CHAPTER 7
ERM Frameworks

JOHN SHORTREED, PhD

Professor Emeritus, Civil Engineering, University of Waterloo

INTRODUCTION

Enterprise risk management (ERM) is equivalent to the ISO definition of “risk management framework.” The ISO definition of a risk management framework, and thus an ERM framework is:

risk management framework: set of components that provide the foundations and organizational arrangements for designing, implementing, monitoring, reviewing and continually improving risk management throughout the organization. (ISO Guide 73 “Risk Management—Vocabulary” 2009, Geneva)

In the ISO definition, the foundations include the policy, objectives, mandate, and commitment to manage risk and the arrangements include plans, resources, processes, relationships, accountabilities, and activities.

An organization’s risk management framework exists only to facilitate the Risk Management Process (RMP), which should be used for any decision in the organization. The RMP identifies the associated risks, assesses the risks, treats the risks within an appropriate context, and is supported by risk communication and consultation as well as monitoring and review.

The ERM framework is integrated into the organization’s overall strategic and operational policies and practices. There is one ERM framework at the organizational level and as many RMPs as there are decision/management positions—hundreds or even thousands. RMP is specified by the ERM framework and is the key risk management process.

Introduction to the ISO Risk Management Framework

The importance of risk management is recognized by the publication in 2009 of an International Standards guide, ISO 31000 Risk Management—Principles and Guidelines, developed by a work group of international experts from more than 30 countries. The same working group also revised ISO Guide 73 (2002) in 2009, and it provides definitions for risk management.

This chapter is based on the ISO risk management framework rather than attempting a comprehensive historical review and development of a state-of-the-art ERM framework. The ISO framework is current best practice for risk management frameworks. It incorporates best practice from COSO, PMI (Project Management Institute), the Australian and New Zealand Standard (AS/NZS 4360:2004) and other leading international risk management standards.

While ISO 31000 leaves some latitude to the organization for the specific framework and associated risk management process, it is expected that the generic ISO framework would be followed and the organization’s ERM framework would be easily recognized as an ISO 31000 framework. This is necessary in order to realize the benefits of common understanding based on standard terminology and processes.

The overarching concept of the ISO ERM framework is that the risk management in an organization is fully integrated into the management and direction of the organization, risk management is just one aspect of management and is just one more tool available to managers besides tools for: operations, finance, planning, human resources, and so forth. Risk according to ISO’s general definition is “effects of uncertainty on objectives.” It is expected that any decision will involve a routine and appropriate consideration of the associated risks and their possible treatment along with consideration of impacts on objectives, which are not uncertain. Risk management is not an add-on step but rather is fully integrated and embedded in all decision processes.

Uncertainty in risk may involve uncertainty of objectives and their measures, effectiveness of controls, the nature of events and their consequences, stakeholders’ views, or uncertainty of any sort. Risk management seeks to enhance the likelihood of positive consequences and reduce the likelihood of negative consequences as defined by the organization’s objectives.

Any decision by any manager can have either positive or negative effects on the organization’s objectives. The uncertain consequences of a decision, positive and/or negative, are inextricably bound to each other and cannot be separated. Expressions such as “run a risk,” “take a risk,” “faint heart ne’er fair maiden won,” “take a chance,” all describe the uncertainty of a decision outcome. “You pay your money and take your choice.” Then you wait for the future to unfold and add up the positive and negative consequences, to see if according to your objectives, it was a good choice or not.

An “opportunity” is a situation where, on balance of probabilities, the net expectation is a favorable decision outcome A “threat” is a situation when, on balance of probabilities, the net expectation is an unfavorable outcome. Both opportunities and threats have associated risks.

The organization first examines the external and internal context in which it operates. Then the organization reviews its objectives, including any risk-specific objectives. Risk criteria that are used to determine the acceptability or tolerability of a risk, in deciding either to pursue an opportunity or respond to a threat, are based on the objectives.

The ISO framework can accommodate profit-seeking organizations as well as regulators who exist only to protect the public from harm. The later organizations may focus primarily on negative consequences although it is recommended that they consider also positive consequences such as trust of public, cost-effectiveness of controls, and so on. The reason for this flexibility in application is because the risk framework is driven by objectives and those objectives can accommodate any goals, purposes, limitations, zero tolerance criteria, absolute priorities, and so on.

The ISO standard’s risk management process can be applied to the whole organization, to part of the organization, to particular types of risk in isolation, or to a specific asset, project, or activity. The standard recognizes that management of risk is more effective if it is conducted in a consistent manner across an organization as defined by the ERM framework.

Principles of Risk Management and Excellence in Risk Management

The ISO framework is principle-based rather than prescriptive. It provides a general framework for ERM with the expectation that individual countries, industrial sectors, and organizations will craft their own detailed and specific frameworks to their own unique situations. The principles have their own chapter in the ISO standard and are expanded in an annex on excellence in risk management.

The overarching ISO principle is that risk management should have net value to the organization. Risk management should make money, enhance reputation, contribute to public safety, improve sustainability, generally enhance benefits, and reduce harm. It does this by improving the decision makers’ understanding of the effects of uncertainty on objectives, devising risk treatments that are objective-effective, and doing monitoring, review, and improvement of risks and controls.

To illustrate the issue of uncertainty/risk and value, consider a study of dams constructed by the U.S. Bureau of Reclamation. The study compared planning estimates prior to construction with data for the projects once built and in operation. The study found that if in the planning period the Benefit to Cost ratio was 1.0 there was only a 17 percent chance the actual project would break even. A prior Benefit to Cost ratio of 4.0 (benefits exceeding costs by 300 percent) was needed to achieve a 95 percent probability of achieving a Benefit to Cost Ratio of 1.0 or break even. The benefits were systematically overestimated and the costs were systematically underestimated (James and Lee 1971). Effective risk management should reduce these biases and improve the estimates of actual value.

Based on a comprehensive analysis of existing principles for risk management the ISO Working Group identified 10 principles for risk management (after ISO 31000, clause 4):

  1. Creates value for objectives of health, reputation, profits, compliance, and so on, less the costs of risk management.
  2. Is an integral part of organizational processes including project management, strategic planning, auditing, and all other processes.
  3. Is part of decision making through analysis and evaluation to understand risk and determine its acceptability as treated.
  4. Explicitly addresses uncertainty and how it can be modified.
  5. Is systematic, structured and timely and produces repeatable and verifiable outcomes and decisions.
  6. Is based on the best available information including historical data, expert opinion, stakeholder concerns, and so forth, tempered with the quality and availability of the information.
  7. Is tailored to the organization, its objectives, its risks, and its capabilities.
  8. Takes human and cultural factors into account in addition to technical and other “hard” factors that impact the likelihood of consequences.
  9. Is transparent and inclusive so that communication and consultation with stakeholders and others keeps the risk management and risk criteria current and relevant.
  10. Is dynamic, iterative and responsive within a “continuous improvement” environment that responds to changes in context, trends, risk factors and other internal and external factors.

These principles provide the basic attributes for an ERM, however, as the organization implements an ERM framework it will exhibit characteristics of “risk maturity” in addition to adherence to the principles. In ISO 3100, Annex A describes the excellence characteristics and evidence for their existence and change in an organization. The excellence characteristics are:

  • Continuous improvement in the framework using a formal process.
  • Accountability for risks with readily available lists of risk owners.
  • Use of the RMP in all decision making with documentation as appropriate.
  • Constant communications about risk, risk controls, and other “of possible interest” aspects of RMP.
  • High profile for risk management as a core commitment in the organization.

ELEMENTS OF AN ERM FRAMEWORK

The first steps to implementing ERM is to have a list of components that provide a comprehensive specification for the framework. Then these components must be designed and the associated implementation plan developed. Most ERM frameworks, including ISO 31000, do not specify these components but rather give conceptual guidance on the framework and its relational structure. In this section a set of seven main components and their subcomponents for the ISO framework are introduced after a short conceptual outline of the ISO framework.

ERM Framework: Concept and Elements

The underlying concept in ISO 31000 for an ERM framework is a quality management approach using the Deming paradigm of Plan-Do-Check-Act (PDCA) (Deming 1986). The quality of decision making in an organization is enhanced through continuous improvement of the risk management framework. The framework is designed, implemented, monitored, and continuously improved following the PDCA approach.

The ERM framework in an organization supports the risk management process for decision making in the organization. The framework also aggregates information on risks, risk management, and performance of risk controls in the organization. The Risk Management Process (RMP) is the key element of the ERM framework. The RMP ensures that risk management and the operation of risk controls will increase good consequences and reduce bad consequences within a continuous improvement cycle.

The framework has to be practical. Managers are usually overworked and one extra responsibility for which they are accountable needs to be manageable if it is to be done effectively. Overly prescriptive approaches, while comprehensive and detailed, may be too onerous and counterproductive. Therefore a principle-based approach is used and adopted to the circumstances. Successful frameworks are usually simple to understand and to implement yet allow for sophistication and subtlety in their application and continuous improvement. As a general rule efforts in risk management should be proportional to the magnitude of the risk and/or the benefits of the risk controls including impacts on stakeholders.

The framework and RMP should use standard terminology and processes. Where possible, ISO Guide 73 terminology should be used and if other terms are used then a link should be made to ISO terminology. For example, if “environmental scan” is used then it should be linked to the ISO term “external context” so the relationship to the framework is clear. Many shortcomings of current risk management are due to the use of nonstandard terminology and the resulting ineffective communication, lack of understanding, and less innovation.

An ERM framework has seven components:

  1. Mandate and commitment to the ERM framework.
    1. Agreement in principle to proceed with ERM.
    2. Gap analysis.
    3. Context for framework.
    4. Design of framework.
    5. Implementation plan.
  2. Risk management policy
    1. Policies for the ERM framework, its processes and procedures.
    2. Policies for risk management decisions:
      • Risk appetite.
      • Risk criteria.
      • Internal risk reporting.
  3. Integration of ERM in the organization.
  4. Risk Management Process (RMP).
    1. Context.
    2. Risk assessment (identification, analysis, and evaluation).
    3. Risk treatment.
    4. Monitoring, review, and actions.
    5. Communications and consultation.
  5. Communications and reporting.
  6. Accountability.
    1. Risk ownership and risk register.
    2. Managers’ performance evaluation.
  7. Monitoring, review, and continuous improvement.
    1. Responsibility for maintaining and improving ERM framework.
    2. Approach to risk maturity and continuous improvement of ERM framework.

Exhibit 7.1 illustrates a typical framework for an organization to implemented ERM according to ISO 31000 (Broadleaf 2008). It shows in addition to the main components of an ERM framework, other processes and functions necessary for implementation and continuous improvement. It is expected that each organization will customize the ISO framework to suit their organization’s structure, roles, and responsibilities, with a view to making integration of risk management easier and more effective.

In Exhibit 7.1 the outer set of four boxes is a “Plan-Do-Check-Act” (PDCA) format modified for implementing an ERM framework in an organization, namely: “Commit & Mandate” (Act); “Communicate & Train” (Do); “Structure & Accountability” (Do); and “Review & Improve” (Check and Act). The plan step is not shown directly but it results in the framework design shown in Exhibit 7.1.

The inner set of five boxes in Exhibit 7.1 is the RMP from ISO 31000. It is used for any decision in the organization. RMP has tasks or activities of “Establish context,” “Risk assessment,” “Treat risks,” “Communicate and consult,” and “Monitor and review.” Exhibit 7.1 illustrates the relationship between the ERM framework and the RMP, which is a component of the ERM framework. There is also an administrative activity shown: “Management Information System,” which provides the interface between the organization’s overall risk management framework and the hundreds or thousands of RMPs within the organization. The risk management information system acts to roll up all the risks in the organization for purposes of risk appetite, as well as roll down the framework to the individual risk and control owners for purposes of local risk criteria.

RISK MANAGEMENT PROCESS (RMP)

This section describes the ISO RMP as shown in the inner boxes of Exhibit 7.1. Exhibit 7.1 illustrates the traditional set of risk management tasks to support and assist decision making by any manager anywhere in the organization. Context sets the stage for the decision or activity requiring risk management; risk assessment identifies, analyzes, and evaluates the risks; risk treatment enhances the likelihood of positive consequences and reduces the likelihood of negative consequences to acceptable or tolerable levels; monitoring and review keeps close watch over the risk and the controls implemented to modify the risk; and communication and consultation is continuous to ensure that the stakeholders are engaged and contribute to the management of risks.

The RMP is the first framework component presented because it is used for all decisions in the organization. RMP is a method to modify risks to create value. The ERM framework exists primarily to facilitate application of the RMP everywhere in the organization.

The RMP in Exhibit 7.1 is not a flow chart but a relational diagram that must be tailored to the individual organization before implementation as a process flow chart. The tailored implementation ensures that risk management is both practical and aligned with the organization’s structures, processes, and objectives.

003

Exhibit 7.1 An ISO 31000 Compatible Framework for Implementing ERM Including the Risk Management Process

Source: © Broadleaf Capital International Pty Ltd., 2008, www.Broadleaf.com.au. Used with permission of Broadleaf Capital International—adapted from a presentation at IRR workshop on Implementing Risk Management ISO 31000 style; Toronto (2008), see www.IRR-NERAM.ca.

There is a range of approaches to RMP that reflects the context of the risk. For example, the risk context may vary at one extreme from:

  • Routine operations where risks are well known from historical data, associated processes are relatively straightforward, mistakes are expensive and avoidable, controls are well known and standard, and so forth. Examples include consumer loans and installing electrical networks. A prescriptive approach with checklists, close supervision, audits, retraining as needed, and other traditional methods of quality control and assurance are appropriate; to
  • Strategic planning decisions where risks are not well known, data is limited, risk assessments are difficult and subjective, risk treatments are speculative, mistakes can be catastrophic, and in general, decision making is done under extreme uncertainty. General approaches are used, including sampling of expert opinion, checks such as Delphi techniques to ensure opinions are well considered and as informed as possible, “what if” scenario analysis to help understand the risk, and extensive review of options, their risks, and the effectiveness of possible treatments. A risk matrix is often used to structure the risk assessment.

In spite of the wide range of characteristics of risks, risk contexts, and risk management decisions, the ISO RMP is applicable to any situation. The ISO RMP is functionally identical to most existing RMPs. For example, in one study the author mapped more than 50 environmental risk management frameworks onto a similar RMP and while there were a number of gaps with tasks not included, there were no missing tasks. Tailoring the RMP to reflect the specific context of the risk may include:

  • Legal and regulatory compliance requirements.
  • Need for a nested hierarchical risk assessment and treatment procedures. For example, if simple pass/fail risk acceptance criteria are not met and there is a chance that more detailed analysis will change the result, then more detail assessment and treatment activities take place. For many “political” decisions the iterative cycle of risk assessment-risk treatment options-communication and consultation with stakeholders may take years and sometimes decades.
  • Recognition of known-unknown risks where the emphasis is less on risk assessment (not possible) and more on the risk financing and other contingency controls as well as the application of policies on risk appetite, precautionary approaches, resilience, flexibility, and robustness of the organization.
  • Due diligence dictated by the body of common law that indicates for a specific situation what a minimal level of risk controls and risk management is required for both the upside and downside risks.
  • Focus of most resources on one task such as risk communication and consultation when it is known, for example, that stakeholder support is critical and perceptions may be contrary to the view of the organization or existing data.
  • Focus on risk assessment as in the benefit/safety of chemicals where the “true” answer is unknown or unknowable based on historical studies.
  • Use of Monte Carlo and other gaming methods where risk factors such as the general global economy will impact sales of a product and these methods may help with the decision on how many products to produce—not too many and not too few.
  • The availability of data and the costs to obtain it.
  • The available knowledge in the organization and capacity to assess and treat risks. For example, operations in developing countries, in war zones, and so forth.

This chapter does not provide a comprehensive look at the five activities in the RMP but rather gives an overview and understanding of each activity. It is noted that any organization will have a number of RMPs already existing based on history, regulation, and industry norms. The alignment of these existing RMPs into the ERM framework and the organization’s policy RMP is an additional challenge in the “tailoring” exercise that is not covered in this chapter.

Before considering the five risk management tasks it is helpful to consider the characteristics of controls and the associated decision-making task. In the RMP, decision making is not shown explicitly because it is implicit in the organization’s structure and the roles and responsibilities assigned to each decision maker. Decisions are influenced by risk management but the risk management process is only one part of the decision process.

There are six different options or approaches to risk treatment and control. All should be considered and often they are used in combination:

  1. Make a conscious decision either to avoid or pursue a risk, often as a first step in a decision process. Is this something to be involved in or not? If so, to what extent and with what level of risk management?
  2. Remove or isolate the risk source by changing materials, using a different supplier, modifying the operational process, or other methods of removing the source of risk.
  3. Change the nature and magnitude of the likelihood through redundancy, training, simplification of operations, bonuses for good performance, incentives, or otherwise modifying likelihood.
  4. Change the nature and magnitude of the consequences through protective equipment, improved design and appearance to change behavior, leverage desirable outcomes through financial incentives, or otherwise mitigate the consequences.
  5. Share the risk with another party or parties often in partnerships or through insurance, which does not reduce the total risk but reduces the risks, both positive and negative, to the organization.
  6. Retain the risk, as treated, by choice or default if no explicit decision is made on the acceptability of the risk. Retaining the risk may include identification of possible contingency plans and the provision of capital reserves.

Risk Management Process: Context

The context for the risk management process is a relatively new risk management activity, first introduced in the 2004 New Zealand and Australia Risk Management Standard. It builds on the framework-context for the organization where the organization-wide risk appetite is formulated and the risk management environment of the organization is defined. The context looks at the laws, market, economy, culture, regulations, technology, natural environment, stakeholders’ needs, issues, and concerns, and basically anything that could impact the objectives, risk criteria, or other risk management activities.

The main output of context is the risk criteria to be used to determine the acceptability of the risks. A second output of the context activity may be the specification of the other risk management activities, such as communication and consultation and risk assessment.

The risk criteria is used to evaluate the significance of the risk by comparisons against the risk with existing controls or the risk with proposed treatments. If the comparison leads to the decision that the risk is not acceptable then further risk treatments are considered. In some cases the risk cannot be modified to make it acceptable and in this case the risk criteria is shifted from acceptance mode to tolerability by posing the question “Is there some possible level of risk that while not acceptable can be tolerated?” In the case of negative consequences this may be ALARA (As Low As Reasonably Achievable), BAT (Best Available Technology), and other approaches to determine the tolerability of risks.

The context may be organized into three categories:

  1. The external context—anything outside the organization that must be taken into account in risk management, including stakeholders, regulations, contracts, trends in business drivers, local culture and social norms, employment situations, and competition.
  2. The internal context—anything inside the organization that must be considered in the RMP, including capabilities, resources, people and their skills, systems and technologies, information flows, decision-making processes (formal and informal), internal stakeholders, policies and strategies within the organization, and other constraints and objectives.
  3. The risk management context—any activity in the RMP that requires attention in seeking to find the appropriate level of risk and associated risk treatments, controls, monitoring, and review. This includes responsibility for the risk, scope of the RMP, linkages of the product or service to other products and services in the organization, risk assessment methods to use (may be specified by regulations, industry norms, stakeholder requirements such as business plan formats, etc.), the time available for the RMP, background studies that may be needed, coordination with communication and consultation task as well as the monitoring and review task, and other processes and procedure matters.

The context as with other RMP tasks must be practical and within the value-added parameters of the organization. This may involve the standardization of RMP tasks including boiler plate context and checklists, with brainstorming for additional items. In many cases guidance will be found from best practice, industry norms, conferences, special software tools, and other opportunities for discovering “good” approaches.

Risk Management Process: Risk Assessment

Risk assessment involves three tasks. It is not possible here to do more than describe in very general terms the objectives of each task and possible approaches to these tasks. For instance for business and finance organizations, nongovernment organizations, or for agricultural organizations there are whole books dedicated to methods for the three tasks:

  1. Risk identification. Risks associated with any decision must be identified and placed in a risk register or risk log before they can be treated, even if it is later determined that the risk levels with existing controls are acceptable. It should be assumed that not all risks will be identified and like any of the RMP activities there needs to be provision for monitoring and review to add risks to the register. Risk identification may use historical data, often categorized in terms of credit risks, operation risks, market risks, technological risks, human behavior risks, country risks, and other convenient mutually exclusive categories that assist in risk identification. Risk names may help stakeholders relate to the risks and have the potential to improve the effectiveness of controls. In many cases risks will be described in aggregate terms representing hundreds or more subrisks. Risk identification may use brainstorming, “what if” methods, scenario analysis or other methods for helping people identify risks, particularly infrequent risks, “black swan” risk situations (Taleb 2007) and other search techniques. One set of risk identification techniques is tree methods, either leading up to an event (tree roots) or following an initial event (tree branches), sometimes structured in terms of decision trees.
  2. Risk analysis. The purpose of risk analysis is to provide the decision maker with sufficient understanding of the risk, that they are satisfied they have the appropriate level of knowledge about the risk to make decisions on risk treatment and acceptance. Risk analysis methods can vary from quantitative mathematical models to qualitative expressions of expert opinions or even organized and structured gut feelings. Risk analysis may be organized into estimates of likelihood of events, estimates of consequences of events, and estimates of the combined effect of likelihood and consequences according to the risk criteria. Risk analysis may be organized into multiple outcomes and their likelihoods in the form of a probability distribution. Risk analysis may include separate determination of risk factors that identify special vulnerabilities or opportunities for success associated with particular markets, people, products, and so forth. Risk factors are usually determined by industry-wide or population-wide studies, such as the tendency for higher credit defaults with lower credit ratings to give a rather obvious example.

    Root cause analysis of risks is both a useful and potentially confounding concept. The basic idea is to carry the analysis to the point where there is a cause of the risk that is fundamental in that if the root cause is treated then the risk consequences and/or likelihood will be modified. For example, accident analysis or debriefing of successful programs can benefit from root cause analysis. Was it the actions of the sales person, the advertising program, the design of the product, or the follow-up service that resulted in the success? Root cause analysis can be confounding, for example, when cause is inappropriately assigned to operators rather than the design of the system and specification of job tasks.

  3. Risk evaluation. Each risk, if identified and analyzed, is evaluated by comparing the residual risk after risk treatment (or with existing controls) against the risk criteria. The risk is then accepted as treated or not accepted and subjected to risk treatment. The risks associated with controls and their implementations are also considered in the risk evaluation and the risk analysis. Risk controls may not work as estimated, some controls such as those involving counter parties will have additional risks of failure of the counter parties, or with partners that do not meet their contractual obligations, or the controls fail for any reason.

    If it is not possible to find a risk treatment that is acceptable then the risk is revisited and it is determined if there is any way to make the risk tolerable usually with more extensive controls.

    Risk evaluation methods are numerous and can include multidimensional objectives, risk matrices, voting, subjective ratings, testing by focus groups, statistical analysis models, market testing, and evaluation gaming. Care must be taken that the risk evaluation method and results are accurately communicated to the decision maker and other stakeholders so limitations and uncertainties are known. Note that if the risk analysis is not quantitative then the risk evaluation must be qualitative.

In many situations the risk assessment is not done as three separate tasks but with methods that combine the tasks. In some well-established methods such as HAZOP (HAZard Analysis and OPerability study) (Crawley and Preston 2008) and FMEA (Failure Mode and Effects Analysis) (Wikipedia 2009a) not only are identification, analysis, and evaluation included in the method but also risk treatment since the team doing the analysis of the system usually selects risk controls until the risk criteria are met.

The risk matrix is a combined risk assessment method that is widely used for strategic risks and other risks that require subjective analysis and evaluation. It is used when quantitative methods are not available and a knowledgeable and experienced team that collectively can provide an acceptable and comprehensive understanding of the risk is available to do risk identification, analysis, and evaluation. The team first identifies the risk and places it in the risk register. Then the team produces a subjective rating on a 3–5 point scale for both the likelihood and the consequences of the risk. The two ratings are plotted on the risk matrix using the subjective ratings. Then the team identifies the acceptable risk levels and/or the level of risk by identifying cells in the matrix that have say high, medium, or low risks or alternatively risks that require treatment or not, the result is sometimes called a “heat map” when high medium and low negative risks are shown in red, yellow, and green. Although popular, risk matrix methods should be used with caution because of the following characteristics:

  • The matrix helps the team compare one risk to other risks as the question is asked: Should these two risks be in the same risk cell? Often Delphi techniques and other cyclical reevaluation methods are used to ensure consistency.
  • The team should clarify if the likelihood is an expected value or an extreme value.
  • The team needs to understand what controls are in place in the evaluation, for instance, while not desirable for other reasons, some of the team members may be thinking of “inherent” risks or the risk without any controls, including even human behavior (e.g., operator actions are often the treatment of last chance).
  • The team can be swayed by dominant and persuasive personalities, including the facilitator, and checks should be in place including secret ballots, rules for interventions, and so on.
  • Often arithmetic is done on the ratings, which is not mathematically sound, for example the rating for likelihood is incorrectly multiplied by the rating for consequences and the product referred to as the level of risk. This is why risk definitions more generally and accurately refer to “level of risk being some combination of likelihood and consequence.”
  • Risks descriptions may be interpreted by team members differently. Care must be taken to make sure the risk and risk treatment can be unequivocally related to the risk being considered.

Risk Management Process: Risk Treatment

Treatment, like medical treatments, may be either vitamins to enhance well-being or therapy to reduce undesired consequences. Risk treatment includes the identification of control options, selection of a control option, and implementation of the selected control. The medical analogy, including wellness criteria is useful to appreciate the complexity of the tasks in risk treatment, particularly since there is uncertainty at every step in the process. This is reflected in the ISO standard by the fact that about 8 percent of the standard is dedicated to risk treatment, including preparation of treatment implementation plans, strategies for evaluating treatment options, and the key role for monitoring of treatment implementation and performance of controls.

Risk Management Process: Monitoring and Review

Monitoring and review along with risk communication and consultation are two RMP activities that are applied to the three “line” activities of context, assessment, and treatment. Monitoring and review are key to the continuous improvement of risk management. For example, most approaches to risk maturity examine how monitoring and review leads to actions and then to observable improvements. Every aspect of RMP needs to be monitored and reviewed including:

  • Has the risk changed in character due to trends? Are there new risks evolving or emerging?
  • Has the context for the risk management changed, as for example after events such as the October 2008 financial crisis?
  • Is the risk treatment plan being implemented? As planned?
  • Are controls effective?
  • What is the appropriate frequency of monitoring?
  • Should monitoring be done by internal audit, third party, or self-assessment?
  • Based on actual outcomes for objectives was the risk assessment accurate?
  • Can monitoring be improved by identifying better key performance indicators?

Risk Management Process: Communication and Consultation

Because risk is uncertainty about effects on objectives there is a strong incentive for communication and consultation. For example, many exercises in strategic planning are “team” exercises, which grapple with uncertainty about future markets, what the competition is doing, technological innovations, the state of the economy, the accuracy of cost estimates, and the probability of war. There must be extensive communications among team members, and consultations with other experts in the organization to ensure the accuracy and effectiveness of activities in the RMP.

There have been extensive studies of risk communication that focus on how risks are perceived, including by team members doing the risk management. People’s perception of risks changes with the frequency of the risk, natural versus man-made risks, the uncertainty of the risk and other factors (Standards Australia 2009). In addition, people are notoriously bad at doing mental arithmetic on likelihoods such that even the simplest methods of ensuring accurate calculations of probabilities and frequencies will reap considerable benefits.

Some recognized prophets in risk management (Kloman 2008) go so far as to argue that if you don’t get risk communication right then you can’t do effective risk management. Consider the risks associated with assets backed by subprime mortgages, which led in part to the October 2008 financial crisis. Might the crisis have been avoided if there had been improved communication and consultation, to explore questions such as “What is the risk associated with this asset? Are there any common root causes? What additional risks are associated with failure of controls? What is best lending practice?”

Like monitoring and reviewing, communication and consultation is a part of all the other tasks in the RMP. As captured in the expression “the more you tell the more you sell” communication improves the effectiveness of risk management for positive consequences as well as negative consequences. Communication and consultation are also key to success in risk assessment, treatment, and evaluation activities. In many risk management processes communication and consultation can account for more than 50 percent of the resources required. Consider, for example, the importance of communication and consultation in winning elections where the outcome is always uncertain.

Risk Management Process: Recording the Risk Management Process

Risk management activities should be recorded. This is standard policy for any important activities in any organization and this task is illustrated in Exhibit 7.1 as a “Management Information System” that links the RMP to the risk management framework. Records created as an integral part of the RMP provide for traceability of decisions, continuous improvement in risk management, data for other management activities, legal and regulatory requirements, and so forth. Systems for record keeping, storage, protection, retrieval, and disposal need to be carefully designed, implemented, monitored, and reviewed.

MANDATE AND COMMITMENT TO THE ERM FRAMEWORK

Risk management should be fully integrated into the management of the organization. This integration requires a mandate and commitment from the board and senior management. This mandate is either for a new ERM framework or for the improvement of an existing framework. There are three steps in the organization’s mandate and commitment, which may be done in an iterative and/or interactive way.

  1. Decision to undertake a review of the risk management framework, assignment of a champion, and resources.
  2. Champion conducts and reports on:
    1. Gap analysis of existing ERM framework and other risk management processes in the organization, usually against ISO 31000, industry norms, and other benchmarks.
    2. Context for risk management in the organization.
    3. Design of a (revised) ERM framework, and recommendations for implementation.
  3. Approval of the ERM framework, and the implementation plan including IT system, alignment of the risk management and organizational processes, changes in evaluation of managers to reflect risk management performance, measures of framework performance and monitoring, and review of the framework in a continuous improvement cycle.

The commitment to ERM must be continuous so that the framework will not only be implemented but maintained and sustained. It is an ongoing commitment.

Rationale for Commitment to ERM

ERM benefits to the organization have been identified as including:

  • Proactive rather than reactive management of risk resulting in more successes, fewer setbacks, and more effective operations and controls.
  • More effective and structured approach to opportunities and threats by managing the associated risks in effective and efficient ways.
  • Better compliance with regulations and other requirements, including employee moral, enhanced health and safety, and crisis management.
  • Improved stakeholder trust and confidence in the organization.
  • Better corporate governance through improved understanding of risks, their control, and general resilience and robustness of the organization.

If the organization believes in these benefits of risk management for their organization they will appoint a champion to do a gap analysis, conduct a context for the ERM framework, and design an appropriate ERM.

Gap Analysis for ERM

The first step in developing (or revising) an ERM framework is a gap analysis of existing processes against a benchmark such as ISO 31000 to provide a baseline for the design of the framework as well as to confirm the potential benefits.

The gap analysis will consider a checklist of elements of the framework such as in the section above. Each element will be described, including its function and operation. For every element, the gap analysis will evaluate its existence or not, its criticality to the organization, and its effectiveness. The result will be a template for the design of the framework.

The gap analysis is complicated by the existence in organizations of hundreds or more existing risk management activities each with its own unique terminology and processes. These “historical” risk management activities will be for health and safety, environmental protection, process safety, fraud detection, validation checks, “what if” analysis of strategic initiatives, procedures for collecting receivables, validation of stakeholder analysis, among other activities. Existing risk management activities may have gaps when compared to modern risk management frameworks and processes. For the ERM framework to integrate and incorporate existing activities it will be necessary to specify some basic principles, standard terminology, and a method of translating them into a common RMP. This is not easy due to inertia and resistance to change as well as the volatility in many organizational structures and associated roles and responsibilities. Use of dual terminology for an interim period may be necessary.

Context for ERM Framework

The organization must review the context in which it operates, starting with the external context that includes market conditions, competition, technology trends, legislative requirements, weather and climate impacts, country risks, political environment, globalization factors, key drivers of profitability and sustainability, including financing and other resources, external stakeholders’ needs issues and concerns, and any other factors that influence threats or opportunities and their associated risks.

The internal context will include the complexity of the organization in terms of size, number of locations, number of countries, degree of vertical integration, existing regulatory and legal requirements, key internal drivers of the organization, the objectives of the organization, stakeholders and their perceptions, capabilities of the organization, existing strategies and organizational structure of the organization, and any other internal factors that will impact risks or risk management.

The combination of the external and internal context will help to set parameters and objectives for the design of the ERM framework. The context will determine:

  • The characteristics of risks faced by the organization and the benefits of risk management.
  • The resources needed for risk management including the need for a chief risk officer.
  • Combined with the gap analysis, the possible emphasis needed for the various components of the ERM framework and the risk management process.

Design, Decision, and Implementation of the ERM Framework

The elements of the ERM framework will be designed to suit the framework context and follow the elements of frameworks as described in this chapter.

Once designed, the ERM framework, its implementation plan, and process for continuous improvement must be approved by the organization then implemented. Exhibit 7.1 provides an example of one ERM framework design.

RISK MANAGEMENT POLICY

Risk management policy for ERM frameworks can be considered in three groups:

  1. Policies for the ERM framework and its processes and procedures.
  2. Policies for risk management decisions.
    1. Risk appetite.
    2. Risk criteria.
    3. Internal risk reporting.
  3. Commitment, responsibility, and timing for monitoring, and review of policies.

Policies for the ERM Framework

The policies should be presented in a short (usually public) document that outlines the context for the organization risk management framework, perhaps including the gap analysis, the organization’s approach to risk management, the standard terminology and risk management processes to be followed, the procedures for continuous improvement of the framework, the accountability for risk and risk management, and how the organization will monitor and review risk management and the performance of controls. These ERM policies for processes and procedures are equivalent to the framework structure illustrated in Exhibit 7.1.

Policies for Risk Management Decisions

The ERM framework should provide overarching policies that are applied in the RMP through risk criteria and risk evaluation.

Policies for Risk Management Decisions: Risk Appetite

The relationship between threats (a situation with predominantly risks with expected negative consequences) and opportunities (a situation with predominantly risks with expected positive consequences) is reinforced by our modern market economy. Even in fairy tales where “faint heart ne’er fair maiden won” it always seems that the two elder sons lost out before the younger succeeded. Enhanced achievement of objectives invariably leads to higher levels of risk. The organization has to decide on its risk appetite or how much risk it needs to take to achieve its objectives and those of its shareholders and stakeholders. Risk appetite is “amount and type of risk an organization is prepared to pursue or take” (ISO Guide 73).

The organization must “take a risk,” or “run a risk,” in order to achieve objectives of growth, return, sustainability, enhanced reputation and trust, avoidance of decline, and so forth. Risk management tries to ensure that the organization selects a risk appetite in an informed and predictable way. Risk appetite will be expressed in risk criteria in each RMP and risk criteria are used in risk evaluation to determine the treatment needed for acceptable risk.

Risk appetite has two dimensions, one that focuses on the average or expected situation and one that focuses on the extreme or worst case situation:

  1. The risk appetite dimension for expected outcomes of risk consequences. This is the normal situation that is expected when there is no recession, no new “killer” technology, no innovations by competitors, and generally business as usual. In some fields such as perhaps mining this “average all things considered” situation may never exist.
  2. The risk appetite dimension for unexpected or “worst case” outcomes of risk consequences. This is the survival dimension of strategic initiatives and is usually expressed in terms of resilience and robustness of the organization to the slings and arrows of outrageous fortune. It is noted that some worst cases are the product of wildly successful initiatives that place the organization in a position where it fails because it cannot cope with that much success.

Consider a simple example of risk appetite for the average or “business as usual all things being equal” situation. The organization expects, all things considered, that objectives will be achieved within reasonable variance about the average. For example, publicly traded companies will provide guidance on this expectation in terms of a range of quarterly performance values. The second dimension of risk appetite in this analogy is concerned with “surprises” or outcomes outside the guidance levels. Surprises, if large enough, can render the organization unable to cope. This inability to cope may be either on the low side with insufficient revenues and profit or on the high side with unexpected increase in demands for products that strain supply lines, lead to shortages, unhappy customers, loss of reputation, and in some cases take over by other organizations.

The two dimensions of risk appetite together provide the basis for risk criteria that set out what risks the organization will take and what risks it will not take. The risk criteria provide for each decision in the organization guidance on acceptable risk levels. This “risk criteria” guidance must recognize the average and frequent situation as well as the infrequent extreme situation. Setting the risk criteria is risky business. How extreme a situation should be considered? 90 percent, 95 percent, or 99 percent? What assumptions should be made about the performance of individual decision makers to respect the organization-wide risk criteria when they formulate their local risk criteria? How effective are the controls to prevent “rogue decisions” and failures to escalate decisions? Are the quality assurance methods for operational risks and their controls sufficient? What is the importance of cumulative risks and common cause risks? Controls for risk appetite can include, for example, “one ship one organization.”

The risk appetite for the average dimension is usually calculated by Monte Carlo methods or even by simple use of averages from historical records. Care should be taken to validate the parameters chosen and to have a monitoring and review process to detect and correct for poor estimates as well as for trends that change historical values.

The risk appetite “worst case” dimension for the simple financial situation might be estimated by considering the maximum monetary loss (or gain) that can be tolerated based on capital reserves, income potential, capabilities of the organization, capabilities of suppliers, information technology limitations, and other basic resources. This simplest worst-case dimension of risk appetite is often prescribed by regulators in the case of banks as the required reserve capital, or by the marketplace based on assessments by investors determining the stock price.

The world is not simple. Risk appetite for nonmonetary situations is still concerned with the likelihood of surprises or deviations from the expected, including the worst case. Conceptually it is exactly the same as the simple financial example. However, it usually is not possible to adequately calculate risk levels, determine with some certainty the capacity of the organization’s reserves, robustness, and resilience, and determine the risk appetite. While the three estimation processes are the same, the lack of measurements for risk and the capacity of reserves and resilience mean that subjective methods must be used.

Determination of risk appetite “worst case” may be done as follows:

  • Extreme values of risks are aggregated for the organization where they are “named” described and estimated, by quantitative methods if possible.
  • Requirements for resilience, robustness, and reserve capacity to manage some reasonable and plausible likelihood of extreme risk consequences is calculated.
  • Estimate of available resilience, robustness, and reserve capacity from step 2 is compared to the requirements from step 1 and the risk appetite is set by specifying in some way the limits on risks that can be accepted by the organization. This is a messy process to say the least.
  • Risk appetite is refined continuously as risk criteria are applied to actual risk management activities in the organization at various levels in the organizational structure. Events such as precedence-setting court cases, catastrophic failures, and other “black swan” events will lead to review of the risk appetite, but there should also be routine periodic monitoring and evaluation.
  • Risk appetite “average” can be calculated by the same analysis procedure and it is recommended that the same process be used for each dimension. This will allow for a consistent approach to the setting of the risk criteria to meet both the business case objectives as well as the survival objectives.

Organizations face many different categories or “silos” of risks such as reputation risks, financial risks, health risks, market risks, and so forth. The equivalencies of levels of risk between these silos must be estimated for purposes of risk appetite. This may be done by using a four or five interval rating scale, with appropriate descriptors such as “level 1 (negative) reputation risk is being on the front page for three days” or “level 3 (positive) competitive market risk is 40 percent above target sales.” Often an organization uses a workshop process to determine the risk appetite equivalencies.

For some categories, such as financial resilience of the organization, the interval scale can be anchored in historical data such as the stock market and other measures of the health of organizations subject to shocks of different magnitudes. For risks with no quantitative measures it may still be possible to anchor qualitative estimates to previous historical situations and outcomes.

Risk appetite is applied throughout the organization in the RMP through the risk criteria. The risk criteria often include limits or checklists for decisions. If these limits are exceeded then the decision gets escalated to the next higher level. While the aggregation of risks can in some situations be quantitatively assessed through Monte Carlo and other simulation methods, in general this is not possible and like much of risk management the only recourse is to subjective methods of risk assessment with rigor and checks provided through various techniques. One well-known technique borrowed from the justice system is cross-examination of evidence (or devil’s advocate methods) to illuminate the plausible range of likelihood for specific events.

Policies for Risk Management Decisions: Risk Criteria

Risk criteria are based on the objectives of the organization as well as the risk appetite and the risk management context. The organization’s objectives may consider ethical and moral positions, existing laws, treatment of employees, clients, suppliers, and customers, climate change, and environmental impacts. In general, the policy will be to accept these as minimums to be exceeded so they are never violated. These policies usually specify how they will be monitored and reviewed for corrective action where needed.

For policies on sustainability of community, historical artifacts and heritage, health, climate change, environmental improvement, and so forth, organizations may select targets using accepted indicators such as carbon footprint, emissions, frequency of violations, and so forth. Targets are published in the organization’s annual report along with past performance.

The new approach to safety and other risks with negative consequences is that while social, ethical, and moral considerations are paramount this does not preclude a pursuit of other objectives such as profits. Indeed, often the controls for safety can also provide competitive advantage and other positive objectives as well for the same level of safety achieved in a different way. For example, in the 1970s Jaguar achieved air pollution standards by redesigning the engines and at the same time achieved more power and improved fuel economy, while others used add-on devices that increased fuel usage and lowered power.

At the organization level there may also be policy positions on expansion of the organization, leadership in sector, sustainability, reputation, excellence, or creation of employment, and other social goals.

The risk criteria are established at the level of the individual decision making. At the framework level the organization will establish the risk appetite and the associated guidance for risk criteria. Risk criteria should include anything and everything the organization values, has committed to, and that is reflected in its objectives. Risk criteria may be limits, optimization criteria, conditional, or almost anything. Risk criteria, while set prior to decision making, should be subjected to periodic review and may even in unusual situations be reviewed during specific risk management processes.

Policies for Risk Management Decisions: Risk Reporting

Integration with the organization’s structure and reporting require that risks be aggregated both vertically and horizontally and similarly risk appetite disaggregated to the individual manager’s level of interest. The problem is typically defined by the structure of the organization chart and the lines of reporting and direction between components of the organization chart.

This is a policy issue because there are many different ways to do the aggregation and disaggregation. In some cases, such as use of resources, profits, revenues, and so forth, standard accounting procedures can be used. Even in these cases methods for modeling uncertainty may not usually be specified. For example, in Basel II the method to be used for the value at risk is left to the individual organization and is not specified.

The policy-setting task is complicated by the shift from predominance of qualitative measures at the strategic level to predominantly quantitative measures at the local manager’s level such as numbers of units, percentage of the budget, number of employees, value of sales, and cost of insurance. The issue is how to compare these numerical values to the risk appetite. There is much scope for risk in the reporting function and the impact on risk appetite, for example, should be managed in some way.

Review of Policies

Policies can be poorly implemented and their effectiveness degrades over time. A key dimension of an ERM framework is to have policies that are simple to understand, work, and can be reviewed over time to ensure they are sustained and continuously improved. Every day newspapers provide examples of organizations that fail because policies were not followed.

For example, Nick Leeson at Barings Bank (Wikipedia 2009b) was provided with funds in excess of his organization’s policy limits within the month he lost all his funds and bankrupted the organization. Similarly, inquiries into the October 2008 financial disaster will uncover hundreds of these failures of policy implementation leading to the collapse of many organizations.

Simplicity is essential. Many years ago I observed the setting of key performance indicators for transit services in London, England. In an exemplary way the list of key performance indicators were reduced from more than 100 to just 1; that is, “passenger miles per pound.” Everyone could understand the indicator, it could be calculated from existing data, and it drove the organization in the direction of its key objectives—to produce riders and to save money. Moreover it played a key role in setting risk appetite and in structuring risk criteria as managers at all levels could relate the current value of the performance indicator to their own activities and risks.

There is a need for the review of organizational successes and failures using root cause analysis and other methods to determine the role of policies, policy maintenance, and application of policies.

In the initial stages of implementing a framework for ERM much of the risk management activity will concern integration of existing risk management processes. This can provide an opportunity to review policies because they will be integrated into the ERM framework one by one. The review of associated historical data on risk management decisions also provides a unique opportunity to review risk appetite and risk criteria policies. In workshops using evidence on costs of risk management, effectiveness of controls, and so forth, the organization can refine policy but also gain internal credibility about the value of the ERM framework. Typically, once a recommendation comes out of this process people come forward and say “I always thought it should be that way.”

Last but not least the ERM framework should itself be reviewed. Are risks reduced or enhanced by controls? Does risk management produce value through reduction of uncertainty? Are better decisions made and strategic planning improved? Too often, “number of inspections,” “coordinating meetings held,” “risk priority ratings,” and other irrelevant and intermediate process statistics find their way into monitoring and review of risk management frameworks. Indicators that measure objectives are more difficult to develop but are the only meaningful measures of the success of ERM.

INTEGRATION OF RISK MANAGEMENT AND RESOURCES FOR ERM

ERM is not stand-alone but is fully integrated with the organization’s management, reporting, roles and responsibilities, right down to taking out the garbage—everything works as one. It is for this reason that ISO emphasizes not being certifiable. Since ERM is intended to be aligned and integrated with the organization’s management structure and since the organization’s management structure is not certifiable as right or wrong (in fact, the flavor of the month is expressed by the current popular “how to” business book from management by objectives and in search of excellence), then it follows that ERM is not certifiable.

Integration of ERM is made possible since risk relates to uncertainty of achieving objectives and the goal of the general management of an organization is to achieve objectives. Objectives provide the glue for integration of ERM into the organization processes. Although the name is no longer popular, “management by objectives” is still a defining characteristic of organizational management.

There are two keys to making ERM integrated: (1) the top down key and (2) the bottom up key. If senior management makes it clear that ERM will be done and then adjust their own processes to explicitly consider risk in all their decisions, then the signal will be loud and clear and other managers will see the advantage of implementing ERM and including risk considerations in all decisions. In one large organization, once it became clear that the central organization was using ERM then there was a big demand for the one-person risk department (they have about 35,000 employees) to help the various divisions with implementing ERM—there was a 1½-year backlog for resources to facilitate workshops to initiate ERM in suborganization units (personal communication, name withheld on request).

The second key to integrating ERM is found in incorporating existing risk management processes into the framework. Existing processes for credit risk, site remediation, health and safety, operational risks, HR procurement and firing, maintenance, achieving sales targets, and so forth, are integrated one by one into the framework. This will require considerable effort since regulations and/or industry or professional norms may require alternative terminology and processes.

One approach to the bottom-up issue is to construct dual-labeled diagrams to show both ISO and the existing regulations and/or industry or professional terminology. It is also likely that many existing risk management approaches will be revisited and revised to be ISO compatible. For example, Australia has adopted a guideline for audit and assurance planning based on the ISO 31000 risk management process. Also the standard for medical devices was recently revised and is aligned with the ISO 31000 approach to risk management. (For example, see ISO 14971 2007, “Medical Devices—Application of Risk Management to Medical Devices,” 2nd ed.).

Integration of ERM, particularly the risk management process of Exhibit 7.1 is facilitated by the fact that most organizations are structured around a natural set of processes and tasks that reflect how they produce their products, goods, or services. For example, a company that produces widgets has a supply purchasing department, a production department, a sales department, a storage facility, a shipping department, a customer service department, a legal department, internal audit, and so on—a set of departments that mirror the flow of tasks for producing and selling widgets. The risks also tend to be characterized by the same departmental structure. For all these reasons the ERM framework has a natural integration structure given by the existing organizational structure.

In larger organizations, full integration of ERM will likely take from three to five years once ERM is initiated. This is because of delays in moving from level to level in the organization (often meeting in the middle if a start is made from the bottom up and the top down), to allow time for one or two continuous improvement cycles, and the need for extensive change management to overcome inherent inertia. For example, BHP Billiton, a large mining firm with about 200,000 employees, the process took about four years and this was considered record time.

The implementation plan, created as a part of implementing the framework, should be used as the basis for monitoring the implementation of risk management in the organization and adjusting the plan where necessary. Issues of change management, strategic planning, and business processes should be reviewed to ensure effective integration of ERM.

One dimension of integration of ERM is the provision of resources, including funds and expertise to ensure that managers have the resources for ERM. This could be done on annually and be included in the general budgeting process rather than a separate process for ERM. In most cases, internal resources, particularly for training and other roll-out activities illustrated in Exhibit 7.1, may need to be supplemented by external resources.

Integration is greatly assisted by communications, accountability, and continuous improvement, the next three components of the framework.

COMMUNICATIONS, CONSULTATION, AND REPORTING

Communication and consultation—“continual and iterative processes that an organization conducts to provide, share or obtain information and to participate in dialogue with stakeholders (3.3.1.1) and others regarding the management of risk.”

—ISO Guide 73

The information can relate to the existence, nature, form, likelihood, severity, evaluation, acceptability, treatment, or other aspects of the risk management. Consultation is a process of informed communication between an organization and its stakeholders on an issue prior to making a decision or determining a direction on a particular issue. Consultation is a process not an outcome, which impacts on a decision through influence rather than power; and about inputs to decision making, not joint decision making. Internal communication and consultation should be appropriately recorded.

Communication about the framework and its elements is needed both for internal and external stakeholders. This is to inform and to be informed. Internal communications during the implementation of ERM are important to ensure that everyone in the organization knows what the ERM framework is and what is expected of them.

The framework should identify the responsibilities for risk communications and the role for managers as to what information they should provide about their operations, decisions, risks, and so forth. These responsibilities normally will include communication about both the risk and the risk controls on a periodic basis. The risk communications will utilize performance indicators for the risks and risk management, but also may have their own performance indicators to allow for monitoring and review of risk communications. The latter may include measures of stakeholder satisfaction with communications and consultation.

Of particular importance is communications during crisis situations and the execution of business contingency plans after a crisis. Communication policies would speak to questions such as: What is a crisis? Who is in charge? Who is authorized to be the official organization spokesperson? What should employees do? What steps should be taken? Who should communicate to customers? What communication principles and guidelines should be followed? (e.g., tell the truth, indicate what has happened, say what the organization is doing, tell others what actions they should do, do not promise things that cannot be delivered, speak only about things in your area of responsibility, partner with respected organizations, test messages) (Leiss 2009).

As reflected in the ISO definition above, consultation is a critical component in the ERM framework. Although decision making is the prerogative of the organization and managers in the organization, information from stakeholders can help inform decisions and assist with the continuous improvement of ERM. Consultation about communication is also needed. The external communication framework should pay particular attention to legal, regulatory, and governance requirements.

ACCOUNTABILITY

The ERM framework should specify or have a process that will specify who is accountable for every identified risk in the organization as well as who is responsible for controls to treat the risk. Managers should have the authority for managing the risks or controls they are accountable for and their performance should be evaluated and appropriately rewarded. Continuous improvement of the controls and the risk management process is also part of ownership.

Everyone in the organization should know who “owns” each risk or risk control and this is usually contained in a (risk) management information system consisting of a collection of risk registers, treatment plans, reporting templates, and assurance plans. The management information system can contain as many as 100,000 risks in large organizations and to be practical it should be aggregated into risk registers levels corresponding to the levels in the organization. Since ERM is integrated into the organization the levels of aggregation of risks will naturally follow the regular organization roles and responsibilities, so no additional organizational structure should be needed.

The ERM framework itself should have an owner who is accountable for the implementation of ERM in the organization and for its continuous improvement. This owner may also have the responsibility for communication and consultation for ERM as per above.

CONTINUOUS IMPROVEMENT

ERM frameworks are always a work in progress. In the initial years of implementation ERM may be limited to areas with high benefits and ease of implementation. Even after a number of years of implementation the framework will be in a state of change, albeit at a lower rate. This is because of “continuous improvement” in the framework.

The risk management performance of individual managers is usually monitored and continuously improved through a hierarchy of four review processes:

  1. Self-evaluation by the individual manager, perhaps with cooperative assistance from other managers in a mutual mentoring situation.
  2. Internal audit of the manager’s department, including the functioning of ERM, particularly the risk management process component of ERM (Standards Australia 2005).
  3. External audit of critical risks and controls (usually auditing process and performance rather than prescriptive check lists), often as a regulatory activity, for example, to ensure public safety.
  4. External review of risk management through participation by the organization in standards organizations, industry-wide user groups, and so forth. This activity contributes to excellence in risk management.

The ERM framework should specify a set of rules for determining the appropriate degree of oversight needed for individual risk or risk control owners.

Monitoring and review of the framework on a periodic basis should look at the framework and the risk culture in the organization: Is the framework implemented? Are the framework policies still appropriate? Do managers accept the framework as the norm? Are risk treatments reducing the effect of uncertainty on objectives? Do external stakeholders have an enhanced appreciation of the organization and trust it to manage risks that impact them? Is the ERM framework “Goldilocks” with just the right level of effort?

Monitoring activities for continuous improvement of the framework may result in a measure of the risk management maturity of the organization: How far along the road to excellence in risk management is the ERM framework? Is there a demonstrated capacity to maximize the organization’s opportunities and minimize their threats? The basic elements of risk management maturity for an ERM framework are given in Annex A, “Attributes of Enhanced Risk Management” of ISO 31000, under five attributes:

  1. Continual improvement in risk management through the setting of organizational performance goals, measurement, review and the subsequent modification of processes, systems, resources, capability, and skills. Risk management should use key performance indicators designed to measure success in meeting the organization’s objectives.
  2. Accountabilities for risk management should be assigned to qualified individuals who are adequately resourced.
  3. Explicit evidence of risk management processes both in management processes and in decision making.
  4. Effective external and internal risk management communications is essential. Comprehensive and frequent internal and external reporting on both significant risks and on risk management performance contributes substantially to effective governance within an organization as well as trust by stakeholders.
  5. Risk management is embraced and embedded into management processes by all levels of management as integral to achieving the organizational objectives.

CONCLUSION

ISO 31000 provides an internationally recognized benchmark for the design and implementation of ERM framework for risk management. The ISO 31000 approach for developing and implementing ERM is similar to and compatible with other approaches but is the first standard to provide a complete and practical solution. It will be published in 2009.

The components of this comprehensive and practical ERM framework are outlined in this chapter. Each organization must determine from its own context how the components of the ISO ERM framework should be integrated into their organization to achieve an ERM framework that will be both comprehensive in scope and practical for the organization.

An ERM framework can often be implemented advantageously in a step-by-step way with considerable learning done along the way. Vertical committees can provide design and validation of key parts of the framework such as the risk management process. This approach will also assist in building acceptance of ERM and encouraging a risk culture, particularly if potentially successful areas are selected for the first steps.

As the risk management culture matures in the organization there should be noticeable improvements in the ability to discuss risks easily, decision making under uncertainty, comfort levels with risk situations, and achievement of objectives.

REFERENCES

Broadleaf Capital International. 2008. Home page, www.broadleaf.com.au/index.html.

Crawley, F., and Preston, M. 2008. HAZOP: Guide to best practice, London: Institution of Chemical Engineers.

Deming, W.E. 1986. Out of the crisis. Cambridge, MA, MIT Press.

ISO 2007. ISO 14971. Medical devices—Application of risk management to medical devices (2nd ed.), Geneva.

ISO 2009. ISO 31000. Risk management—Principles and guidelines, Geneva.

ISO 2009. ISO/IEC. Guide 73, risk management—Vocabulary, Geneva.

James, L.D., and Lee, R.R. 1971. Economics of water resources planning. New York: McGraw-Hill.

Kloman, F. 2008. Mumpsimus revisited: Essay on risk management,” Chapter 8. Risk Communication. Lyme, CT, Seawrack Press, Inc./Xlibris Corporation.

Leiss, W. 2009. Home page for risk communication. McLaughlin Center for Health Risk Assessment, University of Ottawa, Canada. www.leiss.ca/index.php?option=com_content&task=view&id=75&Itemid=55.

Standards Australia. 2005. HB 254. Governance, risk management and control assurance. Sydney, Australia.

Taleb, N.N. 2007. The black swan: The impact of the highly improbable. New York: Random House.

Wikipedia 2009a. Failure mode and effects analysis (FMEA). http://en.wikipedia.org/wiki/Failure_mode_and_effects_analysis.

Wikipedia 2009b. Nick Leeson and the failure of Barrings Bank. http://en.wikipedia.org/wiki/Barings_Bank.

ABOUT THE AUTHOR

John Shortreed recently retired as Director of the Institute for Risk Research (www.irr-neram.ca) after 28 years of risk research, including hazardous materials, blood systems, emergency response, air quality and health, all modes of transportation, land use, criteria for public safety, pharmaceutical drugs, risk frameworks, and standards development. He is a member for Canada of ISO 31000 (2009) working group and was also the Canadian representative for ISO Guide 73 (2002). He has participated for 15 years in the development of risk standards in Canada, with particular attention to frameworks for risk management for both public and private organizations. He is a jack of all risk management trades and master of none. He continues with risk research activities, particularly into the changes that will be required in response to the ISO 31000 risk management standard. ISO 31000 requires integrated organization-wide ERM with specified risk ownership accountability, as well as allowing for positive consequences for risks. For example, these changes will require extensive changes in risk assessment methods and implementation of risk management in organizations.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
18.118.253.223