enterprise risk management lecture 9. why the interest in erm? performance bar is raised for...
Post on 18-Dec-2015
215 views
TRANSCRIPT
Enterprise Risk Management
Lecture 9
Why the Interest in ERM?
• Performance bar is raised for Financial Executives
• Your company can optimize overall returns and
minimize risks
• Leverage existing control processes to meet
emerging risk governance demands
• Rating agencies are incorporating ERM evaluation to
overall corporate rating
• US Sentencing Guidelines offer consideration for
effective risk management
Evolution of ERM COSO Internal Control Framework
• Operations
• Compliance
• Financial Reporting
Evolution of ERM COSO Enterprise Risk Management
• Strategy
• Operations
• Reporting
• Compliance
Defining ERM Portfolio View
Standard Deviation
Ave
rag
e A
nn
ual
Rat
e o
f R
etu
rnPossible Combinations
of Risk and ReturnUnattainable Combinations
Modified from www.monkeychimp.com
Defining ERM Key Concepts
• Common Language
• Common Measurement
• Gross / Inherent Risk
• Response/Control/Mitigation
• Net / Residual Risk
Silo Risk
Silo Risk
Silo Risk
Gross Risks
Responseand Control
NetRisks
Implementing ERM Getting Started
• Get Buy in from the Top• Consolidate Risk Lists• Document Existing Risk Management
Silos• Identify Gaps in Coverage
Decide Next Steps• Fill Gaps to Demonstrate Value• Establish Repeatable Process
Ad Hoc / Heroics
Initial Tasking
• Internal Audit• Compliance• Strategic Planning• Operational Planning• Board Reporting
Implementing ERM Leverage Existing Processes
Common Risk ListAssess Gross Magnitude and Likelihood
Prioritization of RisksSelf Assessment of Response and Control Capabilities
Consensus View on Net RiskDisclosure of Risk Exposures
Risk and Control Focus
Stra
teg
y
Po
licy
Op
era
tion
s
Co
mp
lian
ce F
inl R
prin
g
Enterprise Risk Management
Internal Audit
Sarbanes Oxley PMO
Implementing ERM Establishing a Process
• Get Management Talking About Enterprise Risk• Develop Common Language• Develop a Common Measurement Basis• Establish an Enterprise Risk Management
Framework• Dedicate Staff• Develop Expertise Repeatable
Manageable
Implementing ERM Key Questions
• Quality: Are we talking the right kinds of risk?
• Quantity: Are we talking the proper amount of risk to meet our objectives?
• Resources: Are we allocating resources (financial, human, etc) efficiently to manage risks?
• Advantage: Do we have a competitive advantage in a particular type of risk?
• Challenges:– Cultural
– OperationalOptimizing…?
Sample ERM Implementation Lifecycle
Sample potential ERM Implementation Project Lifecycle• Comprehensive Risk Identification
– Review existing risk lists
– Interview senior management
– Consolidate findings and report
• Collect and Index Extant Risk Related Process Documents– Find policies and procedures related to significant risks
– Assess gaps in coverage i.e. risk identified but no related processes
• Assess gross risk– Interview business unit managers to determin risk events, potential im
pact and likelihood of occurrence
– Review existing risk modeling at the business unit level
– Assess risk materiality and prioritize risks
– Document findings and report
• Assess capabilities to control and respond to risk
– Determine organizational structure and identify risk management capabilities
– Assist business unit managers in self assessing their capabilities to control and respond to risk using objective benchmarking criteria to determine relative strength
– Determine the risk and capability alignment (one to one, many to one, one to many) and assess interdependencies
– Document findings and report
• Assess residual risks
– Determine residual risk exposure based on higher risk materiality and lower related capabilities
– Document findings and report
• Develop Gap Closing Plan
– For higher risk materiality and lower related capabilities develop action plans to either modify risk materiality or strengthen capabilities
• Execute Gap Closing Initiatives
– Additional projects need to be scoped
Sample ERM Implementation Lifecycle ( Cont’d)
Value Proposition Demonstrate Good Governance
• Transparency to Stakeholders– Reveal natural hedges
– Understand how a single event or multiple events may
impact the company as a whole
– Broader understanding of the aggregate exposure to risk
– No surprise
• Clarify Roles and Responsibilities– Assign risks with no clear owner (reputation risk)
– Enhance collaboration in response to events
Risk Environment
Risk to the Enterprise
Credit Risk Market Risk Business Risk Operational Risk
Customer FinancingPrepaid ServicesLoansBonds
Interest Rate RiskForeign ExchangeHedging Programs
Product PricingReservesConsumer BehaviorCatastrophesReputation
PeopleProcessesTechnologyOutsourcingFraud
Response and Control Capabilities• Compliance
• Ethics
• Internal Audit
• Sarbanes Oxley
• Human Resources
• Technology
• Product Development
• Communications
• Insurance Programs
• Capital Management
Risk management capabilities
exist through out the enterprise:
Front office / sales
Middle office / support
Back office / processing
ERM Heat Map
Risk Materiality
Higher
Lower
Response and Control Capabilities
Stronger Weaker
Decisions Under Risk and Uncertainty
Decision Type
Actions
(examples)
Outcomes
(examples)
Consequences
(examples)
Strategy
Determine what business the firm is in (consumer goods, financial services, etc.)
Type of good produced or service rendered
Competitors, porduct liability exposure, regulatory climate
Execution
Choose which market segments to pursue (luxury goods, private banking relationships)
Pricing and quality of goods sold or services rendered, nature of distribution channels
Brand quality, barriers to entry
Operations
Invest in infrastructure, such as new equipment
Skills and technology applications needed to produce goods or render services
Dependencies on skills and technology, efficiency
OrganizationDefine how people work and communicate
Profit and cash flow performance
Responsiveness to change, capacity for growth
Risk Governance
• Decision making and controls related to risk taking
• Interagency Statement on Complex Structured Financial Transactions
• Rating agency consideration of ERM• Organizational Sentencing Guidelines• Internal Audits role in ERM
• Shape the control environment to maximize value, remember that wanting greater returns usually implies taking more risk
Identifying Elevated Risk CSFT’s
• Lack economic substance or business purpose• Questionable accounting, regulatory, or tax objectives• Create misleading disclosures• Involve circular transfers of risks• Involve undocumented agreements that impact
regulatory treatment• Economic terms inconsistent with market norms• Provide disproportionate compensation
Characteristics of Elevated Risk Complex Structured Financial Transactions:
Organizational Sentencing Guidelines Overview
• Established by the US Sentencing Commission• Most recent revisions effective November 1, 2004• Applies to many forms of organizations
– Companies– Not for profits– Unions– Governments– Others
• Focus on the effectiveness of compliance and ethics program
Effectiveness Criteria Responsibility and Authority
• Governing authority– Is knowledgeable of the compliance and ethics program
– Exercises oversight of implementation and effectiveness
• Specific high level individuals shall have responsibility for the compliance and ethics program
• Specific individuals shall be delegated operational responsibility for the compliance and ethics program– Report to governing authority / high level individuals
– Adequate resources
– Appropriate authority
Effectiveness Criteria Procedures
• Communication and training
• Monitoring and auditing
• Periodic evaluation of effectiveness
• Anonymous reporting processes
• Enforcement and consequences
• Risk assessment
ERM, Ethics and Compliance
• Adopting ERM is one way to demonstrate a
commitment to good governance
• Enterprise wide risk assessments can help put the
need for compliance and ethics program in context
• Compliance risk assessments can leverage the
enterprise risk assessment and management process
• A coordinated testing strategy can save time and
effort and reduce information overload
Standard & Poor’s Approach
Enterprise “risk management will become a separate
major category of our analysis”
“The companies that are seen to be the best
performers in this category will be those that have
robust risk management processes that are carried
out across the entire enterprise and that form a
basis for informing and directing the firm’s
fundamental decision making”
Excellent• Extremely strong capabilities to
consistently identity, measure, and manage risk exposures and losses within the companies predetermined tolerance guidance
• Consistent evidence of the practice of optimizing risk adjusted returns
• Risk and risk management are always important considerations in corporate decision making
Standard & Poor’s Classification
Weak• Limited capabilities to cosistently ident
ify, measure, and manage risk exposures across the company and thereny limit losses.
• Execution of risk management is sporadic
• Losses cannot be expected to be limited n accordance with perdetermined tolerance guidelines
• Business managers have yet to adopt a risk management framework
• Risk management satisifies regulatory minimums but is not regularly applied to business decisions
Standard & Poor’s Cultural Indicators
Most Favorable:• Corporate risk management
responsibility rest with a senior influential officer
• With regular reporting and access to the board
• Risk tolerance is clearly articulated and consistent with firm goals and expectations
• Risk management polices and procedures are clearly stated and widely known
• Management view its risk management capabilities as a competitive advantage
Least Favorable:• Corporate risk management
responsibility rest with a middle manager or is nonexistent
• Access to the board is ad doc or limited
• Risk tolerance is unclear and may vary from situation to situation
• Risk management policies and procedures are not fully documented
• Management views risk management as a frustrating constraint imposed by external policies
Standard & Poor’s Control Indicators
Most Favorable:• Demonstrate process to identify
significant risk experience• All significant risk monitored on a
regular basis with timely and accurate measures of risk
• Clearly documented limits and standards for risk taking and management that are widely understood
• Risk limits are enforced with clear predetermined consequence for exceeding limits
• Defined loss event post mortem review to determine if process improvements are necessary
Least Favorable:• Not all significant risk exposures have
been identified
• Risk monitoring is informal, irregular or nonexistent
• Risk limits not documented or are too broad to have an impact on operational decision making
• Review of compliance with limits is irregular and there are often no consequence for exceeding limits
• Minimal or limited review of loss events
ERM Value
Better Decision Making• Facilitates risk management gap analysis
• Helps optimize gap closing spend and activities
• Common language and measurement of risk allows for more
efficient risk monitoring and communication (eliminate
duplication of effort)
– Also provides a context to align risk and control responsibilities
• Provides a meaningful context for external stakeholders
– Shareholders aware of risk to strategy and management's process
to respond and control unwanted risk levels
– Rating agencies understand how risk is factored into decision
making to optimize risk and reward
– Demonstrate good “tone at the top” corporate governance