Ch 4: Enterprise Risk Management

traditional risk management

risks evaluated in a “silo” approach - risks are managed individually even though they can be correlated

ERM

strategic business discipline where a business addresses the full spectrum of its risks and manages the combined impact of those risks as an integrated risk portfolio

holistic approach

main risks within ERM

1. hazard risk

2. operational risk

3. financial risk

4. strategic risk

hazard risk

pure risks - traditional risk management

manage with traditional risk control methods

operational risk

risks arising from day-to-day operations

• supply chain risks: diversification, duplication

• manufacturing: insurance

• customer service: training (loss prevention), loss reduction (dealing with customer complaints), deals with speculative and pure risk

• cybersecurity: insurance, training, dual factor (loss prevention)

• employment practices: training, benefit programs, interviewing and hiring the right people, firing bad people, how it deals with sexual harassment cases

financial risk

arising from changing conditions within financial markets

• changes in commodity prices

• changes in interest rates

• foreign exchange rates

strategic risk

concerned with an organization’s goals and objectives; long-term horizon; organization’s SWOT

• company ethics

• how company rolls out a product

• location of headquarters, warehouses

other ERM risks

regulatory/compliance risks: laws and regulations affect business

• privacy laws, health standards, permits, wage laws

reputational risk

• PR teams

Terrorism

• cybersecurity threats more prevalent today

climate change

• emission regulations, waste regulations

ERM tools

risk management information system - RMIS: computerized database used to collect and manage and analyze risk data

risk score: qualitative or quantitative to assess and measure risks, helps prioritize risks

risk register

risk map

• scatterplot that graphs risks based on frequency and severity

advantages of ERM

• improved risk assessment: identified all risks, how they’re related and ranks them to determine how to control them

• integrated response to full range of risks

• alignment of risk management with the organization’s specific risk tolerance and its strategies

• fewer operational surprises and losses

• reduced earnings volatility

barriers to ERM progam

• lack of commitment from company leadership

• rigid organizational structure

• disagreements between departments over responsibilities

• technological difficultires

• lack of information sharing

why ERM?

organization may be able to offset one risk against another and reduce overall risk