Risk Management

What is Risk Management?

Risk management is the process of identifying, assessing and controlling threats to an organization’s capital and earnings. These risks stem from a variety of sources, including financial uncertainties, legal liabilities, technology issues, strategic management errors, accidents and natural disasters.

A successful risk management program helps an organization consider the full range of risks it faces. Risk management also examines the relationship between risks and the cascading impact they could have on an organization’s strategic goals.

Traditional Risk Management vs. Enterprise Risk Managment

Traditional risk management tends to get a bad rap these days compared to enterprise risk management. Both approaches aim to mitigate risks that could harm organizations. Both buy insurance to protect against a range of risks. Both adhere to guidance provided by the major standards bodies. But traditional risk management, experts argue, lacks the mindset and mechanisms required to understand risk as an integral part of enterprise strategy and performance.

Business units might have sophisticated systems in place to manage their various types of risks, Shinkman explained, but the company can still run into trouble by failing to see the relationships among risks or their cumulative impact on operations. Traditional risk management also tends to be reactive rather than proactive.

The Risk Management Process

The risk management discipline has published many bodies of knowledge that document what organizations must do to manage risk. One of the best-known sources is the ISO 31000 standard, Risk management — Guidelines, developed by the International Organization for Standardization, a standards body commonly known as ISO.

ISO’s five-step risk management process comprises the following and can be used by any type of entity:
1.Identify the risks.
2.Analyze the likelihood and impact of each one.
3.Prioritize risks based on business objectives.
4.Treat (or respond to) the risk conditions.
5.Monitor results and adjust as necessary.

The steps are straightforward, but risk management committees should not underestimate the work required to complete the process. For starters, it requires a solid understanding of what makes the organization tick. The end goal is to develop the set of processes for identifying the risks the organization faces, the likelihood and impact of these various risks, how each relates to the maximum risk the organization is willing to accept, and what actions should be taken to preserve and enhance organizational value. The following four factors must be present for a negative risk scenario:
1. a valuable asset or resources that could be impacted;
2. a source of threatening action that would act against that asset;
3. a preexisting condition or vulnerability that enables that threat source to act; and
4. some harmful impact that occurs from the threat source exploiting that vulnerability.

Risk by categories. Organizing risks by categories can also be helpful in getting a handle on risk. The guidance cited by Witte from the Committee of Sponsoring Organizations of the Treadway Commission (COSO) uses the following four categories:

strategic risk (e.g., reputation, customer relations, technical innovations)
financial and reporting risk (e.g., market, tax, credit)
compliance and governance risk (e.g., ethics, regulatory, international trade, privacy)
operational risk (e.g., IT security and privacy, supply chain, labor issues, natural disasters)

The final task in the risk identification step is for organizations to record their findings in a risk register. It helps track the risks through the subsequent four steps of the risk management process.

Risk Management Standards and Frameworks

As government and industry compliance rules have expanded over the past two decades, regulatory and board-level scrutiny of corporate risk management practices have also increased, making risk analysis, internal audits, risk assessments and other features of risk management a major component of business strategy

4 Strategies to Manage Risks

Risk management teams choose different options to address risks, depending on the likelihood of their occurring and the severity of their impact.

NO RISK

A Risk Avoidance strategy implements policies, technology, employee training and other steps designed to eliminate risk.

STRATEGIES FOR GETTING TO ACCEPTABLE RISK

A risk reduction strategy implements policies, technology, employee traingin and other steps to reduce risk to an acceptable level.
A risk transfer strategy contracts with a third party to bear som or all costs of a risk that may or may not occur.
A risk acceptance strategy accepts the risk because its potential to harm the organization is very limited or the cost of mitigating it exceeds the damage it would inflict.

What are the Benefits and Challenges of Risk Management?

Planning and plotting an ERM course

A comprehensive, all-inclusive enterprise risk management program can avert corporate disasters, save regulations, provide coompetitive advantages and yield intangible rewards.

KEY COMPONENTS

Business and technology objectives
Risk tolerance vs. strategic goals
Corporate culture and governance
Compliance and control mechanisms
Measuring and reporting procedures

ACTION ITEMS

Prioritize business processes
Create a heat map of risks
Pinpoint unacceptable risks
Deploy artificial intelligence
Keep stakeholders informed

Why is Risk Management Important?

Risk management has perhaps never been more important than it is now. The risks modern organizations face have grown more complex, fueled by the rapid pace of globalization. New risks are constantly emerging, often related to and generated by the now-pervasive use of digital technology. Climate change has been dubbed a “threat multiplier” by risk experts.

As the world continues to reckon with these crises, companies and their boards of directors are taking a fresh look at their risk management programs. They are reassessing their risk exposure and examining risk processes. They are reconsidering who should be involved in risk management. Companies that currently take a reactive approach to risk management — guarding against past risks and changing practices after a new risk causes harm — are considering the competitive advantages of a more proactive approach. There is heightened interest in supporting sustainability, resiliency and enterprise agility. Companies are also exploring how artificial intelligence technologies and sophisticated governance, risk and compliance (GRC) platforms can improve risk management.

Banks and insurance companies, for example, have long had large risk departments typically headed by a chief risk officer (CRO), a title still relatively uncommon outside of the financial industry. Moreover, the risks that financial services companies face tend to be rooted in numbers and therefore can be quantified and effectively analyzed using known technology and mature methods. Risk scenarios in finance companies can be modeled with some precision.

Risk Appetite vs. Risk Tolerance

If risk appetite represents the official speed limit of 70, risk tolerance is how much faster you can go before likely getting a ticket.

How to Build and Implement a Risk Management Plan

Example of a Color-Coded Heat Map

A risk map offers a visualized, comprehensive view of the likelihood and impact of an organization’s risks. The risks that fall into the green areas of the map require no action or monitoring. Yellow and orange risks require action. Risks that fall into red portions of the map need urgent action.