Risk Management

What is Risk Management?

Risk management is the process of identifying, assessing and controlling threats to an organization’s capital and earnings. These risks stem from a variety of sources, including financial uncertainties, legal liabilities, technology issues, strategic management errors, accidents and natural disasters.

A successful risk management program helps an organization consider the full range of risks it faces. Risk management also examines the relationship between risks and the cascading impact they could have on an organization’s strategic goals.

Traditional Risk Management vs. Enterprise Risk Managment

Traditional risk management tends to get a bad rap these days compared to enterprise risk management. Both approaches aim to mitigate risks that could harm organizations. Both buy insurance to protect against a range of risks. Both adhere to guidance provided by the major standards bodies. But traditional risk management, experts argue, lacks the mindset and mechanisms required to understand risk as an integral part of enterprise strategy and performance.

The business units might have sophisticated systems in place to manage their various types of risks, Shinkman explained, but the company can still run into trouble by failing to see the relationships among risks or their cumulative impact on operations. Traditional risk management also tends to be reactive rather than proactive.

The Risk Management Process

The risk management discipline has published many bodies of knowledge that document what organizations must do to manage risk. One of the best-known sources is the ISO 31000 standard, Risk management — Guidelines, developed by the International Organization for Standardization, a standards body commonly known as ISO.

ISO’s five-step risk management process comprises the following and can be used by any type of entity:
1.Identify the risks.
2.Analyze the likelihood and impact of each one.
3.Prioritize risks based on business objectives.
4.Treat (or respond to) the risk conditions.
5.Monitor results and adjust as necessary.

The steps are straightforward, but risk management committees should not underestimate the work required to complete the process. For starters, it requires a solid understanding of what makes the organization tick. The end goal is to develop the set of processes for identifying the risks the organization faces, the likelihood and impact of these various risks, how each relates to the maximum risk the organization is willing to accept, and what actions should be taken to preserve and enhance organizational value. The following four factors must be present for a negative risk scenario:
1. a valuable asset or resources that could be impacted;
2. a source of threatening action that would act against that asset;
3. a preexisting condition or vulnerability that enables that threat source to act; and
4. some harmful impact that occurs from the threat source exploiting that vulnerability.

Risk by categories. Organizing risks by categories can also be helpful in getting a handle on risk. The guidance cited by Witte from the Committee of Sponsoring Organizations of the Treadway Commission (COSO) uses the following four categories:

strategic risk (e.g., reputation, customer relations, technical innovations)
financial and reporting risk (e.g., market, tax, credit)
compliance and governance risk (e.g., ethics, regulatory, international trade, privacy)
operational risk (e.g., IT security and privacy, supply chain, labor issues, natural disasters)

The final task in the risk identification step is for organizations to record their findings in a risk register. It helps track the risks through the subsequent four steps of the risk management process.

Risk Management Standards and Frameworks

As government and industry compliance rules have expanded over the past two decades, regulatory and board-level scrutiny of corporate risk management practices have also increased, making risk analysis, internal audits, risk assessments and other features of risk management a major component of business strategy

4 Strategies to Manage Risks

Risk management teams choose different options to address risks, depending on the likelihood of their occurring and the severity of their impact.

NO RISK

A Risk Avoidance strategy implements policies, technology, employee training and other steps designed to eliminate risk.

STRATEGIES FOR GETTING TO ACCEPTABLE RISK

A risk reduction strategy implements policies, technology, employee traingin and other steps to reduce risk to an acceptable level.
A risk transfer strategy contracts with a third party to bear som or all costs of a risk that may or may not occur.
A risk acceptance strategy accepts the risk because its potential to harm the organization is very limited or the cost of mitigating it exceeds the damage it would inflict.

What are the Benefits and Challenges of Risk Management?

Benefits of risk management include the following:

increased awareness of risk across the organization
more confidence in organizational objectives and goals because risk is factored into strategy;
better and more efficient compliance with regulatory and internal compliance mandates because compliance is coordinated;
improved operational efficiency through more consistent application of risk processes and control;
improved workplace safety and security for employees and customers; and
a competitive differentiator in the marketplace.

The following are some of the challenges risk management teams should expect to encounter:

Expenditures go up initially, as risk management programs can require expensive software and services.
The increased emphasis on governance also requires business units to invest time and money to comply.
Reaching consensus on the severity of risk and how to treat it can be a difficult and contentious exercise and sometimes lead to risk analysis paralysis.
Demonstrating the value of risk management to executives without being able to give them hard numbers is difficult.

Planning and plotting an ERM course

A comprehensive, all-inclusive enterprise risk management program can avert corporate disasters, save regulations, provide coompetitive advantages and yield intangible rewards.

KEY COMPONENTS

Business and technology objectives
Risk tolerance vs. strategic goals
Corporate culture and governance
Compliance and control mechanisms
Measuring and reporting procedures

ACTION ITEMS

Prioritize business processes
Create a heat map of risks
Pinpoint unacceptable risks
Deploy artificial intelligence
Keep stakeholders informed

Why is Risk Management Important?

Risk management has perhaps never been more important than it is now. The risks modern organizations face have grown more complex, fueled by the rapid pace of globalization. New risks are constantly emerging, often related to and generated by the now-pervasive use of digital technology. Climate change has been dubbed a “threat multiplier” by risk experts.

As the world continues to reckon with these crises, companies and their boards of directors are taking a fresh look at their risk management programs. They are reassessing their risk exposure and examining risk processes. They are reconsidering who should be involved in risk management. Companies that currently take a reactive approach to risk management — guarding against past risks and changing practices after a new risk causes harm — are considering the competitive advantages of a more proactive approach. There is heightened interest in supporting sustainability, resiliency and enterprise agility. Companies are also exploring how artificial intelligence technologies and sophisticated governance, risk and compliance (GRC) platforms can improve risk management.

Banks and insurance companies, for example, have long had large risk departments typically headed by a chief risk officer (CRO), a title still relatively uncommon outside of the financial industry. Moreover, the risks that financial services companies face tend to be rooted in numbers and therefore can be quantified and effectively analyzed using known technology and mature methods. Risk scenarios in finance companies can be modeled with some precision.

Risk Appetite vs. Risk Tolerance

If risk appetite represents the official speed limit of 70, risk tolerance is how much faster you can go before likely getting a ticket.

How to Build and Implement a Risk Management Plan

A risk management plan describes how an organization will manage risk. It lays out elements such as the organization’s risk approach, roles and responsibilities of the risk management teams, resources it will use to manage risk, policies and procedures.

1. Communication and consultation- Since raising risk awareness is an essential part of risk management, risk leaders must also develop a communication plan to convey the organization’s risk policies and procedures to employees and relevant parties. This step sets the tone for risk decisions at every level. The audience includes anyone who has an interest in how the organization takes advantage of positive risks and minimizes negative risk.

2. Establishing the context- This step requires defining the organization’s unique risk appetite and risk tolerance — i.e., the amount to which risk can vary from risk appetite. Factors to consider here include business objectives, company culture, regulatory legislation, political environment, etc.

3. Risk identification- This step defines the risk scenarios that could have a positive or negative impact on the organization’s ability to conduct business. As noted above, the resulting list should be recorded in a risk register and kept up to date.

4. Risk analysis- The likelihood and impact of each risk is analyzed to help sort risks. Making a risk heat map can be useful here, as it provides a visual representation of the nature and impact of a company’s risks. An employee calling in sick, for example, is a high-probability event that has little or no impact on most companies. An earthquake, depending on location, is an example of a low-probability risk with high impact. The qualitative approach many organizations use to rate the likelihood and impact of risks might benefit from a more quantitative analysis, Witte said. The FAIR Institute, a professional association that promotes the Factor Analysis of Information Risk framework on cybersecurity risks, has examples of the latter approach.

5. Risk evaluation- Here is where organizations determine how to respond to the risks they face. Techniques include one or more of the following:

Risk avoidance: The organization seeks to eliminate, withdraw from or not be involved in the potential risk.
Risk mitigation: The organization takes actions to limit or optimize a risk.
Risk sharing or transfer: The organization contracts with a third party (e.g., an insurer) to bear some or all costs of a risk that may or may not occur.
Risk acceptance: A risk falls within the organization’s risk appetite and tolerance and is accepted without taking action.

6. Risk treatment- This step involves applying the agreed-upon controls and processes and confirming they work as planned.

7. Monitoring and review- Are the controls working as intended? Can they be improved? Monitoring activities should measure key performance indicators and look for key risk indicators that might trigger a change in strategy.

Example of a Color-Coded Heat Map

A risk map offers a visualized, comprehensive view of the likelihood and impact of an organization’s risks. The risks that fall into the green areas of the map require no action or monitoring. Yellow and orange risks require action. Risks that fall into red portions of the map need urgent action.