The case for an enterprise wide approach to risk management
The turnaround occurred in large part because banks were able to develop new tools and techniques to counter risk, in the process giving birth to an entirely new discipline of financial risk management. New forms of options, futures, and counter-party agreements allowed banks to redistribute their financial risks.
Indeed, across all industries, the discipline of risk management has made considerable progress in recent years. Spurred by the banking industry’s success in financial risk management and by Sarbanes-Oxley’s new rigorous standards for corporate governance, some firms have been adopting the practice of “enterprise risk management,” which seeks to integrate available risk management techniques in a comprehensive, organization-wide approach. Other companies are at a more advanced stage, in which they quantify risks and link them to capital allocation and risk-transfer decisions. Even among these more advanced practitioners, however, the focus of enterprise risk management rarely encompasses more than financial, hazard, and operational risks. Many companies already commit themselves to meticulously managing even relatively small risks, for instance, auditing their invoices to comply with new corporate governance regulations. Of course, no company can anticipate all risk events: There will always be unpreventable surprises that can damage your organization, which makes it all the more important to manage those risks that can be prevented, but an enterprise-wide approach to risk management not only helps manage preventable risks, but also the overall strategic view it provides can allow firms to better anticipate those unpreventable occurrences.
Taking this stance promises benefits beyond just protecting a company’s value. When a risk is common to all companies in an industry, the business that takes early steps to mitigate it can put itself in a much stronger competitive position. Moreover, many strategic risks mask growth opportunities: by managing strategic risk, companies can position themselves as a risk shaper that is both more aggressive and more prudent in pursuing new growth. Strategic risk can be categorised into seven major classes: industry, technology, brand, competitor, customer, project, and stagnation, and within each class, there are different types of risks. For example, the so-called ‘Industry Margin Squeeze’ (www.globalcontinutiy.com) happens because, as industries evolve, a succession of changes can unfold that threaten all companies in the sector. An industry may go through rapid deregulation, like that experienced by airlines, which sharpens price competition among companies with high cost structures. Contrast the success of this collaboration with the plight of major music production companies. (www.bbc.co.uk) Collaboration became an economic imperative, but the music companies offered only a fragmented response, as none of them had anticipated this risk in time. The potential for brand erosion is yet another reason why companies should pursue a rigid enterprise-wide risk management strategy, as brands are subject to an array of risks, some predictable and some not, that can sharply reduce their value. This reallocation of investments arrested the brand’s slide early and contributed to the company’s dramatic growth in market value over the past decade
Another risk that many companies can experience is that of market stagnation, with countless companies having seen their market value plateau or decline as a result of their inability to find new sources of growth. One important side effect of on-site production was the higher level of interaction between customers and the Air Liquide staff and this, combined with the enterprise-wide approach to problem solving and risk management pursued by Air Liquide, enabled the company to provide greater value for its customers.
By seizing these new opportunities, the company has expanded its potential markets, gained a greater share of its customers’ spending, and improved customer profitability and loyalty. (www.airliquide.com)
The cases above are some of the main reasons why industry insiders tout enterprise risk management (ERM) as the most effective strategy an organization can use to manage a plethora of risks, running the gamut from strategic, market, credit, operational and financial exposure to the daunting array of man-made and natural disasters. New ERM committees, led by chief risk officers, are responsible for identifying, quantifying and monitoring these risks via a holistic, portfolio-based management system. The main difference between ERM and more traditional ways of managing risk is that ERM calls for high-level oversight of a company’s entire risk portfolio rather than for many different overseers managing specific risks: the so-called silo approach. ERM, in effect, centralizes management under a chief risk officer or ERM committee who manages the individual overseers to help identify overall how much risk the entity can tolerate, assess mitigation tactics and otherwise take advantage of risk opportunities. The idea of viewing risk as an opportunity often surprises some company executives, usually because of their traditional siloed view of risk management. Since companies must hold capital to absorb the risk of loss, there is less to invest in other profit-producing activities, thus ERM helps determine the right amount of capital companies should direct toward risk.
ERM helps a company arrive at this figure, thus reducing opportunity costs, by gathering, or otherwise polling risk over-seers to determine the threats to the organization, the financial impact and the effectiveness of risk mitigation options. Interestingly, ERM’s departure from silo-based risk management doesn’t preclude decentralized risk management, but rather it establishes a hierarchy with discrete risk managers typically reporting to a central figure using so-called ‘dashboard technology’ (www.strategicrisk.co.uk): business intelligence software that extracts risk-based information, collates it and reports it to the chief risk officer or ERM committee, which has overall responsibility.
While the process of building an ERM strategy is similar, overall responsibility for enterprise risk is changing because of the IIA standards (www.theiia.org). The basic requirement for the internal audit function, as contained in the new IIA standards, is to monitor and evaluate the effectiveness of an organization’s risk management and control systems. Standard 2110 of the International Standards for the Professional Practice of Internal Auditing, for example, says that the internal audit activity should help the organization manage risk by identifying and evaluating significant exposures to risk and contributing to the improvement of risk management and control systems. That requires continuous monitoring and measuring of these processes, all of which involve risk. In addition to complying with the sweeping reforms in corporate governance and financial reporting following the Sarbanes-Oxley Act, companies can benefit further by adopting a broader view that encompasses an enterprise-wide risk-management outlook.
Tags: banking industry, enterprise risk management, financial risk management, growth opportunities, risk companies, risk management techniques, risk transfer
