Elliot Book Chapter 12: Risk Management Environment and Culture

Identifying internal and external environments and their stakeholders is the first step in the enterprise risk management ( $ERM$ ) process.
Stakeholders include any individual or organization directly or indirectly involved with or affected by organization decisions.
Senior management uses $SWOT$ (Strengths, Weaknesses, Opportunities, and Threats) analysis to assess these environments.
External Environment factors: Physical (location and climate change), social (cultural norms and $NGOs$ ), legal (regulations and case law), and economic (business cycles and gross national output).
Internal Environment factors: Product demand flux, operations processes, technology and information systems, and cognitive perceptions of risk.

Organizations divide into smaller units called risk centers to manage diverse risks effectively.
Risk Center: A discrete unit with a leader and specific objectives where risks are most appropriately managed.
Risk Owner: The party responsible for identifying and assessing risks within a specific component of the organization.
Ownership should be assigned to the stakeholder who creates the risk or is most affected by its volatility.
Significant risks exceeding a risk center's capacity are managed at the corporate level.
Relationships with external risk owners (suppliers, partners) require an assessment of shared values, culture, and risk appetite.

Organizational Culture: The shared beliefs, values, and behaviors that define how an organization operates and communicates.
Risk Attitude: An organization's perspective on the qualitative and quantitative value gained versus potential loss.
Risk Seeking (Risk Naive): Overemphasizes rewards, underestimates negative impacts, and focuses on a short-term horizon.
Risk Avoiding (Risk Obsessed): Preoccupied with negative outcomes and inclined toward risk transfer rather than innovation.
Risk Optimizing (Risk Managed): Balances the risk-reward relationship by realistically evaluating consequences against organizational goals.
A strong risk-aware culture is necessary to establish new behaviors as shared norms throughout the organization.

Ongoing, transparent communication builds a cushion of trust and credibility essential during crises.
Internal Channels: Formal channels follow official structures, while informal channels allow for rapid information exchange.
External Channels: Standard operating procedures ( $SOPs$ ) specify guidelines for information release to external parties.
Communication Modes:
- Verbal: Emphasizes active listening and accurate expression.
- Nonverbal: Includes body language and tone, which convey the majority of a listener’s understanding.
- Written: Includes reports, memos, and risk stewardship reports to ensure transparency for boards and shareholders.

Social Responsibility: Considering the consequences of organizational actions on all stakeholders and protecting societal welfare.
Code of Ethics: Provides minimum standards of expected behavior and guides ethical decision-making beyond legal requirements.
Internal Governance: Institutionalized parameters such as audit committees providing standards for financial control and risk management.
External Governance: Rules and standards set by regulators and special-interest organizations.
Sustainability: Managing the conflict between short-term profits and long-term goals, such as reducing carbon emissions to address environmental impacts.