A Structured Approach To Enterprise Risk Management (ERM) And The .

Recording risk assessmentsRisk assessment involves the identification of risksfollowed by their evaluation or ranking. It isimportant to have a template for recordingappropriate information about each risk. Table 1shows the range of information that may need tobe recorded. The objective of a template is toenable the information to be recorded in a table,risk register, spreadsheet or a computer-basedsystem. Although a simple description of a risk issometimes sufficient, there are circumstanceswhere a detailed risk description may be requiredin order to facilitate a comprehensive riskassessment process.The consequences of a risk materialising may benegative (hazard risks), positive (opportunity risks)or may result in greater uncertainty. Organisationsneed to establish appropriate definitions for thedifferent levels of likelihood and consequencesassociated with these different risks. Risk rankingcan be quantitative, semi-quantitative or qualitativein terms of the likelihood of occurrence and thepossible consequences or impact.Organisations will need to define their ownmeasures of likelihood of occurrence andconsequences.For example, many organisations find thatassessing likelihood and consequences as high,medium or low, with the results presented on a 3 x3 risk matrix is adequate. Other organisations findthat more options are necessary and a 4 x 4 or 5 x5 risk matrix is required. By considering thelikelihood and consequences of each risk, it will bepossible to prioritise or rank the key risks forfurther analysis.Risk classification systemsAn important part of analysing a risk is todetermine the nature, source or type of impact ofthe risk. Evaluation of risks in this way may beenhanced by the use of a risk classificationsystem. Risk classification systems are importantbecause they enable an organisation to identifyaccumulations of similar risks. A risk classificationsystem will also enable an organisation to identifywhich strategies, tactics and operations are mostvulnerable.Risk classification systems are usually based onthe division of risks into those related to financialcontrol, operational efficiency, reputationalexposure and commercial activities. However,there is no risk classification system that isuniversally applicable to all types of organisations.Table 1: Detailed risk description1Name or title of risk Unique identifier or risk index2Scope of risk Scope of risk and details of possible events, including description ofthe events, their size, type and number3Nature of risk Classification of risk, timescale of potential impact and descriptionas hazard, opportunity or uncertainty4Stakeholders Stakeholders, both internal and external, and their expectations5Risk evaluation Likelihood and magnitude of event and possible impact orconsequences should the risk materialise at current level6Loss experience Previous incidents and prior loss experience of events related to therisk7Risk tolerance, appetiteor attitude Loss potential and anticipated financial impact of the riskTarget for control of risk and desired level of performanceRisk attitude, appetite, tolerance or limits for the risk 8Risk response, treatmentand controls 9Potential for risk improvement 105Strategy and policydevelopments Existing control mechanisms and activitiesLevel of confidence in existing controlsProcedures for monitoring and review of risk performancePotential for cost-effective risk improvement or modificationRecommendations and deadlines for implementationResponsibility for implementing any improvementsResponsibility for developing strategy related to the riskResponsibility for auditing compliance with controlsA structured approach to Enterprise Risk Management

This may be especially true for organisationsoperating in the public sector and those involved inthe delivery of services to the public.There are many risk classification systemsavailable and the one selected will depend on thesize, nature and complexity of the organisation.ISO 31000 does not recommend a specific riskclassification system and each organisation willneed to develop the system most appropriate tothe range of risks that it faces.2: Principles of risk managementRisk management is a central part of the strategicmanagement of any organisation. It is the processwhereby organisations methodically address therisks attached to their activities. A successful riskmanagement initiative should be proportionate tothe level of risk in the organisation, aligned withother corporate activities, comprehensive in itsscope, embedded into routine activities anddynamic by being responsive to changingcircumstances.The focus of risk management is the assessmentof significant risks and the implementation ofsuitable risk responses. The objective is to achievemaximum sustainable value from all the activitiesof the organisation. Risk management enhancesthe understanding of the potential upside anddownside of the factors that can affect anorganisation. It increases the probability ofsuccess and reduces both the probability of failureand the level of uncertainty associated withachieving the objectives of the organisation.Context for risk managementRisk management should be a continuousprocess that supports the development andimplementation of the strategy of an organisation.It should methodically address all the risksassociated with all of the activities of theorganisation. In all types of undertaking, there isthe potential for events that constituteopportunities for benefit (upside), threats tosuccess (downside) or an increased degree ofuncertainty.It is often argued that, for health and safety risks,the consequences can only be negative and themanagement of safety risk should focus onprevention and mitigation of harm. However, foroutsourced service providers, setting goodstandards of health and safety may be part ofwinning contracts and this demonstrates thatthere is an upside to safety risk management.6Risk aware cultureRisk management must be integrated into theculture of the organisation and this will includemandate, leadership and commitment from theBoard. It must translate risk strategy into tacticaland operational objectives, and assign riskmanagement responsibilities throughout theorganisation. It should support accountability,performance measurement and reward, thuspromoting operational efficiency at all levels.Achieving a good risk aware culture is ensured byestablishing an appropriate risk architecture,strategy and protocols.In order to successfully implement, support andsustain the risk management process, a structureis required. ISO 31000 refers to this structure asthe risk management context.Figure 1 illustrates a suitable structure in terms ofthe risk architecture, strategy and protocols, andbriefly describes the key features of each element.This structure is designed to give context to riskmanagement activities and support the riskmanagement process.Risk management processThe risk management process can be presentedas a list of co-ordinated activities. There arealternative descriptions of this process, but thecomponents listed below are usually present. Thislist represents the 7Rs and 4Ts of (hazard) riskmanagement: recognition or identification of risks ranking or evaluation of risks responding to significant risks tolerate treat transfer terminate resourcing controls reaction planning reporting and monitoring risk performance reviewing the risk managementframeworkA structured approach to Enterprise Risk Management

Figure 1: Risk architecture, strategy and protocolsRisk strategyRisk architecture Risk architecture specifies theroles, responsibilities,communication and risk reportingstructure Risk strategy, appetite, attitudesand philosophy are defined in theRisk Management PolicyRisk management processRisk protocols Risk protocols are presented in the form of the risk guidelines for theorganisation and include the rules and procedures, as well as specifying therisk management methodologies, tools and techniques that should be usedRecognition and ranking of risks together form therisk assessment activity. ISO 31000 uses thephrase ‘risk treatment’ to include all of the 4Tsincluded under the heading ‘risk response’. Thescope of risk responses available for hazard risksincludes the options of tolerate, treat, transferor terminate the risk or the activity that gives rise tothe risk. For many risks, these responses maybe applied in combination. For opportunity risks,the range of available options includes exploitingthe risk. Reaction planning includes businesscontinuity planning and disaster recovery planning.3: Review of ISO 31000ISO 31000 describes the components of a riskmanagement implementation framework. Figure 2provides a simplified version of this implementationframework. It includes the essential steps in theimplementation and ongoing support of the riskmanagement process. The initial component ofthe ISO 31000 framework is ‘mandate andcommitment’ by the Board and this is followed by:7 design of framework implement risk management monitor and review framework improve frameworkFramework for managing riskISO 31000 describes a framework forimplementing risk management, rather than aframework for supporting the risk managementprocess. Information on designing the frameworkthat supports the risk management process is notset out in detail in ISO 31000. An organisation willdescribe its framework for supporting riskmanagement by way of the risk architecture,strategy and protocols for the organisation.The risk architecture, strategy and protocolsshown in Figure 1 represent the internalarrangements for communicating on risk issues.It also sets out the roles and responsibilities of theindividuals and committees that support the riskmanagement process. The risk strategy should setout the objectives that risk management activitiesin the organisation are seeking to achieve. Finally,the risk protocols describe the procedures bywhich the strategy will be implemented and risksmanaged.4: Achieving the benefits of ERMFigure 3 provides a simplified version of the riskmanagement process from ISO 31000 using theterminology of Guide 73. The key stages in theprocess are represented as risk assessment andrisk treatment. Figure 3 also indicates that the riskmanagement process takes place within the riskmanagement context of the organisation.A structured approach to Enterprise Risk Management

Figure 2: Framework for managing risk (based on ISO 31000)Mandate and commitmentDesign of framework Organisation and its context Risk management policy Embedding risk managementImprove frameworkImplement riskmanagement Implement frameworkImplement RM processMonitor and review frameworkRisk assessmentRisk identification establishes the exposure of theorganisation to risk and uncertainty. This requiresan intimate knowledge of the organisation, themarket in which it operates, the legal, social,political and cultural environment in which it exists,as well as an understanding of strategic andoperational objectives. This will include knowledgeof the factors critical to success and the threatsand opportunities related to the achievement ofobjectives. It should be approached in amethodical way to ensure that all value-addingactivities within the organisation have beenevaluated and all the risks flowing from theseactivities defined.The result of the risk analysis can be used toproduce a risk profile that gives a rating ofsignificance to each risk and provides a tool forprioritising risk treatment efforts. This ranks therelative importance of each identified risk. Thisprocess allows the risks to be mapped to thebusiness area affected, describes the primarycontrol mechanisms in place and indicates wherethe level of investment in controls might beincreased, decreased or reapportioned.The risk analysis activity assists the effective andefficient operation of the organisation by identifyingthose risks that require attention by management.This will facilitate the ability to prioritise risk controlactions in terms of their potential to benefit theorganisation. The range of available risk response8treatments include tolerate, treat, transfer andterminate. An organisation may decide that thereis also a need to improve the control environment.Risk treatmentRisk treatment is presented in ISO 31000 as theactivity of selecting and implementing appropriatecontrol measures to modify the risk. Risktreatment includes as its major element, riskcontrol (or mitigation), but extends further to, forexample, risk avoidance, risk transfer and riskfinancing. Any system of risk treatment shouldprovide efficient and effective internal controls.Effectiveness of internal control is the degree towhich the risk will either be eliminated or reducedby the proposed control measures. The costeffectiveness of internal control relates to the costof implementing the control compared to the riskreduction benefits achieved.Compliance with laws and regulations is not anoption. An organisation must understand theapplicable laws and must implement a system ofcontrols that achieves compliance. One method ofobtaining financial protection against the impact ofrisks is through risk financing, including insurance.However, it should be recognised that somelosses or elements of a loss may be uninsurable,such as uninsured costs and damage to employeemorale and the reputation of the organisation.A structured approach to Enterprise Risk Management

Feedback mechanismsISO 31000 recognises the importance of feedbackby way of two mechanisms. These are monitoringand review of performance and communicationand consultation. Monitoring and review ensuresthat the organisation monitors risk performanceand learns from experience. Communication andconsultation is presented in ISO 31000 as part ofthe risk management process, but it may also beconsidered to be part of the supportingframework.Reporting and disclosure are only very brieflymentioned in ISO 31000 and they are not includedin the process shown in Figure 3. Also, themonitoring and review feedback activities set outin ISO 31000 do not explicitly mention the tasks ofmonitoring risk performance and reviewing the riskmanagement framework.Figure 3: Risk management process (based on ISO 31000)Risk assessmentRisk identificationRisk analysisRisk evaluationMonitoring and reviewCommunication and consultationEstablish contextRisk treatment9A structured approach to Enterprise Risk Management

Part 2: Enterprise risk managementPart 2 provides an overview of the steps involved inthe implementation of an enterprise riskmanagement (ERM) initiative. The terminology usedin this part is based on the 7Rs and 4Ts of (hazard)risk management. A brief description of the stepsinvolved in the implementation of an ERM initiativeis provided in Appendix B.5: Planning and designingThere are a number of factors that should beconsidered when designing and planning an ERMinitiative. Details of the risk architecture, strategyand protocols should be recorded in a riskmanagement policy for the organisation. Table 2provides information on the contents of a typicalrisk management policy.Board mandate and commitmentMany organisations issue an updated version oftheir risk management policy each year. Thisensures that the overall risk management approachis in line with current best practice.It also gives the organisation the opportunity tofocus on the intended benefits for the coming year,identify the risk priorities and ensure thatappropriate attention is paid to emerging risks. Thepolicy should also describe the risk architecture ofthe organisation. Figure 4 illustrates a typical riskarchitecture of a large listed company.Mandate and commitment from the Board iscritically important and it needs to be continuousand high-profile. Unless this mandate andcommitment are forthcoming, the risk managementinitiative will be unsuccessful. Keeping the riskmanagement policy up to date demonstrates thatrisk management is a dynamic activity fullysupported by the Board.Table 2: Contents of risk management policyA risk management policy should include the following sections:10 Risk management and internal control objectives (governance) Statement of the attitude of the organisation to risk (risk strategy) Description of the risk aware culture or control environment Level and nature of risk that is acceptable (risk appetite) Risk management organisation and arrangements (risk architecture) Details of procedures for risk recognition and ranking (risk assessment) List of documentation for analysing and reporting risk (risk protocols) Risk mitigation requirements and control mechanisms (risk response) Allocation of risk management roles and responsibilities Risk management training topics and priorities Criteria for monitoring and benchmarking of risks Allocation of appropriate resources to risk management Risk activities and risk priorities for the coming yearA structured approach to Enterprise Risk Management

Scope of the initiativescope of the initiative will be defined by the range ofbenefits the organisation is seeking to achieve and thiswill be influenced by the expectations of the variousstakeholders in the organisation.In order to be successful, the ERM initiative needs tobe comprehensive. However, introducing enhancedstandards of risk management is a progressiveprocess that cannot be achieved instantaneously.Therefore, it is necessary for an organisation to decidethe scope of the ERM initiative, as it develops. TheFigure 4: Risk architecture of a large PLCAudit CommitteeThe Board Overall responsibility for riskmanagement Ensure risk management isembedded into all processes andactivities Review group risk profile Receive routine reports from GRMC Set annual audit programme and priorities Monitor progress with audit recommendations Provide risk assurance to the Board Oversee RM structures and processesGroup Risk Management Committee (GRMC) Formulate strategy and policy based on risk appetite,risk attitudes and risk exposures Receive reports from business units, review riskmanagement activities and compile the group riskregister Receive reports from business units and make reportsand recommendations to the Board Track RM activity in the business units and keep the riskmanagement context under reviewDisclosures Committee Review and evaluate disclosurecontrols and procedures Consider materiality of informationdisclosed to external partiesBusiness unitsDirect and monitorReports for evaluation11 Produce specific policy statements, as necessary Prepare and update the business unit risk register Set risk priorities for business unit Monitor projects and risk improvements Prepare reports for GRMC Manage control risk self-certification activitiesA structured approach to Enterprise Risk Management

Risk management frameworkDepending on the nature of the organisation, the riskmanagement function may range from a part-time riskmanager, to a single risk champion, to a full-scale riskmanagement department. The role of the internal auditfunction will also differ from one organisation toanother. In determining the most appropriate role forinternal audit, the organisation needs to ensure that theindependence and objectivity of internal audit are notcompromised.The range of risk management responsibilities thatneed to be allocated in the policy will be broad andextensive. Table 3 sets out examples of the riskmanagement responsibilities that may be allocated in atypical large organisation. The Board has responsibilityfor determining the strategic direction of theorganisa

This guide provides a structured approach to implementing risk management on an enterprise-wide basis that is compatible with both COSO ERM and ISO 31000. However, the guide places more emphasis on ISO 31000 because it is an international standard and many organisations have international operations. At the same time as