Introduction To ERM (Enterprise Risk Management)

Introduction to ERM(Enterprise Risk Management)

Jonathan Burns Director of Finance forParamount Health Caresince November 2014 Relocated to NW OH fromLexington, KY Prior roles in highereducation andbanking/finance Learned about ERM dueto compliance regulationsand implementedParamount’s ERMstructure and process Jonathan.Burns@ProMedica.org 419-887-2500

Agenda Define ERMBenefits of ERMComponents of ERMGovernance StructureDefine SRM

Define ERMEnterprise Risk Management (ERM):“A process effected by an entity’s board ofdirectors, management and other personnel,applied in strategy setting and across theenterprise, designed to identify potential eventsthat may affect the entity, and manage risk to bewithin its risk appetite, to provide reasonableassurance regarding the achievement of entityobjectives.”Source: ermInsights and John Bugalla andCOSO (Committee of Sponsoring Organizations)

Define ERM ERM is the process of planning, organizing,leading, and controlling the activities of anorganization in order to minimize the effectsof risk on an organization's capital and earnings. Strategic Risk Management (SRM) is a businessdiscipline that drives deliberation and actionregarding uncertainties and untappedopportunities that affect an organization’sstrategy and strategy execution.Source: ermInsights and John Bugalla

Define ERMERM consists of active and intrusive processes that:1) are capable of challenging existing assumptionsabout the world within and outside the organization;2) communicate risk information with the use ofdistinct tools (such as risk maps, stress tests, andscenarios);3) collectively address gaps in the control of risks thatother control functions (such as internal audits andother boundary controls) leave unaddressed; and, indoing so,4) complement - but do not displace - existingmanagement control practices.Source: ermInsights and John Bugalla andCOSO (Committee of Sponsoring Organizations)

Agenda Define ERMBenefits of ERMComponents of ERMGovernance StructureDefine SRM

Benefits of ERM Enhance board risk oversight responsibilities Required in certain industries (financial,insurance) Executive risk-informed decision making Individual risk silos do not work Create new measurable valueSource: ermInsights and John Bugalla

Benefits of ERM Volatility and uncertainty abound Competitive advantage is critical for futuresuccess Avoid the strategy-execution gap Enhance audit and compliance Lessen the impact of adverse eventsSource: ermInsights and John Bugalla

Benefits of ERMPlanning for Performance: “Give me six hours to chop down atree and I will spend the first fourhours sharpening the axe.”- Abraham Lincoln The process of getting there willultimately determine your finalresult. Planning is a veryimportant step to businessstrategy.Source: ermInsights and John Bugalla

Benefits of ERMStrategy-Execution Gap:Source: ermInsights and John Bugalla; CEB,Harvard Business Review

Benefits of ERMStrategy-Execution Gap:Source: ermInsights and John Bugalla; CEB,Harvard Business Review

Benefits of ERMSample Risk Categories: Underwriting OperationalModel RiskProduct PricingReservesNatural Catastrophe Strategic Regional Concentration ofRisk Reputation Global/National Economy Competition Availability of ReinsuranceRegulatory RiskIT RiskPersonnel Risk Market Investment Market Risk Liquidity Claims Credit Reinsurer CreditSource: Willis Re and Willis Towers Watson

Agenda Define ERMBenefits of ERMComponents of ERMGovernance StructureDefine SRM

Components of ERMSteps to design an ERM: Define desired programImplement ERM charterEstablish risk appetiteDefine tolerance levelsStart risk assessment process

Components of ERMFive Key ERM Practices:Source: Willis Re and Willis Towers Watson

Components of ERMDefine desired program: Use a gap analysis to survey leadership for desiredoutcome of ERMSource: ermInsights and John Bugalla

Components of ERMCriterion 1: Risk Organization & Governance Risk management function centered on compliance, audit and controls Silo-based risk managementprocesses Commitment to ERM from topmanagement and BoardEstablished risk officer or head of riskposition (may not be solely focused onrisk)Functioning cross-functional seniormanagement risk committeeRisk management viewed as a “partner”by the business unitsResources dedicated to risk managementat the enterprise levelExistence of some risk policydocumentationManagement “working group” forum fordiscussion of risk issuesA more holistic/enterprise view of riskRisk management roles and riskownership formally definedTraining provided to risk managementstaff and risk ownersSource: ermInsights and John Bugalla Functioning cross-functional senior managementrisk committeeRisk management viewed as a “partner” by thebusiness unitsEstablished CRO with authority at a senior level,reports to the CEO and with independent accessto the BoardERM roles and responsibilities established anddefined including ERM staff, risk owners,committees and BoardCommittee charters defined — roles,responsibilities, membership, reportingClearly documented risk policies, procedures,and risk baring capacity and appetiteFormal information flow from functions to ERM,senior management, and the boardERM/SRM duality is recognized - upside gainsStrong risk owners at function level identifyingboth risks and opportunitiesEmerging threats and opportunities identifiedand analyzedERM/SRM integrated and aligned with corporatestrategyStrategic information reported to board

Components of ERMCriterion 2: Risk Appetite and Tolerance Individual risk limits (e.g., trading,credit, operating, investment),mostly based on managementintuition and/or traditionLimited monitoring and reporting ofviolations to risk tolerances but nottied to corrective action and/orrevised risk tolerances, as needed Early stage development of risk appetitestatement articulated by seniormanagement, but lacks robustnessInclusion of risk appetite in riskidentification and assessment processRisk limits for individual risk categoriesarticulated at functional levelUnderstanding of risk profile in relationto risk appetiteClear limits defined and exceptionmanagement process in place, but notenforced Source: ermInsights and John Bugalla Risk appetite statement articulated(quantitative and qualitative) and incorporatesmultiple stakeholder viewpoints in definingmetricsRisk appetite and tolerances validated throughquantitative modelingAnnual approval and sign-off by the Board ofDirectors of key material risksCommunication of strategy, risk appetite andtolerances throughout the organizationModeling/reconciling top-down risk appetitewith bottom-up risk limitsFormal process for vetting models and newproductsApplying risk appetite to decision making,capital deployment, resource allocationEnforcement of risk and reward decisions withlinkage to compensation/performanceIncorporation of reputation impact into riskappetite and tolerance statementsAll corporate functions understand purpose ofERM/SRM

Components of ERMCriterion 3: Metrics & Measurement Metrics based onaccounting/regulatory reportingrequirementsMeasurement techniques forfinancial and event risksMetrics for evaluating risk andreward at operational level exist butare inconsistent and not defined aspart of the ERM process Robust measurement of some key risks(e.g. pricing models for all transactions)Risk prioritization through qualitative andquantification of key risks (heat map)Use of internal SMEs and root causeanalysisSimplified approach to stress testingcapital adequacyLimited scenario planning and/or SWOTanalysisSome risk metrics at the function level,but inability to aggregate at theenterprise levelCompany metrics are established andused to prioritize opportunities andsupport the evaluation of an individualopportunitySource: ermInsights and John Bugalla Measurement metrics for all risk categorieswith aggregation capabilitiesModeling key risks in common termsMetrics for evaluating risk and reward atoperational level exist and are consistentand defined as part of the ERM processERM embedded in strategic planning anddecision makingConsistent approaches to risk measurementand impact on valueAbility to produce results accurately andquicklyRobust use of scenario planning, analysisand stress testingRisk metrics included in individualperformance objectives and compensationMacroeconomic indicators considered inpredictive financial performance

Components of ERMCriterion 4: Risk Management Process, Procedures & Controls Risk management function centeredon insurance and other traditionalrisksInternal audit focused oncompliance, audit and controlsExistence of control structureRisk-adjusted decisions process inplaceRisk prioritization based onqualitative informationSilo-based management of key risksBusiness continuity plans developedOperational risk controls definedand in place Consistent risk identification andassessment processEnterprise-wide view of key risks to thestrategyRisk treatments and options developed forkey risksStandardized process for insurance,financial risk management (credit, marketand operational)Regular monitoring and analysis of extremeeventsRisk management knowledge exists at thesenior management levelRisk policies are clearly defined andcommunicated, and have influence onfunctional managementManagement and risk owners understandimportance of and role in managing riskwithin the operationsFormal approach to identifying, quantifyingand monitoring operational risksSource: ermInsights and John Bugalla Enterprise-wide view of key risks to thestrategyERM goals and objectives articulated andaligned with business strategy andobjectivesRisk-adjusted decisions process in placeValue driver analysis in placeAppropriate risk and control processes(identification, measurement, reporting andcheckpoints against risk tolerances) in placeRobust framework for stress testing andscenario analysis modelsUse of value mapping toolsRisk culture aligned and implementedUnderstanding the portfolio effect of riskRisk financing options clearly understoodERM/SRM collaborating with complianceand audit

Components of ERMCriterion 5: Risk Monitoring, Reporting & Communication Ad hoc reporting. although theremay be significant lag timeReactive response to risk events andreportsExistence of risk reporting bybusiness line and for the enterpriseReporting developed for regulatorycomplianceManagement reports developed foraudit findings and controlsFinancial disclosure requirements Risk management dashboard that includesreporting metrics linked to risk appetiteand tolerancesExistence of risk reporting by business lineand for the enterpriseAbility to produce reports based upontimely and useful information that allowfor actionable decision makingReporting is data-oriented vs. informationoriented and not easily actionableQuarterly or monthly ERM reporting toexecutive managementAnnual reporting of key risks to the BoardReporting is tailored appropriately to theaudience to whom it is deliveredAnnual third-party stewardship reportsTechnology is used to support the businessstrategy and the implementation andmonitoring of risk tolerancesSource: ermInsights and John Bugalla Risk management dashboard that includesreporting metrics linked to risk appetite andtolerances, and strategyAbility to produce reports based upon timelyand useful information that allow foractionable decision making, and adaption tonew strategyFlexible reporting and ability to drill down intorisk informationIntegration of ERM components, data, systemsReporting is tailored appropriately to theaudience to whom it is deliveredEmerging threats and opportunities includedin reportsStrategic risks are reported to board onquarterly basisRisk management is a competitive advantageRisk owners report to board and audit verifiesAll corporate functions understand purposeand support ERM/SRM

Components of ERMSteps to design an ERM: Define desired programImplement ERM charterEstablish risk appetiteDefine tolerance levelsStart risk assessment process