Aligning Key Enterprise Risk To Strategic Initiatives .
Aligning Key Enterprise Risk toStrategic Initiatives Using MetricsRisk Management: Rising to the ChallengesChrystina Howard, ARM, CRM, CICKenneth Felton, RN, MS, CPHRM, DFASHRM
Aligning Risks to Strategy
Learning ObjectivesAt the end of this session, you will: Understand how to identify key risks that may have an impact on theachievement of organizational goals Understand how to identify relevant quantitative and qualitative metrics tomonitor performance against plan Understand how to map key risks to core strategic initiatives in order toachieve enterprise objectives
Agenda1. Outline the ERM process, benefits & output2. Demonstrate the link between ERM success andstrategic objectives3. Using KRIs, KPIs and strategic objectives to optimizeachievement of organizational goals
Risk Evaluation
Enterprise Risk AssessmentStrive to achieve the 3 Es of Assessment1. Economy - Controlling the cost of the assessment2. Efficiency - Completing the assessment with minimumexpenditure of effort3. Effectiveness – Achieving the results or benefits basedon the stated scope and goals of the assessment
Risk Identification: 80/20 Rule Organizations have a tendency to spend 80% of their timeidentifying risks But only 20% doing something about themFlip the 80/20 RuleSpend 80% of your time fully articulating risks, assessing impact andlikelihood, and developing risk mitigation strategies to reduce theimpact on the organization
Risk Assessment Objective: identify and articulate the most relevant risks that couldimpact the organization’s ability to achieve objectives Don’t “Boil The Ocean” Assessment methods:o Structured interviewso Internal audits of existing risk assessmentso Public domain searcho Comprehensive on-line risk survey with write-inso Facilitated, cross-functional workshops
Define the Scope Define the guidelines for the assessmentExample:Assess the major risks to Memorial Hospitalachieving its strategic business objectives overthe next 3 years.
Risk Prioritization Begin by roughly ranking a broad risk list Target 20-25 top risks for a deep dive Fully articulate each risk Assess Impact and Likelihood based on consensus Results in prioritized risk profile
Risk ArticulationFully articulate the risk into component parts: Most risk descriptions focus on triggering events Essential to identify key drivers or existingcharacteristics that make the organization vulnerable List specific consequences that all stakeholders canunderstand Identify the controls currently in place to specificallyaddress each risk
Risk Articulation
Qualitative Risk DistributionRisk Distribution After Improvements65545322321321LikelihoodLikelihoodRisk Distribution With Current Controls61123Impact4531412234100463100123Impact456
Risk CategoriesAnalysis by Source of Riskand Stratified by Risk Rank (Before Improvements)StrategicRegulatoryPatient ManagementQualityFinancialHuman CapitalInformation TechnologyOperational0GRS 15115 GRS 102310 GRS 747 GRS 356GRS 3
Improvement planningRisk No.1 : Unable to Attract Qualified PersonnelLocal area and pay scale; Specialized nature of work; High standards ofUnderlyngexcellence; Aging workforce; Lack of budgetary agility; HR departmentVulnerabilities understaffed & resources divertedRisk ScoresBeforeImprovementAfterImprovementUnable to attract qualified, specialized personnel in multiple criticalpositions for 12 monthsImpactLikelihoodGRS44163395TriggersLack of leadership and direction; Increased work burden; Decreasedemployee morale; Further difficulty in recruiting; Higher turnover;Consequences Reputational impact; Unable to accomplish goals and objectives ofStrategic PlanCurrentControlsHR programs to retain talent; Monitoring of key metrics by HR;Attractive recruitment packages compared to competitors; Outsideprofessional servicesLikelihood4Before3After2112345ImpactRisk Number1ActionDemonstrate additional staffing needsDevelop and deploy a marketing and PRstrategy for Local areaEvaluate vendors for Talent ManagementSystem consolidationEvaluate Compensation ProgramRisk NameUnable to Attract Qualified PersonnelMeasure of SuccessPerform time study on utilization of resources and presentconclusions on staffing needs to Senior Execs.Develop and deploy a marketing and PR strategy for LocalareaTalent Management System consolidated under a singlevendorProvide recommendations on improvementsCategoryHuman CapitalAllocated c-2015Jim31-Jul-2015
What ERM Achieves1. Systematic & objective management of multiple andcross-enterprise risks2. Reduction in operational surprises to better seizeopportunities3. Improvement of business performance4. Link between risk management and organizationalperformance; and alignment with strategic planning5. Increase in risk awareness throughout theorganization
What ERM Achieves6.7.8.9.Increased decision support for resource allocationReduction in the total cost of riskOptimization of capital efficiencyImprovement in organizational value, andsustainable competitive advantageERM aligns strategy, people, processes,technology, knowledge, with the objective ofcontinuously improving the organizations riskmanagement capabilities over time
Organizational Objective Setting“If you don’t know where you’re going, then any roadwill get you there.” This line from Alice in Wonderlandis true for many organizations1The importance of setting appropriate objectives isitself an organizational objective.Strategy setting is a fluid and dynamic process.The Importance and Value of Organizational Goal Setting, Managing and Achieving Organizational Goals, pg. 1.
“One clear vision beats a diluted vision, every time.”Bob Parsons
2017 Report of The State of Risk Oversight
2016 Report on the State of Risk eDocuments/AICPA ERM Research Study 2017.pdfResearch conducted by the ERM initiative at North Carolina State UniversityThe report summarizes the findings of organizational risk oversight againstcurrent practiceMost notably, opportunities to identify and assess key risks especially withstrategic planning activities
Links Between Strategy and RiskThe company’s management and its board of directors should analyzethe links between various strategic options and the risks they entailwhen entering into a strategic planning process (Smith,2012). 30% of Boards either mostly or extensively review the top risks duringstrategic planning discussions2Lord Levene: “ With a clear understanding of the risks they face businessescan maximize their performance and drive forward a competitive edge”Boards that understand top risks – respond proactive, targeted and focusedWalid Ben-Amar1, Ameur Boujenoui1 & Daniel Zéghal1 , The Relationship between Corporate Strategy and Enterprise RiskManagement: Evidence from Canada, Journal of Management and Strategy Vol. 5, No. 1; 2014, pg.12 – Beasley, Mark , Branson, Bruce, Bonnie Hancock, 2017 THE STATE OF RISK OVERSIGHT: AN OVERVIEW OF ENTERPRISE RISK MANAGEMENTPRACTICES 8th Edition March 2017, pg, 15.
Setting Strategic Goals1.Ensure you have an effective set of processes for identifying,understanding, and assessing risks to the setting and achievement ofobjectives.2.Understand the relationships between objective-setting, the managementof risks to those objectives, and the internal controls that manage thoserisks to acceptable levels.3.Understand that it is important to identify, understand, and manage risks tothe setting of objectives, and that is achieved by effective related internalcontrol.
Effective KRIsThe selection of effective Key Risk Indicators (KRIs)starts with a firm understanding of organizationalobjectives and risks related events and uncertaintiesthat may affect the achievement of those objectives.
KRIs (Key Risk Indicators) v. KPIs ( Keyperformance indicators)The two types of indicators should be implemented for effectivemanagement of risk. It is important to understand and distinguishbetween the two indicators: KPI's are Key Performance Indicators designed to offer a highlevel overview of the historical performance of the enterpriseor its key operations. KRI's are Key Risk Indicators and are born out of high-qualitydata used to track a specific risk and provide a real-timeindicators that offers information about emerging risks. Safeguarding an organization from risk, necessitates a periodicand regular review of these Key Performance MetricsEmil Scarlat, PhD, Nora Chirta, PhD Indicators and Metrics used in the Enterprise Risk Management(ERM),
KPI's – KRI'sKPI's: Identify underperforming aspects of enterprise thatmerit increased resourcesKRI's: Based on standardsQuantifiableEasily applied and understoodValidate or invalidate decisions
Four Categories of IndicatorsCoincident indicators can be thought of as a proxy measure of a loss event andcan include internal error metrics or near misses.Causal indicators are metrics that are aligned with root causes of the risk event,such as system down timeControl effectiveness indicators provide ongoing monitoring of theperformance of controls. Measures may include control effectiveness, such aspercent of supplier base bypassing controls, such as dollars spent with nonapproved suppliers.Volume indicators (sometimes called inherent risk indicators) frequently aretracked as key performance indicators; however, they also can serve as a KRI. Asvolume indicators change, they can increase the likelihood and/or impact of anassociated risk event.Aravind Immaneni, Chris Mastro and Michael Haubenstock, A Structured Approach to Building Predictive Key Risk Indicators,Operational Risk: A Special Edition of The RMA Journal May 2004, pg. 42.
Reporting of KRI'sThe Current State of ERM Oversight Report:41 % admit to not being “at all satisfied” or “minimally satisfied”with the nature and extent of the reporting of key risk indicatorsto senior executives.33 .Beasley, Mark, Branson, Bruce, Hancock, Bonnie, 2017 Report on the Current State of Enterprise Risk Oversight, pg. 29
Balance Risk and OpportunityTo obtain the best possible alignment ofperformance management and risk managementand balance risk and opportunity each KRI shouldbe linked to a KPI
Mapping Key Risks Mapping key risks to core strategic initiatives allowmanagement to identify the most criticalmetrics and monitor their performance. These metrics can help oversee theimplementation of core strategic initiatives andreduce chances of disruption Communicate, Communicate, CommunicateThe Power of Key Risk Indicators (kri's) in Enterprise Risk Management (ERM), Metric Stream, 2015 , pg. 2.
Linking Risks to KRIsCOSO Developing Key Risk Indicators to Strengthen Enterprise Risk Management, December 2010, pg. 2.
Maximo Schliemann, Establishing Key Risk Indicators for IT,, July 31, 2012, slide 25.
COSO Developing Key Risk Indicators to Strengthen Enterprise Risk Management, December 2010, pg. 5.
Strategic Risk ModelER Service Line PatientFlowINCREASE REVENUESUnable to meet earlyphlebotomy and lab resultsdeliveryDecreasing HCAHPS ScoresKRIs% Lab results within 30 minutesDoor to Doc times within standardDecrease ED LOSKRI:KPI: Increase in OperatingMarginPOTENTIAL RISKSTRATEGIC INITIATIVEKRI:PROFITABILITYPOTENTIAL RISKSTRATEGIC INITIATIVEREDUCE COSTKRI:POTENTIAL RISKKPI: Decrease in Cost toCollectKRI:STRATEGIC INITIATIVE POTENTIAL RISK
Metrics offer multiple benefits1.2.3.4.5.6.7.8.9.Early identification of trends and issuesRepresents a source of critical information for controlProvides information about the likelihood of achieving target sites,Helps to make decisions based on informationHelps in evaluating performanceLeads to a proactive managementImproves future estimates and performanceEvaluates success and failureImproves customer satisfactionWalid Ben-Amar1, Ameur Boujenoui1 & Daniel Zéghal1 , The Relationship between Corporate Strategy and Enterprise RiskManagement: Evidence from Canada, Journal of Management and Strategy Vol. 5, No. 1; 2014, pg.1
The Value of Metrics in ERMConclusion:Organizing, monitoring, reviewing and communicating KRIsprogress and their impact on KPIs provide a holistic riskmanagement strategy which increases the value of thebusiness. These metrics align performance with timelydecision making, resource allocation and the achievement ofstrategic initiatives.
Just in Case
Thank you!Risk Management: Rising to the Challenges
KPIs ( Key performance indicators) The two types of indicators should be implemented for effective management of risk. It is important to understand and distinguish between the two indicators: KPI's are Key Performance Indicators designed to offer a high-level overview of the historical performance of the enterprise or its key operations.
3 Enterprise Anti-Fraud Committee: Purpose: To establish governance, visibility, and direction for enterprise fraud risks, controls and response activities. Chartering committee: Enterprise Operational Risk Committee (EORC) Key Responsibilities: -Recommend:- Enterprise Fraud Risk Policy updates - Enterprise-level tolerances-Manage:- Enterprise fraud risk standards
Risk Matrix 15 Risk Assessment Feature 32 Customize the Risk Matrix 34 Chapter 5: Reference 43 General Reference 44 Family Field Descriptions 60 ii Risk Matrix. Chapter 1: Overview1. Overview of the Risk Matrix Module2. Chapter 2: Risk and Risk Assessment3. About Risk and Risk Assessment4. Specify Risk Values to Determine an Overall Risk Rank5
Enterprise Risk Management-Integrated Framework (Framework). The Framework, originally published in 2004, is a widely accepted framework used by . This initiative is intended to enhance the Framework's content and relevance in an . Explores enterprise risk management and strategy from three different perspectives:
enterprise risk management, inter nal control and fraud deterrence designed to improve organizational performance and governance and to reduce the extent of fraud in organizations". 8 Announced in October 2014 Update the 2004 Enterprise Risk Management-Integrated Framework Goal of:
Spartan Tool product. 2 1. Escape Key 2. Help Key 3. Standard Survey Key 4. WinCan Survey Key 5. Overlay Key 6. Overlay Style Key 7. Overlay Size Key 8. Footage Counter Key 9. Report Manager Key 10. Settings Key 11. Spa r e Function Key 1 12. Spa r e Function Key 2 13. Power Button 14. Lamp O 15. Lamp - Key 16. Lamp Key 17. V
1. 10,000 Reasons (Bless The Lord): key of E 2. Alive In Us: key of G 3. All Because Of Jesus: key of B 4. All Who Are Thirsty: key of D 5. Always: key of B 6. Arms Open Wide: key of D 7. At The Cross: key of E 8. Blessed Be Your Name: key of B 9. Break Free: key of A 10. Broken Vessels (Amazing Grace): key of G 11. Come As You Are: key of A 12 .
operational risk management as part of enterprise risk management. Keywords: Operational Risk, Enterprise Risk, Banking, Financial Services, Cyber Risk 1 Clinical Associate Professor, Managerial Economics and Decision Sciences. Kellogg School of Management Northwestern University, Evanston, IL USA. E-mail: russell-walker@kellogg.northwestern.edu
Studies have shown veterinary surgeons do not feel they receive adequate training in small animal nutrition during veterinary school. In a 1996 survey among veterinarians in the United States, 70% said their nutrition education was inadequate. 3. In a 2013 survey in the UK, 50% of 134 veterinarians felt their nutrition education in veterinary school was insufficient and a further 34% said it .
