization.

The curved lines in Figure 26.1 represent the range of possible outcomes for each risk position,

to within a 95 per cent certainty. An organization may decide that it has a risk appetite such

that it is willing to tolerate a hazard risk shown at point A. Risk appetite point A represents the

233