Rapid changes in information technologies, globalization, outsourcing, greater complexity of business transactions, and increased competition make it much more difficult for boards and senior executives to effectively oversee the constantly changing portfolio of risks facing the enterprise.At the same time, many of the risk management techniques used by boards and senior executives are often ad hoc. In response to these trends, many organizations are embracing an emerging business practice known as enterprise risk management (ERM) that emphasizes a holistic approach to risk management for the entire enterprise.
The goal of ERM is to increase the likelihood that an organization will achieve its objectives by managing risks to be within the stakeholders’ appetite for risk. ERM done correctly should protect stakeholder value through the right set of risk assessment, transfer and retention strategies.Enterprise Risk ManagementSeveral conceptual frameworks have been developed in recent years that provide an overview of the core principles for effective ERM. In 2004, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) issued its Enterprise Risk Management-Integrated Framework, with this definition of ERM
Enterprise risk management is a process, effected by the entity’s board of directors, management, and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within the risk appetite, to provide reasonable assurance regarding the achievement of entity objectives.ERM has to be driven from the top. The board of directors and senior executives set the tone and direction. For ERM to be effective, it must be embedded in and connected directly to the enterprise’s strategy.
The goal of ERM is to help the enterprise achieve its core objectives.Assessment of Strategic Business RiskThe first step in effective risk management is finding a way to systematically evaluate a company’s strategic business risk. That must begin with defining the entity’s use of the term “risk.” Michael Porter’s definition in his landmark book, Competitive Strategy is useful: “Risk is a function of how poorly a strategy will perform if the ‘wrong’ scenario occurs.”Before management can effectively manage risks that might be identified by various scenario analyses, they need to define an overriding risk management goal. Otherwise, they won’t be able to appropriately determine whether identified risks are within acceptable tolerance levels.
The Return Driven Strategy framework describes how an enterprise’s strategy can be aligned with the ultimate objective to: “Ethically Maximize Shareholder Wealth.”Risk Retention and Risk Transfer StrategiesAs risks are identified, they must be continuously assessed and managed by way of retention or transfer. In the realities of today’s business world, all assessed risks are managed in one way or another. Whether that management is to ignore the risk, retain or transfer the risk will be one of the critical lynchpins which determines corporate value. These decisions will determine the potential effect and extent of disruption to corporate assets, customers, reputation and shareholder value.China: Opportunities and RisksAssume your company is planning to manufacture in China and import product to the US market.
As the recent scenarios of the importation of products with lead based paint demonstrate, an ERM analysis is critical. The departments with primary responsibility should identify and assess the risks of the decision. For instance, manufacturing and legal should be involved in pinpointing facts that distinguish China production. Cost of production, manufacturing feasibility, political climate and regulatory status will likely be some of the reasons a decision was made to manufacture in China. These facts will naturally point to some risk creating a “critical risk pocket.” SM A “critical risk pocket” SM denotes a parameter of risks which could occur depending upon developing facts. Manufacturing and legal will create a risk pocket involving differences in domestic manufacturing requirements and the potential that legal, and other issues, may arise from these differences.Identifying and Managing Critical Risk Pockets SM
Focusing on each critical risk pocket, SM the potential effect on the company assets should be considered. Once assessed, then the company must determine how much, if any of that risk, it wants to assume or transfer. Whether to protect corporate assets by purchasing insurance, self insuring, creating a captive, or using other products, requires specialized knowledge and experience taking into consideration numerous factors including: emerging legal, regulatory and political trends, the corporate market, the geographic reach of the company, loss ratio, available risk transfer products and options.
Risk Transfer and Retention StrategiesThe continuous assessment of risk and the development of risk transfer and risk retention strategies should be an integral part of the business strategy and its execution. Effective risk plans with the support of professional expertise can help to manage enterprise-wide risks more effectively by focusing on risk management activities that protect corporate assets and shareholder value. Strategic risk plans can provide a powerful force for continuously evaluating portfolio of risks facing an enterprise and proactively developing countermeasures for dealing with the risks that constantly threaten the enterprise.Katherine Smith Dedrick, J.D., MBA, is a partner at the Chicago based law firm of Childress Duffy, Ltd., and a founding member of the consulting firm Risk Worldwide, LLC. Katherine counsels corporations in risk assessment and transfer initiatives focusing on asset protection and the alternative methods available to protect those assets, as well as post disaster insurance and capital recovery.
