How Often Should a Top 10 Profile Be Prepared?

This is a key decision to ensure positive cooperation and feedback from organizational executives. For most organizations an annual profile may be too infrequent given the fluctuating changes in the marketplace and within the organization itself. On the other hand, a profile every quarter may be excessive, especially for organizations just starting ERM. A semi-annual profile is the most expedient interval to start. It can then be adjusted after some experimentation.

Who Should Be Interviewed and How Should Interviews Be Scheduled?

Hydro One’s experience has shown that interviewing the top 40 executives and risk specialists,⁶ draws the most efficient and balanced range of responses for an average-sized organization.⁷ Ideally, interviews are conducted by two members of the ERM team, one who is facilitating the interview and the other who is taking detailed notes.

Scheduling a half-hour interview can be more easily accommodated than an hour-long interview. As well, all interviews should be scheduled within a set time period. A three-week time period is practical and provides a picture at a point in time without becoming blurred unless events affecting the organization change dramatically during the process (e.g., market collapse, earthquake, hostile takeover attempt).

What to Consider When Interviewing the CEO?

Since the CEO is the sponsor,⁸ care is required in approaching interviews and sessions involving the CEO as his or her views need to be reflected in the product, while still leaving the opportunity to make further refinements based on consultation with other members of the management team and other sources of information. Thus, it may be appropriate to interview the CEO for thoughts on various risks but caution the CEO that once this information is consolidated with other interviews and sources a different risk profile may emerge. Ultimately, however, the CEO should be prepared to review and discuss the report with the executive team before it is finalized and shared with the board.

What Background Information Needs to Be Gathered?

At this point, key background information that can influence the risk profile should be gathered. This could include benchmarking information, performance measures, and other trend analyses that might be used as key risk indicators (see Chapter 8 on Key Risk Indicators), internal and external audit reports and results of risk workshops, both at the senior and line management levels.

In an ERM environment the interviews with senior management and risk specialists should be validated against other ERM information. Such other information ideally would include divisional risk assessments prepared as part of the annual business planning process, and risk assessments (e.g., from risk workshops) as part of major projects and initiatives throughout the year. The results of these divisional and project risk assessments should be consolidated and used as critical input to the corporate risk profile. Altogether, these significant sources of information should complement and validate each other with any significant differences investigated as to their cause.

Obtaining Corporate Business Objectives

Before proceeding with ERM, and the eventual top 10 list, clearly articulated corporate business objectives must be identified. Surprisingly, this information is not always readily available in some organizations, where major business objectives may be understood but are not officially documented. They could be manifested by the large sums of money spent on certain initiatives, buried in annual reports and other disclosures, or scattered throughout business planning documents. Hence, it is imperative to first compile and get executive agreement on a list of the top 8 or 10 corporate business objectives over the next few years. These objectives should be stated in measurable terms such as growing sales by 20 percent, achieving certain profit levels, expanding overseas to certain countries, and reaching specific safety or customer satisfaction targets. These are, however, not to be confused with key performance indicators (performance measures), which all too often are prepared on an annual basis only. Business objectives must not only be articulated in terms of stretch targets or new initiatives but also in terms of preserving shareholder value, corporate reputation, employee morale, and an organization’s customer base.

For the remainder of the chapter, all further discussions about ERM and creating a top 10 profile will be framed in terms of risks to achieving corporate business objectives. In fact, the first matter raised at each interview should be to inform the interviewee that discussions will be focused on the risks to meeting the business objectives over the next few years.

Scanning of Events

One of the key inputs into preparing a corporate risk profile is having a good understanding of what external events have happened recently or might happen to impact the organization. This is sometimes referred to as an “environmental scan.” A simple way to prepare this is to compile an ongoing file of newspaper clippings, research reports, articles, and other items depicting events that have happened that could impact the organization or its stakeholders.⁹ Examples of these events include changes in governments, proposed and actual regulatory changes, stock market anomalies (e.g., inverted yield curves), surprising and relevant law suits raised or settled with similar businesses, disasters or crises. Compiled regularly, the file becomes a comprehensive compendium, which then needs to be summarized into one or two pages of the most impactful events or potential risk issues. It is subsequently distributed, in advance, to the interviewees or presented at the start of the interview with a qualifying statement that the summary is intended to remind the interviewees of what has happened since the last interview and get them thinking about what external events could impact the organization. Many interviewees find the summary informative and look forward to receiving it. It also provides them with an opportunity to identify, discuss, and even add additional events or items that may have been inadvertently omitted.

Prepare a List of Potential Risks

In many real-life examples of ERM, management is provided with and asked to rate, either a static list of risks, or to discuss risks without any prompts from the interviewer. As a result, interviewees do not always consider risks not already identified on the list provided or may not be responsive to general questions like “What keeps you awake at night?” At Hydro One, the practice is to bridge these two approaches and provide the interviewees with a list of past and potential risks at the start of the interview, urge them to be anticipatory in their thinking, and through gentle probing and discussion explore scenarios that could materialize into or create new risks.

What Is Presented in the List of Potential Risks? The list at Hydro One consists of brief descriptions of risks grouped into categories such as safety, regulatory and customer expectations. Each risk that was mentioned in the last risk profile is highlighted in the color denoting the previous risk rating. For example, red denotes high risks and yellow denotes medium risks. Risks that were not mentioned, because they were rated as low or are still evolving, are left uncolored and are referred to as “white spaces.” Examples include pandemic risks, regulatory changes, and pending environmental legislation.

What Is the Objective of the List? All of the risks are listed in three columns on a large sheet of paper, which allows interviewees to quickly scan and focus on their areas of interest. Some interviewees spend most of the interview process just on their area of accountability or specialty. Others may choose to discuss the risks that are of particular concern to them. The objective to presenting these risks is to solicit opinions as to whether the risks are likely to impact the business and in what time frame. It requires skill on behalf of the interviewer to work with the various personality types, gain the interviewee’s confidence, and retrieve accurate and appropriate information to prepare a valid risk profile.

Provide a Prior List of Top Risks In addition, interviewees should be provided—at the onset of the interview—with a matrix of the prior list of top risks and their respective ratings as identified in the previous risk profile. (See Exhibit 11.4.) This matrix has additional blank columns for recording the interviewee’s current ratings of risks, if different, and the expected trending, be it flat, upward, or downward. The interviewees are encouraged to provide their opinion prior to the end of the interview as to whether each rating should be adjusted and where they feel the trend is going. They are also asked whether any other risks should be included in the top 10 risks. A final column on the sheet is used for making brief comments by the interviewer.

Hydro One’s experience shows that some interviewees like this format and proceed to provide their assessments of each risk and add any new ones. Other interviewees prefer not to provide an opinion on the ratings and trending of these risks, but will speak knowledgeably about the risks and the relevant mitigants and provide valuable qualitative data and perspectives. Hydro One caters to these differences and does not impose a single expectation of each interviewee. This is where ERM may be considered as much an art as a science.

Written Notes With most interviews there can be a generous amount of discussion and information collected. It can be a challenge, therefore, to facilitate an interview while also taking copious notes. Ideally, then, there should be two interviewers from the ERM group, one team member leading the interview and the other team member taking detailed notes.

Feedback from the Interviewees on the Interview Process For several years now, Hydro One has been conducting these interviews. During that time, there has been positive feedback from the interviewees on the process involved. Overall, the interviewees have commented on learning more about the risks to the organization as a whole and thinking about them more on a practical level. The interviewers have also found the dialogue to be nondefensive, allowing the interview to play a key role in ensuring the business objectives are well understood throughout the broader management team.

Helpful Tips When Summarizing

A helpful method used at Hydro One is to prepare individual sheets for each major risk with two columns:

1. The first identifies the sources of risk and causes for any increases in risk.
2. The second denotes the mitigation efforts and causes for any decreases in risk.

Each comment listed in either of the above two columns is annotated with the initials of the interviewee for quick reference and follow-up if required to any specific issue. Although all interviews are treated confidentially and sources are never revealed, the practice is to maintain documentation of the original interview notes and to occasionally follow up with the interviewee for further clarification as required.

These individual risk sheets, when completed, become a summary of the key facts and descriptions, thus providing the basis for compiling or updating the risk profile. If there are conflicting views on any risks, they would need to be explored and validated.

Keep It Simple

When drafting the corporate risk profile, Hydro One follows some basic principles and best practices. First, the document is relatively simple and easy to understand. This goes back to the guiding principle of keeping ERM simple. Second, the document is a combination of descriptions and an easy-to-understand chart. One of its attractions is that it is written in plain lay English rather than legalese.

Key Foundational Elements

The document itself is divided into three parts. The first part focuses on foundational information such as the process followed, the number of interviews completed, the time frame for the assessment (e.g., three years forward), and the risks that have been removed from or added to the profile since the last one. The second part consists of a matrix (see Exhibit 11.5). This matrix lists the top risks, shows the current ratings, trends, and previous ratings for comparison, and references the risk descriptions on subsequent pages. The third part consists of a half-page narrative for each risk. Each narrative describes the sources of the risk, the business objectives impacted, and the mitigants in place or planned.

Hydro One evaluates and describes risks as “residual risks,” in other words, after taking into account current and planned mitigating actions. It does not use the term “inherent risk” except in rare cases such as the weather.¹⁰

Tips to Consider When Crafting the Initial Draft

Great care should be given to crafting the initial profile as it may be the first such document seen by management or the board. Recognizing Hydro One’s experience in using the top 10 method, a number of guidelines and tips follow:

• Assess the business context, the management style, the CEO’s known preferences and interests, and any sensitive areas and issues. This knowledge may help guide the writer of the profile as to how risks should be described in light of the circumstances and personalities involved.
• “Take Baby Steps.” Describe the essence of the risks in a broad enough manner so readers can relate rather than having to dive into overly detailed descriptions that may not be as universal in understanding and application.
• Use the corporate vernacular. Play back corporate terms and examples that will resonate and be easily understood by management and the board.
• Portray the corporate risk profile in a palatable fashion. Practically speaking, the profile should be viewed as a reflection of management’s understanding of the key risks faced by the enterprise and the mitigants underway or planned to manage them. This is not to say that risks should be downplayed or sugar-coated. Rather they can be expressed as a realistic “roadmap” or opportunity for improvement. Trying to cover too much detail, or to be too stark in the initial depiction of risks, is likely to threaten not only future exercises in risk profiling, but the entire ERM process.
• Capture and describe any wide divergent views of risk. It is often defined as uncertainty about future events. Therefore, where it is apparent that there is a wide divergence of views on the impact, probability, or adequacy of the mitigation of the risks, it is important to capture and describe this uncertainty in the profile. Avoid suggesting a level of precision about a rating or number that may not reflect reality. The reason is that mathematical formulae may portray exact numbers and therefore imply greater certainty than may be appropriate.
• Refrain from using strict predefined categories or descriptions of risk. In practice risks evolve, get addressed, and often diminish either due to management’s mitigation strategies, changes in strategic objectives, or due to external factors. Hydro One’s risk descriptions are customized and continue to evolve, split, and regroup much like amoeba in a Petri dish. By opting to customize categories and descriptions, the profile is a more accurate reflection of the evolving environment. It does, however, require greater skill and knowledge of the business.

An Example of Hydro One’s Evolving Risk Categories

For illustrative purposes, we provide an example of how a risk at Hydro One evolved as did the related risk profile descriptions. Several years ago, Hydro One labeled a risk as “asset condition” to reflect the potential impact on its objectives in the event of asset failures. It became evident later on that there were fundamental distinguishing risk characteristics between its transmission assets and its distribution assets. As a result, Hydro One split this risk grouping and gave each type of asset its own risk category and rating. As the electricity generation and demand locations started to shift in the province of Ontario, Hydro One then split the transmission asset risk into two separate parts. This split currently reflects the risks due to those from the existing condition of these assets versus those associated with not having sufficient assets in the right physical locations to meet growing shifts in generation and demand. More recently, distributed generation (e.g., windmills) has mushroomed and will require a multimillion dollar upgrade of the distribution grid. This has resulted in a new risk category being formed. Exhibit 11.6 shows the evolution of the single initial risk category, asset condition, into four discrete risk categories.