Entreprise Risk Management

In many industries, companies are being pushed by their regulators to implement Enterprise Risk  Management (ERM). However, the vast majority of companies are not subject to a high degree of regulation and are still pushing for the adoption of ERM. Perhaps the reason that regulators and boards are so favourable toward ERM is because of the strategic and operational benefits that it makes possible, including:

• Increasing the chance of achieving strategic and business objectives;

• The ability to see adversity on the horizon and minimize its impact;

• The ability to take advantage of value-creating opportunities such as a competitive advantage for the future;

• Provides a process for board members to oversee risk management activities as required in some countries. 

With the introduction and adoption of ERM by many companies around the world, an additional step should be included in their ERM process. The new step – planning – is critical to establish the context surrounding the new ERM program. The planning and preparation stage should take place before an ERM program is initiated. It is at this point that the organizations leaders should discuss how the ERM program will be aligned with the organization’s strategic objectives, and be utilized as a compliance tool for regulators as needed.

Too many ERM programs are initiated and championed by a single individual or department from the bottom up without giving adequate consideration to both the needs and goals of the entire enterprise, which is a core concept of ERM. The result is an ERM effort that is narrowly focused. For example, an ERM effort championed by the compliance or regulatory group often becomes a compliance-biased program.

Obviously, these organizational capabilities are important, but they should be considered within the overall context of the organization’s strategic goals. An ERM initiative that takes a holistic approach in a culture that supports it will not only leverage the best risk identification and treatments already in place throughout the organization, but also help to incorporate the same risk processes into the strategic planning process.

When ERM is aligned with the organization’s strategic and operational goals, ERM can also lead to strategic and operational benefits. The methodology is to embed ERM within the strategic and annual business planning process. Because the strategic plan sets out a vision for the organization’s growth over a multi-year time frame, incorporating the ERM process will support, not hinder, the strategic plan. The reason is straightforward: while the strategic plan is based on various projections over time (among them political, economic, technological, social, environmental, and legal), its starting line is existing conditions. 

However, there is an enormous range of changing circumstances with consequences that vary over time – the future is not what it used to be – that can quickly turn favorable operating conditions into an extremely difficult environment.

Consider the wide range of outcomes, such as interest rates, the price of oil, a British exit from the EU, the refugee migration, and cyber risks, that are possible spanning the five-year time frame of 2016-2020.

Embedding the ERM process into strategic and business planning is not an end to itself. The ERM process supports the strategic plan, but it is executing the strategic and business plans with tactical actions that are critical. When data and information about risks or obstacles is added early in the process and decisions are based on that data and information your organization will actually start to practice strategic risk management. 

Embedding the ERM process into strategic planning also is important for growing the business because the opposite side of risk is opportunity. And a focus on opportunity can lead to an important competitive advantage within your industry.

Adequate planning and preparation before initiating ERM are crucial. The planning step requires the active engagement and leadership of the CEO and leadership team. With the CEO leading the planning sessions, a constructive dialogue about ERM that will determine the unique shape and contour of your organization’s program can begin. An initial planning session with the following agenda is a good place to start:

• Create an ERM charter: vision, mission, and purpose.

• Identify the ERM leader: Chief Risk Officer, CFO or CEO.

• Identify how best to align the organizational team that will include the ERM process within the organization’s strategic plan.

• Define "risk” within your organization.

• Draft an initial "risk register” for your organization.

• Initiate a discussion about risk appetite and tolerance.

• Identify internal and external resources and collaborations that will bring added robustness to the effort.

An ERM charter created during ERM planning is an internal blueprint for both executive leadership and middle management to follow. The strategic nature of the document warrants creation by senior executives who have a broad view and power within the organization. At the very least, the charter should state the vision, mission, and purpose of ERM within the organization. It will set the tone from the top for ERM in one of two very different directions: either risk management is a strategic support function, or it is about audit and control. 

We believe ERM should be aligned with and support the business activities of the organization. Risk management should collaborate with audit and compliance, but not be housed within compliance, if the option exists. Half of the foundational principals of ERM have to do with "preserve, protect, and comply,” but the other half have to do with supporting building the business. ERM should be employed to identify, assess, and address both threats and opportunities to the organization. More specifically, the goals of an ERM program should be: (1) minimize the impact of adverse events, (2) support business growth opportunities, and (3) enhance organizational governance. 

Incorporating ERM into the strategic plan will support growth objectives and minimize the impact of adverse events that could hamper an organization from achieving its goals. We view ERM as an important component of the strategic planning process. At Brokerslink, we have the capabilities to help our clients build and implement an ERM process that adds value and gives them a competitive edge.



By John Bugalla (Managing Principal of ermINSIGHTS) and Corey Gooch (Director of Business Development at Brokerslink)