RISK 4A - ROLEs AND RESPONSIBILITIES IN ERM

board level roles

board of directors/board committee and audit committee

management level roles

ERMEC, ERM Steering Committee, ERM Project Team, Operational/Assurance/Administrative Working Groups, Risk champions/owners

Board of Directors / Board Committee (BOARD)

• are assigned oversight of top enterprise level risks or group of risks (risk domains) based on the responsibilities of the Committees

• The CEO or designees regularly update the responsible Board Committee of significant new or emerging risks and plans to manage these risks

• Receives reports from the applicable Board Committees on ERM top risks – usually annually (full Board) or quarterly (Committees)

• Ensures resources are adequately allocated by executive management to address the organizations top risks 

Audit Committee (BOARD)

• A key committee of the Board in executing the Board’s oversight responsibility of the ERM Program

• Reviews the ERM vision, short- and long-term ERM objectives and deployment work plan

• Receives regular updates on ERM Program activities

• Evaluates whether management is appropriately identifying, assessing, and responding to the critical risks facing the organization through its ERM Program

• Reviews listing of top risks at the enterprise level on a periodic basis (i.e., quarterly), and when developed through the ERM Risk Assessment

• Risks types typically assigned to the Audit Committee: Financial, Fraud, Cybersecurity, Technology, Insurance, Litigation, Privacy, and Compliance/Regulatory

ERM Exec Committee (MANAGEMENT)

• Promotes risk-informed decision-making and timely communication of top risks and mitigation strategies to the Board and across the enterprise leadership team

• Sets organizational risk appetite and risk strategy, discuss, and recommend these decisions to the Board

• Ensures enterprise risk appetite and risk tolerance levels that align with the organization’s strategic direction to guide risk-based decisions and actions

• Establishes and approves the membership and structure of the ERM Risk Management Steering Committee 

• Approves final risk management policies, recommendations, and proposals

• Ensures identified risks are assigned and regularly reported to appropriate board level committees for oversight

• Reviews the ERMEC charter (usually annually) and updates it as needed to respond to new risk-oversight needs and any changes in regulatory or other requirements 

Enterprise Risk Management Steering Committee (MANAGEMENT)

• Meets periodically to review top risk areas, status of mitigating risk initiatives, and emerging risks

• Ensures efficient and effective coordination of assurance activities (Internal Audit, Compliance, Information Security, Risk Management, Privacy, etc.) to identify and avoid gaps and duplicated efforts

• Requires the ERM Program to be periodically self-assessed and objectively assessed by an independent evaluator (with best practice emerging at a 5-year cadence)

• Ensures corrective actions that arise from independent evaluations of the ERM Program are addressed

• Reviews entity-level risk assessments and response plans

• Ensures risk response plans are appropriately resourced through the annual budgeting process

ERM Project Team (SUPPORT FOR ERM STEERING COMMITTEE AND ERM PROGRAM) → (MANAGEMENT)

• Develops foundational ERM practices and selects tools and techniques for approval by Executive Risk Management Executive Committee

• Identifies and adapts best-practice ERM approaches to be tailored for the organization

• Ensures risk universe remains up-to-date and relevant

• Documents and maintains the software-based risk registers of known enterprise level risks within the ERM risk universe

• Develops training and communication to ensure consistency of the ERM approach 

Operational and Assurance/Administrative Working Groups (MANAGEMENT)

• Leads or facilities ERM risk assessment assigned by the ERM Steering Committee

• Performs assessment of KRI for key risks relevant to their areas of responsibility 

• Reports to the ERM Steering Committee with status of risk mitigation activities 

Risk Champions / Risk owners (MANAGEMENT)

Participates in ERM risk assessment activities under their span of control

Risk Owners develop risk tolerance levels for individual risks within their span of control

Risk Champions approve risk tolerance levels and ensure escalation protocols are implemented to communicate risks breaching risk tolerance thresholds

Risk Ownerships develop and implement risk response strategies including appropriate risk mitigation activities and strategies for the risks to which they are assigned

Remains accountable for implementation and operating effectiveness of risk mitigation plans

Ensures risk mitigation plans are incorporated into planning and budgeting cycles when necessary

Monitors key risks for changes since risk assessment and escalate when risks exceed established tolerance levels

Internal Audit’s Role in Supporting ERM

Evaluate risk mitigation actions after ERM risk assessments are completed to assign an overall rating to the “Sufficiency of Mitigating Actions”

Assess the overall quality and performance of the ERM Program and its level of maturity / value to the organization

Perform internal audits and advisory consulting projects in relevant areas associated with key risks of the organization

should overall evaluation of quality of ERM program be done if Internal Audit is not indepdent of the ERM program?

no!!

According to NC State’s Annual Report on The State of Risk Oversight Today, ERM programs have matured but progress is slow. Most Organiations do not rate their ERM program as _____

“robust”

According to NC State’s Annual Report on The State of Risk Oversight Today, organizations struggle to connect ERM efforts with strategic planning processes and most do not see ERM as _________

providing a strategic advantage

According to NC State’s Annual Report on The State of Risk Oversight Today, most organizations identify risks on at least an annual basis for operational, compliance, and financial risks, but emerging strategic risks are given

the least attention

According to NC State’s Annual Report on The State of Risk Oversight Today, risk assessments are done using numerical scales — usually just _____________

likelihood and impact

According to NC State’s Annual Report on The State of Risk Oversight Today, risk dashboards usually have ____________________

KPIs and not KRIs

According to NC State’s Annual Report on The State of Risk Oversight Today, there are more organizations with CRO and many more have risk committees that meet

monthly or quarterly

According to NC State’s Annual Report on The State of Risk Oversight Today, most Board delegate ERM to their __________ to oversee

audit committees

According to NC State’s Annual Report on The State of Risk Oversight Today, there is pressure from Board and external parties for senior executives to ___________

increase their involvement in risk oversight activities

According to NC State’s Annual Report on The State of Risk Oversight Today, ________________________________ exist that limit the progress of ERM of organizations

internal barriers (generally competing priorities)