SlideShare a Scribd company logo
1 of 70
Executive Perspectives
on Top Risks for 2017
Key Issues Being Discussed in the
Boardroom and C-Suite
Research Conducted by North Carolina State University’s
ERM Initiative and Protiviti
Executive Summary
i · Protiviti · North Carolina State University ERM Initiative
Introduction
The impact of the Brexit vote in the U.K., increased volatility in
commodity markets, polarization
surrounding the 2016 presidential election in the United States,
terrorist events, asset bubbles in
China, continued discussion about fair wages and income
equality that includes calls for raising
the minimum wage, and ongoing instability in the Middle East
and the unprecedented Syrian
immigration in Europe are only some of the drivers of
uncertainty affecting the global business
outlook for 2017. Entities in virtually every industry and
country are reminded all too frequently
that they operate in what appears to many to be an increasingly
risky global landscape. Rapidly
escalating concerns about political and economic stability, data
breaches and related cyberattacks,
and continued incidents of terrorism vividly illustrate the reality
that organizations of all types face
risks that can suddenly propel them into global headlines,
creating complex enterprisewide risk
events that threaten brand, reputation, and, for some, their very
survival. Boards of directors and
executive management teams cannot afford to manage risks
casually on a reactive basis, especially
in light of the rapid pace of disruptive innovation and
technological developments in a digital world.
Protiviti and North Carolina State University’s ERM
Initiative are pleased to provide this executive summary
that highlights key findings in our full report focusing
on the top risks currently on the minds of global boards
of directors and executives. This executive summary
highlights results from our fifth annual risk survey of
directors and executives to obtain their views on the
extent to which a broad collection of risks are likely to
affect their organizations over the next year.
Our respondent group, comprised primarily of board
members and C-suite executives, provided their
perspectives about the potential impact in 2017 of 30
specific risks across these three dimensions:1
• Macroeconomic risks likely to affect their organi-
zation’s growth opportunities
• Strategic risks the organization faces that may
affect the validity of its strategy for pursuing
growth opportunities
• Operational risks that might affect key operations
of the organization in executing its strategy
This executive summary provides a brief description
of our methodology and an overview of the overall
risk concerns for 2017, followed by a review of the
results by type of executive position. It concludes
with a discussion of questions executives may want
to consider as they look to strengthen their overall
risk management processes.
Our full report (available at erm.ncsu.edu or
protiviti.com/toprisks) contains extensive analysis
of key insights about top risk concerns across
a number of different dimensions, including a
breakdown by industry, size of company, type
of ownership structure, geographic locations of
company headquarters (i.e., based in either North
America, Europe, Asia-Pacific or other regions), and
whether the organization has public debt.
1 Our report about top risks for 2016 and 2015 included 27
specific risks. Three additional risks were added for the 2017
survey.
See Table 2 for a list of the 30 risks addressed in this study.
Executive Perspectives on Top Risks for 2017 – Executive
Summary · 1protiviti.com · erm.ncsu.edu
About the Survey
We surveyed 735 board members and executives
across a number of industries and from around
the globe, asking them to assess the impact of 30
unique risks on their organization over the next
12 months. They rated the impact of each risk on
their organization using a 10-point scale, where 1
reflects “No Impact at All” and 10 reflects “Extensive
Impact.” For each of the 30 risks, we computed the
average score reported by all respondents and rank-
ordered the risks from highest to lowest impact. We
also grouped risks based on their average into one of
three classifications:
Classification Risks with an average score of
Significant Impact 6.0 or higher
Potential Impact 4.5 through 5.99
Less Significant Impact 4.49 or lower
http://protiviti.com
http://www.erm.ncsu.edu
2 · Protiviti · North Carolina State University ERM Initiative
With regard to the respondents, we targeted our survey
to individuals currently serving on the board of directors
or in senior executive positions so that we could capture
C-suite and board perspectives about risks on the
horizon for 2017. Respondents to the survey serve in a
number of different board and executive roles.
In our full report, (available online at erm.ncsu.edu
and protiviti.com/toprisks), we analyze variances
across different sizes and types of organizations,
industry, and respondent position, in addition to
differences between U.S.-, Europe- and Asia-Pacific-
based organizations. Page 14 provides more details
about our methodology. This executive summary
highlights our key findings.
Executive Position Number of Respondents
Board of Directors 16
Chief Executive Officer 78
Chief Financial Officer 100
Chief Risk Officer 136
Chief Audit Executive 132
Chief Information/Technology Officer 115
Other C-Suite2 93
All other3 65
Total Number of Respondents 735
2 This category includes titles such as chief operating officer,
general counsel and chief compliance officer.
3 These 65 respondents either did not provide a response or are
best described as middle management or business
advisers/consultants. We do not provide a
separate analysis for this category.
http://erm.ncsu.edu
http://protiviti.com/toprisks
Executive Perspectives on Top Risks for 2017 – Executive
Summary · 3protiviti.com · erm.ncsu.edu
Executive Summary
01
Survey respondents indicate that the overall global business
context is noticeably more risky than in
the two prior years, with respondents in the United States
indicating it is about the same as in prior
years, whereas respondents in other parts of the world are
signaling greater concern about the overall
risk environment in 2017 relative to last year. The overall risk
scores for all of the top 10 risks are higher
than prior years, suggesting that respondents sense the level of
risk is increasing across a number of
dimensions. A majority of respondents rated each of the top 10
risks as a “Significant Impact” risk, and
for two of the top 10 risks the overall average score exceeded
6.0 (on a 10-point scale), placing them as
“Significant Impact” risks on an overall basis.
02
elevated risks, there does not appear to
be a significant increase in the likelihood that organizations
will devote additional time or resources
to risk identification and management over the next 12 months.
While there is an overall moderate
level of interest in enhancing risk oversight processes, that level
is lower than the prior two years.
On the surface, this result seems paradoxical, but it could
indicate that organizations either are
facing resource constraints in an increasingly risky business
environment or are satisfied with the
sufficiency of prior year investments.
03
There is consistency between last year and this year as to which
risks made the top 10 list of risks out
of the 30 risks included in the survey, with some differences in
rank among the risks. There continue
to be concerns about operational risk issues, with five of the top
10 risks representing operational
concerns. Three of the top 10 risks relate to strategic risk
concerns, with two related to concerns about
macroeconomic issues. This year’s emphasis on operational
risks is consistent with our results in the
previous two years.
Brexit. Turmoil in the Middle East and the resulting surge
in immigration. Changes in national political leadership.
Depressed oil prices. Monetary policies and concerns about
inflation and inflated asset prices in China. Global terrorism.
Escalating healthcare costs. Rapidly developing innovations
from the digital technology revolution. Expanding regulation
and oversight. A strong U.S. dollar. These and a host of other
significant risk drivers are all contributing to the risk
dialogue in boardrooms and executive suites.
Expectations of key stakeholders regarding the
need for greater transparency about the nature
and magnitude of risks undertaken in executing an
organization’s corporate strategy continue to be high.
Pressures from boards, volatile markets, intensifying
competition, demanding regulatory requirements,
fear of catastrophic events and other dynamic forces
are leading to increasing calls for management to
design and implement effective risk management
capabilities to identify and assess the organization’s
key risk exposures, with the intent of reducing them
to an acceptable level.
Key Findings
http://protiviti.com
http://www.erm.ncsu.edu
4 · Protiviti · North Carolina State University ERM Initiative
With respect to the top five risks overall:
• Economic conditions in domestic and international
markets – This risk represents the top overall risk
and the level of concern is noticeably higher when
compared to the two prior years. Seventy-two
percent of our respondents rated this risk as a
“Significant Impact” risk.
• Regulatory change and heightened regulatory scru-
tiny – This risk continues to represent a major source
of uncertainty among the majority of organizations.
Sixty-six percent of our respondents rated this risk as
a “Significant Impact” risk. This risk was the overall
top risk in the prior four years we conducted this
survey, but it was edged out by concerns related to
economic conditions looking forward to 2017.
• Managing cyberthreats – Threats related to cyber-
security continue to be of concern as respondents
focus on how events might disrupt core operations.
This risk continues to be the top operational risk
overall and it is a top five risk for each of the four size
categories of organizations as well as four of the six
industry groupings we examine.
• Rapid speed of disruptive innovation – New to the
list of top five risks for 2017 is the risk of the speed
in which disruptive innovation or new technologies
might emerge that outpace an organization’s ability to
keep up and remain competitive. With advancements
in digital technologies and rapidly changing business
models, respondents are focused on whether their
organizations are agile enough to respond to sudden
developments that alter customer expectations and
change their core business model. That concern is
elevated for 2017 (fourth overall) relative to prior years.
• Privacy and identity protection – Respondents
ranked this risk as a top five risk for the first time
in 2016 and it continues as a top five risk for 2017.
The inclusion of this risk in the top five is consistent
with the increasing number of reports of hacking
and other forms of cyber intrusion that compromise
sensitive personal information.
in coming year – Most C-suite executives perceive
the magnitude and severity of risks being higher
in 2017 relative to prior years. Interestingly, board
members report the lowest threat level when
compared to any of the C-suite executive groups.
These findings suggest that there are differing
views of the top risk exposures facing their orga-
nizations – board members appear to be the most
optimistic, as they rated 18 of the 30 risks at the
lowest impact level, while chief executive officers
(CEOs) and chief financial officers (CFOs) rated
none of the 30 risks at the lowest level. The noted
differences in risk viewpoints across different types
of executives seem to be a concern at the global
level, given that we find similar kinds of differ-
ences in viewpoints continue to be present when
examining different regions of the world separately.
These findings suggest there is a strong need for
discussion and dialogue to ensure the organization
is focused on the right emerging risk exposures.
• CEOs and CFOs see riskier environment –
Interestingly, CEOs and CFOs perceive a riskier
environment overall relative to other members of
management based on the average risk scores for
each of the 30 risks they rated. They rate none of
the risks at the lowest impact level (a rating of 4.49
or lower on our 10-point scale). Chief information
officers (CIOs) rate the most number of risks (12 of
30 risks) at the “Significant Impact” level.
One of the first questions an organization seeks to
answer in risk management is, “What are our most
critical risks?” The organization’s answer to this ques-
tion lays the foundation for management to respond
with appropriate capabilities for managing these risks.
This executive summary provides insights as to what
the key risks are for 2017 based on the input of the
participating executives and board members.
The list of top 10 global risks for 2017, along with their
corresponding 2016 and 2015 scores, appears in Figure 1
on the following page.
M Macroeconomic
Risk Issue
O Operational
Risk Issue
S Strategic
Risk Issue
Executive Perspectives on Top Risks for 2017 – Executive
Summary · 5protiviti.com · erm.ncsu.edu
Figure 1: Top 10 Risks for 2017
2017 2016 2015
865 74
Economic conditions in markets we currently serve may
significantly restrict growth opportunities for our organization
M
Regulatory changes and regulatory scrutiny may heighten,
noticeably affecting the manner in which our products or
services will be produced or delivered
S
Our organization may not be sufficiently prepared to manage
cyberthreats that have the potential to significantly disrupt
core operations and/or damage our brand
O
Ensuring privacy/identity management and information
security/system protection may require significant resources for
us
Our organization’s succession challenges and ability to
attract and retain top talent may limit our ability to
achieve operational targets
Anticipated volatility in global financial markets and
currencies may create significantly challenging
issues for our organization to address
Resistance to change may restrict our organization from
making necessary adjustments to the business model
and core operations
Sustaining customer loyalty and retention may be increasingly
difficult due to evolving customer preferences and/or
demographic shifts in our existing customer base
Our organization’s culture may not sufficiently encourage the
timely identification and escalation of risk issues that have
the potential to significantly affect our core operations and
achievement of strategic objectives
O
O
O
O
M
Rapid speed of disruptive innovations and/or new technologies
within the industry may outpace our organization’s ability to
compete and/or manage the risk appropriately, without
making significant changes to our business model
S
S
http://protiviti.com
http://www.erm.ncsu.edu
6 · Protiviti · North Carolina State University ERM Initiative
In addition to our Key Findings, other notable findings
this year with regard to those risks making the top 10
include the following:
• The risk of succession challenges and the ability to
attract and retain talent continues to be an overall
top 10 risk, but it is especially prevalent for smaller
sized organizations (those with revenues under
$100 million), likely triggered by a tightening labor
market (though the decline in unemployment rates
has been relatively modest), and the respondents’
perception that significant operational challenges
may arise if organizations are unable to sustain a
workforce with the skills needed to implement their
growth strategies.
• With uncertainties surrounding Brexit, political
dynamics from the U.S. November 2016 elections,
falling commodity prices, and the direction of central
bank monetary policies around the world, respondents
continue to be focused on challenges for their orga-
nizations resulting from anticipated volatility in the
global financial markets and currencies. This risk has
been consistently increasing each year over the past
three years, signaling that it is of growing concern.
• Interestingly, respondents continue to highlight the
need for attention to be given to the overall culture of
the organization to ensure it is sufficient to encourage
the timely identification and escalation of risk issues.
This risk issue was added to our 2015 risk survey,
and it has been included in the top 10 risks each year
since then, with the level of concern even higher for
2017. Coupled with that, respondents also highlighted
another cultural concern related to overall resistance
to change within the organization. Respondents
continue to indicate concern about the organization’s
lack of willingness to make necessary adjustments to
the business model and core operations that might be
needed to respond to changes in the overall business
environment and industry. These issues can be lethal
if they result in the organization’s leaders becoming
out of touch with business realities.
• Rounding out the top 10 risks are concerns about an
organization’s ability to sustain customer loyalty
and retention due to evolving customer preferences
and other demographic shifts. When paired with
the concerns about the speed of disruptive innova-
tion, this issue of changing customer demographics
and their related preferences might combine to
threaten an organization’s core business model.
As a result, it is not surprising that many organi-
zations are focusing their marketing programs on
understanding customer behavior and attitudes,
with an aim toward building and sustaining profit-
able customer loyalty.
In addition to our analysis of the top 10 risk results
for the full sample, we conducted a number of sub-
analyses to pinpoint other trends and key differences
among respondents. Additional insights about the
overall risk environment for 2017 can be gleaned from
these analyses, which we highlight in a number of
charts and tables in our full report. Following are some
significant findings:
• For the 27 of 30 risks included in both last year’s
and this year’s survey, not one of the risk scores
decreased from 2016 to 2017. In all cases, the overall
risk score for each risk increased over the prior
year, suggesting an overall increase in risk concerns
across all dimensions for 2017 relative to last year.
When we look at the results across different regions
of the world (i.e., North America, Asia-Pacific
and Europe), we find that this overall finding is
primarily driven by respondents outside North
America. Respondents in the Asia-Pacific region
rated all 27 risks higher in 2017 relative to 2016, and
respondents in Europe rated 24 of 27 risks higher in
2017 relative to 2016. However, respondents in North
America only rated 9 of the 27 risks higher for 2017
compared to 2016. This suggests that the overall
environment may be perceived as riskier outside
North America for 2017.
Executive Perspectives on Top Risks for 2017 – Executive
Summary · 7protiviti.com · erm.ncsu.edu
• Three of the top five risks for 2017 with the greatest
increase in risk ratings from 2016 relate to macroeco-
nomic risk concerns. Concerns about overall economic
conditions, anticipated change in global trade policies,
and uncertainty surrounding political leadership in
national and international markets rose noticeably
over prior years. The state and health of global market
conditions are attracting significant attention.
• Challenges related to difficulties in obtaining afford-
able insurance coverages for certain risks represented
the operational risk with the greatest increase in risk
impact score over the prior year. The strategic risk
with the greatest increase in risk impact score relates
to the concern about regulatory changes and height-
ened regulatory scrutiny. Interestingly, that risk has
been the highest-ranked risk for the past several
years we have conducted our surveys.
• CEOs and CFOs rated none of the 30 risks at the
lowest impact level (“Less Significant Impact” – a
rating of 4.49 or lower), suggesting that they have
overall concerns about a number of risks. CEOs and
CFOs ranked concerns about economic conditions
and regulatory change as “Significant Impact”
risks. In addition, CFOs ranked two additional
risks as “Significant Impact”: sustained low fixed
interest rates having a significant effect on the
organization’s operations, and the impact of
disruptive innovations and/or new technologies
obsoleting the organization’s business model.
• CEOs identified three strategic risks as top risk
concerns: regulatory change and scrutiny, strategic
impact of cyber-related events, and opportunities
for organic growth. In contrast, CFOs and CIOs
rated more macroeconomic risks as their top
five risks, while chief audit executives (CAEs)
rated more operational risks in their top five.
Furthermore, other C-suite executives (a group
that includes chief operating officers, general
counsels, etc.) rated more risks in their top five
relative to strategic and macroeconomic risks.
This disparity in viewpoints emphasizes the
critical importance of the management team
engaging in risk discussions among themselves
and with the board, given an apparent lack of
consensus about the organization’s most signifi-
cant emerging risk exposures.
• All organizations, except the smallest (those with
revenues less than $100 million), rated some of their
top five risks as “Significant Impact” risks. The
largest organizations (those with revenues of $10
billion or higher) rated three of their top five risks as
“Significant Impact” risks while the next category of
large firms (those with revenues between $1 billion
and $9.9 billion) rated all top five risks as “Significant
Impact” risks. Thus, the environment for large orga-
nizations appears to be the riskiest relative to entities
in the other size categories. Unease over operational
risks were common among all sizes of organizations
(although the specific operational risks differ), and
concerns about those risks are generally higher for
2017 relative to 2016. These findings emphasize the
reality that there is no “one size fits all” list of risk
exposures across all organizations.
• With respect to industry groupings, the Financial
Services industry has seen a steady increase in
overall risk perceptions over the last three years,
likely due to anxiety over increasing regulatory
http://protiviti.com
http://www.erm.ncsu.edu
8 · Protiviti · North Carolina State University ERM Initiative
scrutiny, concerns about cyber risk, and a continued
low interest rate environment with no end in sight
over the foreseeable future. Respondents in the
Financial Services industry group rated six of 30
risks as “Significant Impact” risks, followed by the
Technology, Media and Communications industry
group, where five of the 30 risks are rated that highly.
The Energy and Utilities industry group also saw one
of the largest increases in overall risk concerns.
• While both U.S.-based and non-U.S.-based
organizations perceive the overall level of risk
magnitude and severity as high, non-U.S.-based
organizations scored their overall risk environ-
ment higher than U.S.-based organizations. Both
groups of respondents identified regulatory issues
and economic conditions as top five risk concerns,
with respondents in the Asia-Pacific and European
regions especially concerned about risks related to
economic conditions. U.S.-based firms rated more
operational risks as their top five risk concerns,
while non-U.S. firms rated macroeconomic
and strategic risks in their top five. U.S.-based
firms are more concerned about cybersecurity
and ensuring privacy/identity management,
and addressing succession challenges, while
non-U.S.-based firms are more concerned about
anticipated changes in trade policy, volatility
in global financial markets and currencies, and
disruptive innovations and new technologies. All
five top risks for non-U.S.-based organizations are
rated at the highest level – “Significant Impact”
risks – whereas only one of the top five risks for
U.S.-based organizations was at that level.
The full report on this study (available online at erm.
ncsu.edu and protiviti.com/toprisks) includes our
in-depth analysis of perceptions about specific risk
concerns. We identify and discuss variances in the
responses when viewed by organization size, ownership
type, industry and geography, as well as by respondent
role. In addition, on page 12 of this executive summary,
we pose key questions as a call to action for board
members and executive management to consider that
can serve as a diagnostic to evaluate and improve their
organization’s risk assessment process.
Our plan is to continue conducting this risk survey
periodically so we can stay abreast of key risk issues
on the minds of executives and observe trends in risk
concerns over time.
On page 12 of this executive summary, we pose key questions
as a call to action for board members
and executive management to consider that can serve as a
diagnostic to evaluate and improve their
organization’s risk assessment process.
http://erm.ncsu.edu
http://erm.ncsu.edu
http://protiviti.com/toprisks
Executive Perspectives on Top Risks for 2017 – Executive
Summary · 9protiviti.com · erm.ncsu.edu
Table 1: Perceived Impact for 2017 Relative to Prior Years – by
Role
Macroeconomic Risk Issues Board CEO CFO CRO CAE
CIO/
CTO
Other
C-Suite
Economic conditions in markets we currently
serve may significantly restrict growth
opportunities for our organization
Anticipated increases in labor costs may affect
our opportunity to meet profitability targets
Sustained low fixed interest rates may have a
significant effect on the organization’s operations
Anticipated changes in global trade policies
may limit our ability to operate effectively and
efficiently in international markets
Anticipated volatility in global financial markets
and currencies may create significantly challenging
issues for our organization to address
Uncertainty surrounding political leadership in
national and international markets may limit our
growth opportunities
Our ability to access sufficient capital/liquidity
may restrict growth opportunities for our
organization
Uncertainty surrounding costs of complying with
healthcare reform legislation may limit growth
opportunities for our organization
Geopolitical shifts and instability in
governmental regimes or expansion of global
terrorism may restrict the achievement of our
global growth objectives
http://protiviti.com
http://www.erm.ncsu.edu
10 · Protiviti · North Carolina State University ERM
Initiative
Strategic Risk Issues Board CEO CFO CRO CAE
CIO/
CTO
Other
C-Suite
Regulatory changes and regulatory scrutiny may
heighten, noticeably affecting the manner in
which our products or services will be produced
or delivered
Rapid speed of disruptive innovations and/or new
technologies within the industry may outpace our
organization’s ability to compete and/or manage
the risk appropriately, without making significant
changes to our business model
Sustaining customer loyalty and retention
may be increasingly dif ficult due to evolving
customer preferences and/or demographic
shifts in our existing customer base
Shifting expectations may trigger shareholder
activism for our organization that may
significantly impact our organization’s strategic
plan and vision
Social media, mobile applications and other
internet-based applications may significantly
impact our brand, customer relationships,
regulatory compliance processes and/or how we
do business
Shifts in social, environmental and other customer
preferences and expectations may be difficult for
us to identify and address on a timely basis
Opportunities for organic growth through
customer acquisition and/or enhancement may
be significantly limited for our organization
Ease of entrance of new competitors into the
industry and marketplace may threaten our
market share
Our organization may not be sufficiently prepared
to manage an unexpected crisis significantly
impacting our reputation
Growth through acquisitions, joint ventures and
other partnership activities may be difficult to
identify and implement
Substitute products and services may arise
that affect the viability of our current business
model and planned strategic initiatives
Executive Perspectives on Top Risks for 2017 – Executive
Summary · 11protiviti.com · erm.ncsu.edu
Operational Risk Issues Board CEO CFO CRO CAE
CIO/
CTO
Other
C-Suite
Our organization may not be sufficiently
prepared to manage cyberthreats that have the
potential to significantly disrupt core operations
and/or damage our brand
Ensuring privacy/identity management and
information security/system protection may
require significant resources for us
Our organization’s succession challenges and
ability to attract and retain top talent may limit
our ability to achieve operational targets
Inability to utilize data analytics and “big data”
to achieve market intelligence and increase
productivity and efficiency may significantly
affect our management of core operations and
strategic plan
Our organization’s culture may not sufficiently
encourage the timely identification and escalation
of risk issues that have the potential to significantly
affect our core operations and achievement of
strategic objectives
Our existing operations may not be able to meet
performance expectations related to quality,
time to market, cost and innovation as well as
our competitors
Resistance to change may restrict our
organization from making necessary adjustments
to the business model and core operations
Risks arising from our reliance on outsourcing
and strategic sourcing arrangements,
technolog y vendor contracts, and other
partnerships and/or joint ventures to achieve
operational goals may prevent us from meeting
organizational targets or impact our brand image
Uncertainty surrounding the viability of key
suppliers or scarcity of supply may make it
difficult to deliver our products or services
Our organization may face greater difficulty in
obtaining affordable insurance coverages for
certain risks that have been insurable in the past
http://protiviti.com
http://www.erm.ncsu.edu
12 · Protiviti · North Carolina State University ERM
Initiative
A Call to Action: Questions to Consider
This report provides insights from 735 board members
and executives about risks that are likely to affect
their organizations over the next 12 months. Overall,
most rate the business environment as significantly
risky, and on an overall basis, respondents rated each
of the 27 of 30 risks included in prior year surveys as
higher in 2017 relative to 2016 and 2015, suggesting
that there continues to be a number of uncertainties
in the marketplace for 2017.
The message is that the rapid pace of change in
the global business environment provides a risky
environment for entities of all types in which to operate.
The unique aspect regarding disruptive change is that
it represents a choice – which side of the change curve
do organizations want to be on? This is an important
question because, with the speed of change and constant
advances in technology, rapid response to new market
opportunities and emerging risks can be a major source
of competitive advantage. Conversely, failure to remain
abreast or ahead of the change curve can place an
organization in a position of becoming captive to events
rather than charting its own course.
Accordingly, in the interest of evaluating and improving
the risk assessment process in light of the findings in this
report, we offer executives and directors the following
diagnostic questions to consider when evaluating their
organization’s risk assessment process:
• Given the pace of change experienced in the
industry and the relative riskiness and nature of the
organization’s operations:
– Is the risk assessment process frequent enough?
– Does the process involve the appropriate
organizational stakeholders?
– Is the business environment monitored over
time for evidence of changes that may invalidate
one or more critical assumptions underlying the
organization’s strategy?
– Are risks evaluated in the context of the
organization’s strategy and operations? Is adequate
consideration given to macroeconomic issues?
– Is the process supported by an effective
methodology and risk criteria?
– Does the process encourage an open, positive
dialogue for identifying and evaluating
opportunities and risks? Is attention given to
reducing the risk of undue bias and groupthink?
– Does the assessment process give adequate
attention to differences in viewpoints that may
exist across different executives and different
global jurisdictions?
– Is the board informed of the results on a timely
basis? Do directors agree with management’s
determination of the significant risks?
• Following completion of a formal or informal risk
assessment:
–
risks?
–
certain risks that warrant a better understanding?
Does the process look for patterns that connect
potential interrelated risk events?
– Are effective risk response action plans developed
to address the risk at the source? Are the risk
owners accountable for their design and execution?
– When there is evidence that one or more critical
assumptions underlying the strategy are becoming,
or have become, invalid, does management act
timely on that knowledge?
– Is implementation of risk responses monitored by
the risk owners?
– Do decision-making processes consider the
impact on the organization’s risk profile?
Executive Perspectives on Top Risks for 2017 – Executive
Summary · 13protiviti.com · erm.ncsu.edu
• Is the board aware of the most critical risks
facing the organization? Do directors understand
the organization’s responses to these risks? Is
there an enterprisewide process in place that direc-
tors can point to that answers these questions and
is that process informing the board’s risk
oversight effectively?
• Is management periodically evaluating changes
in the business environment to identify the
risks inherent in the organization’s strategy? Is
the board sufficiently involved in the process,
particularly when such changes involve acquisition
of new businesses, entry into new markets, the
introduction of innovative technologies or alteration
of key assumptions underlying the strategy?
• Are significant risk issues warranting attention by
executive management and the board escalated to
their attention on a timely basis? Does management
apprise the board in a timely manner of significant
risks or significant changes in the organization’s
risk profile? Is there a process for identifying
emerging risks? Does it result in consideration of
response plans on a timely basis?
• Is there a periodic board-level dialogue regarding
management’s appetite for risk and whether
the organization’s risk profile is consistent with
that risk appetite? Is the board satisfied that the
strategy-setting process appropriately considers a
substantive assessment of the risks the enterprise
is taking on as strategic alternatives are consid-
ered during strategy setting and the selected
strategy is executed?
These and other questions can assist organizations
in defining their specific risks and assessing the
adequacy of the processes informing risk management
and board risk oversight. We hope this executive
summary and our full report provide important
insights about perceived risks on the horizon for 2017
and serve as a catalyst for an updated assessment
of risks and risk management capabilities within
organizations, as well as improvement in the
assessment processes in place.
http://protiviti.com
http://www.erm.ncsu.edu
14 · Protiviti · North Carolina State University ERM
Initiative
Methodology
We are pleased that participation from executives was
strong again this year. Globally, 735 board members and
executives across a number of industries participated in
this survey. We are especially pleased that we received
responses from individuals all over the world, with
407 respondents (55%) based in the United States and
328 respondents (45%) based outside the United States
(151 respondents [20.5%] were based in the Asia-Pacific
region and 136 respondents [18.5%] were based in
Europe). In 2016 our responses by region were 47% U.S.-
and 53% non-U.S.-based organizations. As a result, this
report again provides a perspective about risk issues on
the minds of executives at a global level.
Our survey was conducted online in the fall of 2016.
Each respondent was asked to rate 30 individual risk
issues using a 10-point scale, where a score of 1 reflects
“No Impact at All” and a score of 10 reflects “Extensive
Impact” to their organization over the next year.
For each of the 30 risk issues, we computed the
average score reported by all respondents. Using mean
scores across respondents, we rank-ordered risks
from highest to lowest impact. This approach enabled
us to compare mean scores across the past three years
to highlight changes in the perceived level of risk.
Consistent with our prior studies, we grouped all
the risks based on their average scores into one of
three classifications:
• Risks with an average score of 6.0 or higher are
classified as having a “Significant Impact” over the
next 12 months.
• Risks with an average score of 4.5 through 5.9 are
classified as having a “Potential Impact” over the
next 12 months.
• Risks with an average score of 4.4 or lower are clas-
sified as having a “Less Significant Impact” over
the next 12 months.
We refer to these risk classifications throughout our
report, and we also review results for various subgroups
(i.e., company size, position held by respondent,
industry representation, organization type, geographic
location and presence of rated debt). With respect to
the various industries, we grouped related industries
into combined industry groupings to facilitate analysis,
consistent with our prior years’ reports.
Executive Perspectives on Top Risks for 2017 – Executive
Summary · 15protiviti.com · erm.ncsu.edu
The following table lists the 30 risk issues rated by our
respondents, arrayed across three categories –
Macroeconomic, Strategic and Operational.
Table 2: List of 30 Risk Issues Analyzed
Macroeconomic Risk Issues
• Anticipated volatility in global financial markets and
currencies may create significantly challenging issues for our
organization to address
• Uncertainty surrounding political leadership in national and
international markets may limit our growth opportunities
• Anticipated changes in global trade policies may limit our
ability to operate effectively and efficiently in international
markets
• Our ability to access sufficient capital/liquidity may restrict
growth opportunities for our organization
• Economic conditions in markets we currently serve may
significantly restrict growth opportunities for our organization
• Uncertainty surrounding costs of complying with healthcare
reform legislation may limit growth opportunities for our
organization
• Geopolitical shifts and instability in governmental regimes or
expansion of global terrorism may restrict the achievement of
our global growth objectives
• Anticipated increases in labor costs may affect our
opportunity to meet profitability targets*
• Sustained low fixed interest rates may have a significant
effect on the organization’s operations*
Strategic Risk Issues
• Rapid speed of disruptive innovations and/or new
technologies within the industry may outpace our organization’s
ability
to compete and/or manage the risk appropriately, without
making significant changes to our business model
• Social media, mobile applications and other internet-based
applications may significantly impact our brand, customer
relationships, regulatory compliance processes and/or how we
do business
• Regulatory changes and regulatory scrutiny may heighten,
noticeably affecting the manner in which our products or
services
will be produced or delivered
• Shifts in social, environmental and other customer
preferences and expectations may be difficult for us to identify
and
address on a timely basis
• Ease of entrance of new competitors into the industry and
marketplace may threaten our market share
• Our organization may not be sufficiently prepared to manage
an unexpected crisis significantly impacting our reputation
• Growth through acquisitions, joint ventures and other
partnership activities may be difficult to identify and implement
• Opportunities for organic growth through customer
acquisition and/or enhancement may be significantly limited for
our organization
• Substitute products and services may arise that affect the
viability of our current business model and planned strategic
initiatives
• Sustaining customer loyalty and retention may be increasingly
difficult due to evolving customer preferences and/or
demographic shifts in our existing customer base
• Shifting expectations may trigger shareholder activism for
our organization that may significantly impact our
organization’s
strategic plan and vision*
* Represents a new risk issue added to the 2017 survey.
http://protiviti.com
http://www.erm.ncsu.edu
16 · Protiviti · North Carolina State University ERM
Initiative
Operational Risk Issues
• Uncertainty surrounding the viability of key suppliers or
scarcity of supply may make it dif ficult to deliver our products
or services
• Risks arising from our reliance on outsourcing and strategic
sourcing arrangements, technology vendor contracts, and other
partnerships and/or joint ventures to achieve operational goals
may prevent us from meeting organizational targets or impact
our brand image
• Our organization’s succession challenges and ability to attract
and retain top talent may limit our ability to achieve
operational targets
• Our organization may not be sufficiently prepared to manage
cyberthreats that have the potential to significantly disrupt core
operations and/or damage our brand
• Ensuring privacy/identity management and information
security/system protection may require significant resources for
us
• Our existing operations may not be able to meet performance
expectations related to quality, time to market, cost and
innovation as well as our competitors
• Inability to utilize data analytics and “big data” to achieve
market intelligence and increase productivity and efficiency
may
significantly affect our management of core operations and
strategic plan
• Resistance to change may restrict our organization from
making necessary adjustments to the business model and
core operations
• Our organization’s culture may not sufficiently encourage the
timely identification and escalation of risk issues that have the
potential to significantly affect our core operations and
achievement of strategic objectives
• Our organization may face greater difficulty in obtaining
affordable insurance coverages for certain risks that have been
insurable in the past
Executive Perspectives on Top Risks for 2017 – Executive
Summary · 17protiviti.com · erm.ncsu.edu
ABOUT PROTIVITI
Protiviti is a global consulting firm that delivers deep expertise,
objective insights, a tailored approach and unparalleled
collaboration to help leaders
confidently face the future. Protiviti and our independently
owned Member Firms provide consulting solutions in finance,
technology, operations, data,
analytics, governance, risk and internal audit to our clients
through our network of more than 70 offices in over 20
countries.
We have served more than 60 percent of Fortune 1000® and 35
percent of Fortune Global 500® companies. We also work with
smaller, growing companies,
including those looking to go public, as well as with
government agencies. Protiviti is a wholly owned subsidiary of
Robert Half (NYSE: RHI). Founded in 1948,
Robert Half is a member of the S&P 500 index.
ABOUT NORTH CAROLINA STATE UNIVERSITY’S ERM
INITIATIVE
The Enterprise Risk Management (ERM) Initiative in the Poole
College of Management at North Carolina State University
provides thought leadership about
ERM practices and their integration with strategy and corporate
governance. Faculty in the ERM Initiative frequently work with
boards of directors and senior
management teams helping them link ERM to strategy and
governance, host executive workshops and educational training
sessions, and issue research and
thought papers on practical approaches to implementing more
effective risk oversight techniques (www.erm.ncsu.edu).
Research Team
This research project was conducted in partnership
between Protiviti and North Carolina State University’s
Enterprise Risk Management Initiative. Individuals
participating in this project include:
North Carolina State University’s ERM Initiative
• Mark Beasley
• Bruce Branson
• Don Pagach
Protiviti
• Pat Scott
• Brian Christensen
• Jim DeLoach
• Kevin Donahue
The full report from North Carolina State University’s ERM
Initiative and Protiviti, Executive
Perspectives on Top Risks for 2017, is available at
erm.ncsu.edu and protiviti.com/toprisks.
http://protiviti.com
http://www.erm.ncsu.edu
http://erm.ncsu.edu
http://www.protiviti.com/toprisks
© 2016 Protiviti Inc. An Equal Opportunity Employer
M/F/Disability/ Veterans. PRO-1216-101093a
Protiviti is not licensed or registered as a public accounting
firm and does not issue opinions on financial statements or offer
attestation services.
www.erm.ncsu.edu www.protiviti.com
http://www.erm.ncsu.edu
http://www.protiviti.com
Statistical Analysis:
FY 2013 FY 2014 FY 2015
FY 20016
Budget
STATISTICAL
SUMMARY LRMC CCH CCH CCH
Admissions 16,583 17,122 17,397 17,745
Adjusted Admissions 22,934 23,101 23,375 23,843
Patient Days 71,109 76,731 78,799 80,375
Adjusted Patient Days 98,330 103,487 105,871 107,988
Average Daily Census 195 210 216 220
Percentage of
Occupancy 63% 68% 70% 71%
Average Length of
Stay 4.3 4.5 4.5 4.5
Emergency Visits 33,586 33,095 36,266 37,354
Urgent Care Visits 11,717 15,734 16,202 16,688
Observation Cases 4,380 5,216 5,496 5,661
Outpatient
Registrations 30,819 30,063 32,313 33,928
Home Health Visits 51,736 43,496 38,532 38,532
Births 1,297 1,328 1,265 1,265
Other Statistics
Employees 2,112 2,350 2,400
Full Time Equivalent Employees 1,690 1,880 1,920
Financial Data:
Balance Sheet
FY 2014 and 2015
Assets 2015 2014
Current assets:
Cash and cash equivalents
Cash and investments held by bond trustee –
required for current liabilities
Accounts receivable, less allowances for
uncollectible
$
53,635,94
4
11,552,85
9
34,328,81
4
12,479,98
5 patient accounts of approximately $40,466,000 and
$38,196,000 in 2010 and 2009, respectively 44,068,697
38,838,787
Estimated third-party settlements, net 1,295,000 1,758,080
Supplies 9,899,409 8,860,081
Prepaid expenses and other current assets 9,066,378 11,867,585
Total current assets
129,518,287 108,133,332
Assets limited as to use:
Current liabilities:
Accounts payable $ 19,860,709 15,744,839
Accrued expenses:
Employee compensation and
benefits
20,467,163 14,712,215
Interest 2,186,356 2,069,202
Other 11,501,375 12,929,155
Current portion of long-term debt 5,000,000 4,715,000
Total current liabilities 59,015,603 50,170,411
Interest rate swaps 7,663,158 5,121,610
Other 12,907,742 8,342,913
Long-term debt, less current portion 154,594,700 162,282,08
4
Total liabilities 234,181,203 225,917,01
8 Net assets:
Unrestricted 181,147,094 175,919,30
4 Temporarily restricted — 129,367
Permanently restricted — 1,101,862
Cash and investments held by bond trustee, less current portion
6,577,710 5,986,813
Other 4,575,567 2,660,774
Total assets limited as to use 11,153,277 8,647,587
Property and equipment, net 176,575,169 184,822,376
Other assets:
Investments
88,036,572
96,245,865
Deferred loan costs, net
1,762,631
—
2,414,097
1,524,290
Due from affiliates 7,388,113 1,280,004
Other assets 894,248 —
Total other assets 98,081,564 101,464,256
Total assets $ 415,328,297 403,067,551
Total net assets 181,147,094 177,150,53
3 Total liabilities and net assets $ 415,328,297 403,067,55
1
See accompanying notes to combined financial
statements.
Combined Statements of Operations
and Changes in Net Assets
Years ended 2015 and 2014
2015 2014
Unrestricted revenues:
Net patient service revenue $ 356,970,899
355,503,779
Other revenues 3,972,874 3,265,341
Total revenues 360,943,773 358,769,120
Expenses:
Salaries, wages, and benefits 154,185,77
3
156,730,75
4 Supplies and other costs 114,684,53
7
116,721,80
9 Physician and other professional fees 30,825,059
27,166,07
2 Provision for bad debts 26,961,851 27,098,156
Depreciation and amortization 23,307,829 24,265,90
2 Interest 6,255,524 7,237,20
7
Total expenses 356,220,57
3
359,219,90
0 Income (loss) from operations 4,723,200 (450,780)
Nonoperating gains (losses):
Investment loss, net
(3,070,456)
(2,316,910)
Change in net unrealized gains and losses on investments
6,788,945 (7,813,344)
Change in fair value of interest rate swaps (2,541,548)
(4,212,764)
Contributions 202,470 5,196
Change in interest in net assets of Leesburg Regional
Medical Center Charitable Foundation, Inc. — (393,832)
Loss on extinguishment of debt (648,158) (5,926,723)
Gain on sale of property and equipment 28,128 3,244
Other 38,270 9,186
Nonoperating gains (losses), net 797,651 (20,645,94
7) Excess (deficiency) of revenue and gains over expenses
before discontinued operations 5,520,851 (21,096,727)
See accompanying notes to combined financial statements.
Combined Statements of Cash Flows Years ended 2015 and
2014
2015 2014
Cash flows from operating activities and nonoperating
gains:
Change in net assets
$3,996,561
(15,261,655)
Adjustments to reconcile change in net assets to
net cash
provided by operating activities and nonoperating gains:
Depreciation and amortization 23,307,82
9
24,265,90
2 Provision for bad debts 26,961,85
1
27,098,15
6 Change in fair value of interest rate swaps 2,541,54
8
4,212,76
4 Change in net unrealized gains and losses on
investments
(6,788,94
5)
7,813,34
4 Gain on sale of property and equipment (28,128
)
(3,244
) Change in interest in net assets of Foundation 1,524,29
0
394,672
Gain on sale of businesses — (6,380,95
9) Loss on early extinguishment of debt 648,15
8
5,926,72
3 Amortization of premiums and discounts, net (187,38
4)
(189,839
) Changes in operating assets and liabilities:
Accounts receivable (32,191,76
1)
(24,785,38
1) Supplies (1,039,32
8)
719,289
Estimated third-party receivables/payables 463,08
0
(4,170,07
3) Prepaid expenses and other assets 1,906,95
9
(1,397,17
4) Accounts payable 4,115,87
0
1,446,42
9 Accrued expenses 4,444,32
2
2,036,40
3 Other noncurrent liabilities 4,564,829
2,293,03
8 Net cash provided by operating activities and
nonoperating gains 34,239,751
24,018,39
5 Cash flows from investing activities:
Net change in investments 14,998,23
7
(13,286,13
1) Purchases of property and equipment (14,964,88
4)
(10,135,35
4) Proceeds from sale of property and equipment 28,128 3,244
Proceeds from sale of businesses — 5,239,33
1 Net change in assets limited as to use (1,578,564)
2,987,04
8 Net cash used in investing activities (1,517,083)
(15,191,862) Cash flows from financing activities:
Repayment of long-term debt and capital lease
obligations
(44,715,00
0)
(102,517,95
2) Proceeds from issuance of long-term debt 37,500,00
0
97,655,00
0 Change in due from affiliates (6,108,10
9)
(784,088)
Payment of loan costs (92,429)
(2,422,432
) Net cash used in financing activities (13,415,538)
(8,069,472
)
Change in cash and cash equivalents 19,307,13
0
757,061
Cash and cash equivalents, beginning of year 34,328,814
33,571,75
3
Cash and cash equivalents, end of year $ 53,635,944
34,328,81
4
Noncash financing activity:
Notes receivable received in sales of businesses $ —
3,100,00
0
Relevant Notes to Financial Statements:
1. Organization and Summary of Significant Accounting
Policies
a. Use of Estimates - The preparation of these combined
financial statements, in
conformity with U.S. generally accepted accounting principles,
requires management to
make estimates and assumptions that affect the reported
amounts of assets and
liabilities and disclosure of contingent assets and liabilities at
the date of the combined
financial statements, and the reported amounts of revenues and
expenses during the
reporting period. Actual results could differ from those
estimates.
b. Cash and Cash Equivalents - CCH considers all highly liquid
investments with a
maturity of three months or less when purchased, excluding
investments classified as
assets limited as to use, to be cash equivalents.
2. Assets Limited as to Use, Investments, and Investment
Income
Investments in equity securities with readily determinable fair
values and all investments in
debt securities are measured at fair value in the combined
balance sheets. Investment income
(including realized gains and losses on investments, unrealized
gains and losses on trading
securities, interest and dividends) is included in excess of
revenues and gains over expenses
unless such earnings are subject to donor restrictions.
Investment income that is restricted by
donor stipulations is reported as an increase in temporarily
restricted net assets.
Other assets limited as to use includes $4,575,567 and
$2,660,774 as of 2015 and 2014,
respectively, which has been designated for the State of Florida
workers’ compensation and
medical malpractice requirements.
3. Allowance for Uncollectible Patient Accounts
Additions to the allowance for uncollectible patient accounts
are made by means of the
provision for bad debts. Accounts receivable are written off
after collection efforts have been
followed in accordance with CCH’s policies. Accounts written
off as uncollectible are deducted
from the allowance for uncollectible patient accounts, and
subsequent recoveries are added.
The amount of the provision for bad debts is based upon
management’s assessment of
historical and expected net collections, business and economic
conditions, trends in federal and
state government healthcare coverage and other collection
indicators.
4. Interest Rate Swaps
CCH uses interest rate swaps to manage net exposure to interest
rate changes related to its
borrowings and to lower its overall borrowing costs. CCH
recognizes all interest rate swaps as
either assets or liabilities in the combined balance sheets and
measures those instruments at
fair value. The changes in fair value of the derivatives are
recognized as nonoperating gains
(losses).
5. Net Patient Service Revenue
Gross patient service charges are recorded on the accrual basis
in the period in which services
are provided at CCH’s established rates, excluding charges
related to charity care. Contractual
adjustments and other deductions are subtracted from gross
patient service charges to
determine net patient service revenue. Contractual adjustments
under third-party
reimbursement programs and agreements represent the
difference between CCH’s established
rates for services and amounts reimbursed by third-party payors.
Payment arrangements
under third-party reimbursement programs and agreements
include prospectively determined
rates per discharge, reimbursed costs, discounted charges and
per diem payments. Other
deductions from revenue include discounts provided to self-pay
patients.
Net patient service revenue is reported at the net realizable
amounts due from patients, third-
party payors and others for services rendered, including
estimated retroactive adjustments
under reimbursement agreements with third-party payors due to
future audits, reviews and
investigations. Retroactive adjustments are accrued on an
estimated basis in the period the
related services are rendered and adjusted in future periods as
final settlements are
determined or as years are no longer subject to such audits,
reviews and investigations.
6. Medicare and Medicaid Programs
The Medicare program CCH for services rendered on a
prospective basis. Payments for
inpatient services are based on each patient’s DRG assignment.
Payments for outpatient
services are based on the Ambulatory Payment Group (APC)
assignment. DRGs and APCs are
based on each patient’s clinical diagnosis and medical
procedures. The Medicare program also
reimburses CCH for capital costs on a prospective basis. CCH
are reimbursed for cost
reimbursable items at a tentative rate with final settlement
determined after audit by the fiscal
intermediary. The Medicaid program reimburses CCH on a per
service basis established by
using prior year’s cost, not to exceed the current year’s
allowable cost. Annual provisions for
contractual adjustments are based on management’s
computation of prospective payments
and allowable costs. Final determination of amounts earned
pursuant to the Medicare and
Medicaid programs is subject to review by appropriate
governmental authorities or their
agents. In the opinion of management, adequate provision has
been made for any adjustments
that may result from such reviews.
Final settlements have been determined and received for all
Medicare cost reports through the
year ended 2008. Adjustments to revenue are accrued on an
estimated basis in the period the
related services are rendered and adjusted in future periods as
changes in estimated provisions
and final settlements are determined. Adjustments to revenue
related to prior periods
decreased net patient service revenue by approximately
$220,000 and increased net patient
service revenue by approximately $3,299,000 for the years
ended 2014 and 2014,
respectively.
Approximately 61% and 63% of net patient service revenue was
derived from the Medicare
program for the years ended 2015 and 2014, respectively.
Approximately 4% and 1% of net
patient service revenue was derived from the Medicaid program
for the years ended 2015 and
2014, respectively. Laws and regulations governing the
Medicare and Medicaid programs are
extremely complex and subject to interpretation. As a result,
there is at least a reasonable
possibility that recorded estimates will change by a material
amount in the near term.
7. Uncompensated Care
CCH provides uncompensated charity care to patients who meet
certain established criteria.
CCH does not pursue collection of amounts determined to
qualify as charity care; therefore,
these amounts are excluded from net patient service revenues.
Charity care at established
rates was approximately $31,091,000 and $23,949,000 for the
years ended 2015 and 2014,
respectively.
CCH also provides uncompensated care to patients that do not
have health insurance or that
do not meet the established criteria for charity care. CCH
pursues collection of these amounts
net of any discounts; however, certain amounts are eventually
determined to be
uncollectible. These amounts are classified as provision for bad
debts in the accompanying
combined statements of operations and changes in net assets and
totaled approximately
$26,962,000 and $27,321,000 for the years ended 2015 and
2014, respectively.
8. Long-Term Debt
In August 2008, CCH entered into another interest rate swap
agreement (the Second Swap
Agreement) to limit the effect of increases in interest rates
related to the 2008A Series Bonds.
The Second Swap Agreement expires in July 2031. The notional
principal amount of the Swap
Agreement is $22,655,000. The effect of the Second Swap
Agreement is to attempt to fix the
effective interest rate at 3.352%. For the years ended, 2015 and
2014, CCH recognized an
increase in interest expense of $702,541 and $458,712,
respectively, in the combined
statements of operations and changes in net assets associated
with payment differentials for
its Second Swap Agreement. The fair value of the Second Swap
Agreement is the estimated
amount LRMC would receive or pay to terminate the Second
Swap Agreement at the reporting
date, taking into account current interest rates and the current
creditworthiness of the parties.
The fair value of the Second Swap Agreement is a liability of
$2,605,703 and $1,730,473 as
of June 30, 2010 and 2009, respectively, and is included as a
separate noncurrent liability in
the accompanying combined balance sheets. The change in the
fair value of the Second Swap
Agreement resulted in a loss of $875,230 and
$1,730,473 for the years ended 2015 and 2014, respectively, and
is classified as a
nonoperating loss in the accompanying combined statements of
operations and changes in net
assets.
Due to the uncertainty surrounding monoline bond insurers,
such as AMBAC, MBIA, FSA, and
Radian, during 2009, CCH refunded the 2001 Auction Rate
Bonds insured by AMBAC and the
2006 Bonds insured by Radian.
CCH has a defined contribution retirement plan (the Plan)
covering substantially all employees.
The Plan provides that CCH will match 50% of employee
contributions, up to 3% of the
contributing employee’s compensation. Additional contributions
to the Plan are at the discretion
of the Board of Directors. CCH contributed an additional 1.25%
of employee compensation for
the years ended, 2015 and 2014. Total Plan expense was
approximately
$3,442,000 and $3,246,000 for the years ended 2015 and 2014,
respectively.
CCH has an employee health benefit plan covering substantially
all health costs for eligible
employees and their dependents, including self-insurance
coverage for amounts up to a
specified level. Health plan expense was approximately
$27,508,000 and $25,211,000 for the
years ended 2015 and 2014, respectively.
9. Commitments and Contingencies
a. Contingencies
CCH annually purchases commercial malpractice insurance
policies to cover medical
malpractice claims. Such policies have deductible provisions, in
varying amounts, for
which CCH is self-insured.
Losses that are subject to the deductible provisions, including
an estimate of claims
incurred but not reported, total approximately $16,945,000 and
$14,057,000 as of 2015
and 2014, respectively. Such amounts are included in other
accrued expenses, if payment
is expected within one year, or as other long-term liabilities in
the accompanying
combined balance sheets. CCH may be liable for ultimate losses
in excess of amounts
accrued. In the opinion of management, such amounts would not
have a material adverse
effect on CCH’s financial position or results of operations.
From time to time, CCH is involved in other litigation and
claims arising in the normal
course of business. After consultation with legal counsel,
management believes that these
matters will be resolved with no material adverse effect on
CCH’s financial position or
results of operations.
10. Concentrations of Credit Risk
CCH grants credit without collateral to its patients, most of who
are local residents and are
insured under third-party payor agreements. CCH does not
charge interest on accounts
receivable. Net patient accounts receivable included
approximately $24,174,000 or 55%, due
from the Medicare program as of 2015, and $20,126,000 or
50%, due from the Medicare
program as of 2015. The credit risk for other concentrations of
receivables is limited due to the
large number of insurance companies and other payors that
provide payments for services.
Project References:
• Controlling Retained Insurance Costs Through an Allocation
<insert link to
http://ezproxy.rasmussen.edu/login?url=http://search.ebscohost.
com/log
in.aspx?direct=true&db=bth&AN=103109497&site=ehost-live
• Study Examines Top Priorities of Hospital C-Suite Executives
and Risk Managers
<insert link to
http://ezproxy.rasmussen.edu/login?url=http://search.ebscohost.
com/log
in.aspx?direct=true&db=bth&AN=91887385&site=ehost-live
• How to Conduct a Risk Workshop <insert link to
http://ezproxy.rasmussen.edu/login?url=http://search.ebscohost.
com/log
in.aspx?direct=true&db=bth&AN=93288103&site=ehost-live
• Your Hospital’s Strategy for Managing Total Cost of Risk
<insert link to
http://search.proquest.com.ezproxy.rasmussen.edu/docview/609
961741?
accountid=40836
• Global Association of Risk Professionals <insert link to
www.garp.org>

More Related Content

Similar to Executive Perspectives on Top Risks for 2017Key Issues B.docx

Student 1 The main intention of this framework is to support .docx
Student 1 The main intention of this framework is to support .docxStudent 1 The main intention of this framework is to support .docx
Student 1 The main intention of this framework is to support .docx
cpatriciarpatricia
 
Deloitte es grc_sostenibilidad-reputation-survey
Deloitte es grc_sostenibilidad-reputation-surveyDeloitte es grc_sostenibilidad-reputation-survey
Deloitte es grc_sostenibilidad-reputation-survey
Bluemap Consulting Group
 
The Safety agenda: Leading Safety Into The Future from National Safety Council
The Safety agenda: Leading Safety Into The Future from National Safety CouncilThe Safety agenda: Leading Safety Into The Future from National Safety Council
The Safety agenda: Leading Safety Into The Future from National Safety Council
MIELKE
 

Similar to Executive Perspectives on Top Risks for 2017Key Issues B.docx (20)

Emergence of the Chief Risk Officer function
Emergence of the Chief Risk Officer functionEmergence of the Chief Risk Officer function
Emergence of the Chief Risk Officer function
 
Risk And Threat Assessment
Risk And Threat AssessmentRisk And Threat Assessment
Risk And Threat Assessment
 
Country credit ratings and sustainability: credit rating agencies are 20 year...
Country credit ratings and sustainability: credit rating agencies are 20 year...Country credit ratings and sustainability: credit rating agencies are 20 year...
Country credit ratings and sustainability: credit rating agencies are 20 year...
 
PwC 2016 CEO Survey Insurance report
PwC 2016 CEO Survey Insurance report PwC 2016 CEO Survey Insurance report
PwC 2016 CEO Survey Insurance report
 
Student 1 The main intention of this framework is to support .docx
Student 1 The main intention of this framework is to support .docxStudent 1 The main intention of this framework is to support .docx
Student 1 The main intention of this framework is to support .docx
 
Deloitte es grc_sostenibilidad-reputation-survey
Deloitte es grc_sostenibilidad-reputation-surveyDeloitte es grc_sostenibilidad-reputation-survey
Deloitte es grc_sostenibilidad-reputation-survey
 
1. Fraud risk asessment (rev).pptx
1. Fraud risk asessment (rev).pptx1. Fraud risk asessment (rev).pptx
1. Fraud risk asessment (rev).pptx
 
K458893.pdf
K458893.pdfK458893.pdf
K458893.pdf
 
Risk Management And Internal Control In The Changing Econmic Landscape
Risk Management And Internal Control In The Changing Econmic LandscapeRisk Management And Internal Control In The Changing Econmic Landscape
Risk Management And Internal Control In The Changing Econmic Landscape
 
Are CEOs Less Ethical Than in the Past?
Are CEOs Less Ethical Than in the Past?Are CEOs Less Ethical Than in the Past?
Are CEOs Less Ethical Than in the Past?
 
Risk Monitoring and Management Trends In Commodities
Risk Monitoring and Management Trends In CommoditiesRisk Monitoring and Management Trends In Commodities
Risk Monitoring and Management Trends In Commodities
 
Aon's Underrated Threats Report
Aon's Underrated Threats ReportAon's Underrated Threats Report
Aon's Underrated Threats Report
 
Deloitte survey reveals how global business executives understanding of strat...
Deloitte survey reveals how global business executives understanding of strat...Deloitte survey reveals how global business executives understanding of strat...
Deloitte survey reveals how global business executives understanding of strat...
 
About The PRS Group
About The PRS GroupAbout The PRS Group
About The PRS Group
 
The Safety agenda: Leading Safety Into The Future from National Safety Council
The Safety agenda: Leading Safety Into The Future from National Safety CouncilThe Safety agenda: Leading Safety Into The Future from National Safety Council
The Safety agenda: Leading Safety Into The Future from National Safety Council
 
Insights from the global risk management survey, 10th edition
Insights from the global risk management survey, 10th editionInsights from the global risk management survey, 10th edition
Insights from the global risk management survey, 10th edition
 
Risk Management
Risk ManagementRisk Management
Risk Management
 
Всемирный обзор экономических преступлений за 2016 год
Всемирный обзор экономических преступлений за 2016 годВсемирный обзор экономических преступлений за 2016 год
Всемирный обзор экономических преступлений за 2016 год
 
Accenture 2015: Global Risk Management Study - North American Insurance Report
Accenture 2015: Global Risk Management Study - North American Insurance ReportAccenture 2015: Global Risk Management Study - North American Insurance Report
Accenture 2015: Global Risk Management Study - North American Insurance Report
 
Factors: Finding a place in institutional investors' arsenal
Factors: Finding a place in institutional investors' arsenalFactors: Finding a place in institutional investors' arsenal
Factors: Finding a place in institutional investors' arsenal
 

More from SANSKAR20

The Arts and Royalty; Philosophers Debate Politics Please respond .docx
The Arts and Royalty; Philosophers Debate Politics Please respond .docxThe Arts and Royalty; Philosophers Debate Politics Please respond .docx
The Arts and Royalty; Philosophers Debate Politics Please respond .docx
SANSKAR20
 
The Article Critique is required to be a minimum of two pages to a m.docx
The Article Critique is required to be a minimum of two pages to a m.docxThe Article Critique is required to be a minimum of two pages to a m.docx
The Article Critique is required to be a minimum of two pages to a m.docx
SANSKAR20
 
The Apple Computer Company is one of the most innovative technology .docx
The Apple Computer Company is one of the most innovative technology .docxThe Apple Computer Company is one of the most innovative technology .docx
The Apple Computer Company is one of the most innovative technology .docx
SANSKAR20
 
The annotated bibliography for your course is now due. The annotated.docx
The annotated bibliography for your course is now due. The annotated.docxThe annotated bibliography for your course is now due. The annotated.docx
The annotated bibliography for your course is now due. The annotated.docx
SANSKAR20
 

More from SANSKAR20 (20)

The Assignment (3–5 pages)Complete a leadership development plan .docx
The Assignment (3–5 pages)Complete a leadership development plan .docxThe Assignment (3–5 pages)Complete a leadership development plan .docx
The Assignment (3–5 pages)Complete a leadership development plan .docx
 
The assignment consist of a Case Study.  I have attached the Case St.docx
The assignment consist of a Case Study.  I have attached the Case St.docxThe assignment consist of a Case Study.  I have attached the Case St.docx
The assignment consist of a Case Study.  I have attached the Case St.docx
 
The annotated bibliography will present an introduction and five ref.docx
The annotated bibliography will present an introduction and five ref.docxThe annotated bibliography will present an introduction and five ref.docx
The annotated bibliography will present an introduction and five ref.docx
 
The artist Georges Seurat is one of the worlds most fascinating art.docx
The artist Georges Seurat is one of the worlds most fascinating art.docxThe artist Georges Seurat is one of the worlds most fascinating art.docx
The artist Georges Seurat is one of the worlds most fascinating art.docx
 
The Assignment (2–3 pages including a budget worksheet)Explain th.docx
The Assignment (2–3 pages including a budget worksheet)Explain th.docxThe Assignment (2–3 pages including a budget worksheet)Explain th.docx
The Assignment (2–3 pages including a budget worksheet)Explain th.docx
 
The assigment is to Research and find me resources on  Portland Sta.docx
The assigment is to Research and find me resources on  Portland Sta.docxThe assigment is to Research and find me resources on  Portland Sta.docx
The assigment is to Research and find me resources on  Portland Sta.docx
 
the article.httpwww.nytimes.com20120930opinionsundaythe-m.docx
the article.httpwww.nytimes.com20120930opinionsundaythe-m.docxthe article.httpwww.nytimes.com20120930opinionsundaythe-m.docx
the article.httpwww.nytimes.com20120930opinionsundaythe-m.docx
 
The Arts and Royalty; Philosophers Debate Politics Please respond .docx
The Arts and Royalty; Philosophers Debate Politics Please respond .docxThe Arts and Royalty; Philosophers Debate Politics Please respond .docx
The Arts and Royalty; Philosophers Debate Politics Please respond .docx
 
The assassination of Archduke Franz Ferdinand was the immediate caus.docx
The assassination of Archduke Franz Ferdinand was the immediate caus.docxThe assassination of Archduke Franz Ferdinand was the immediate caus.docx
The assassination of Archduke Franz Ferdinand was the immediate caus.docx
 
The article Fostering Second Language Development in Young Children.docx
The article Fostering Second Language Development in Young Children.docxThe article Fostering Second Language Development in Young Children.docx
The article Fostering Second Language Development in Young Children.docx
 
The Article Critique is required to be a minimum of two pages to a m.docx
The Article Critique is required to be a minimum of two pages to a m.docxThe Article Critique is required to be a minimum of two pages to a m.docx
The Article Critique is required to be a minimum of two pages to a m.docx
 
The Apple Computer Company is one of the most innovative technology .docx
The Apple Computer Company is one of the most innovative technology .docxThe Apple Computer Company is one of the most innovative technology .docx
The Apple Computer Company is one of the most innovative technology .docx
 
The artist Georges Seurat is one of the worlds most fascinating art.docx
The artist Georges Seurat is one of the worlds most fascinating art.docxThe artist Georges Seurat is one of the worlds most fascinating art.docx
The artist Georges Seurat is one of the worlds most fascinating art.docx
 
The Article Attached A Bretton Woods for InnovationBy St.docx
The Article Attached A Bretton Woods for InnovationBy St.docxThe Article Attached A Bretton Woods for InnovationBy St.docx
The Article Attached A Bretton Woods for InnovationBy St.docx
 
The analysis must includeExecutive summaryHistory and evolution.docx
The analysis must includeExecutive summaryHistory and evolution.docxThe analysis must includeExecutive summaryHistory and evolution.docx
The analysis must includeExecutive summaryHistory and evolution.docx
 
The annotated bibliography for your course is now due. The annotated.docx
The annotated bibliography for your course is now due. The annotated.docxThe annotated bibliography for your course is now due. The annotated.docx
The annotated bibliography for your course is now due. The annotated.docx
 
The Americans With Disabilities Act (ADA) was designed to protect wo.docx
The Americans With Disabilities Act (ADA) was designed to protect wo.docxThe Americans With Disabilities Act (ADA) was designed to protect wo.docx
The Americans With Disabilities Act (ADA) was designed to protect wo.docx
 
The air they have of person who never knew how it felt to stand in .docx
The air they have of person who never knew how it felt to stand in .docxThe air they have of person who never knew how it felt to stand in .docx
The air they have of person who never knew how it felt to stand in .docx
 
The agreement is for the tutor to write a Microsoft word doc of a .docx
The agreement is for the tutor to write a Microsoft word doc of a .docxThe agreement is for the tutor to write a Microsoft word doc of a .docx
The agreement is for the tutor to write a Microsoft word doc of a .docx
 
The abstract is a 150-250 word summary of your Research Paper, and i.docx
The abstract is a 150-250 word summary of your Research Paper, and i.docxThe abstract is a 150-250 word summary of your Research Paper, and i.docx
The abstract is a 150-250 word summary of your Research Paper, and i.docx
 

Recently uploaded

QUATER-1-PE-HEALTH-LC2- this is just a sample of unpacked lesson
QUATER-1-PE-HEALTH-LC2- this is just a sample of unpacked lessonQUATER-1-PE-HEALTH-LC2- this is just a sample of unpacked lesson
QUATER-1-PE-HEALTH-LC2- this is just a sample of unpacked lesson
httgc7rh9c
 
SPLICE Working Group: Reusable Code Examples
SPLICE Working Group:Reusable Code ExamplesSPLICE Working Group:Reusable Code Examples
SPLICE Working Group: Reusable Code Examples
Peter Brusilovsky
 

Recently uploaded (20)

Towards a code of practice for AI in AT.pptx
Towards a code of practice for AI in AT.pptxTowards a code of practice for AI in AT.pptx
Towards a code of practice for AI in AT.pptx
 
When Quality Assurance Meets Innovation in Higher Education - Report launch w...
When Quality Assurance Meets Innovation in Higher Education - Report launch w...When Quality Assurance Meets Innovation in Higher Education - Report launch w...
When Quality Assurance Meets Innovation in Higher Education - Report launch w...
 
Diuretic, Hypoglycemic and Limit test of Heavy metals and Arsenic.-1.pdf
Diuretic, Hypoglycemic and Limit test of Heavy metals and Arsenic.-1.pdfDiuretic, Hypoglycemic and Limit test of Heavy metals and Arsenic.-1.pdf
Diuretic, Hypoglycemic and Limit test of Heavy metals and Arsenic.-1.pdf
 
Andreas Schleicher presents at the launch of What does child empowerment mean...
Andreas Schleicher presents at the launch of What does child empowerment mean...Andreas Schleicher presents at the launch of What does child empowerment mean...
Andreas Schleicher presents at the launch of What does child empowerment mean...
 
UGC NET Paper 1 Unit 7 DATA INTERPRETATION.pdf
UGC NET Paper 1 Unit 7 DATA INTERPRETATION.pdfUGC NET Paper 1 Unit 7 DATA INTERPRETATION.pdf
UGC NET Paper 1 Unit 7 DATA INTERPRETATION.pdf
 
QUATER-1-PE-HEALTH-LC2- this is just a sample of unpacked lesson
QUATER-1-PE-HEALTH-LC2- this is just a sample of unpacked lessonQUATER-1-PE-HEALTH-LC2- this is just a sample of unpacked lesson
QUATER-1-PE-HEALTH-LC2- this is just a sample of unpacked lesson
 
Unit 3 Emotional Intelligence and Spiritual Intelligence.pdf
Unit 3 Emotional Intelligence and Spiritual Intelligence.pdfUnit 3 Emotional Intelligence and Spiritual Intelligence.pdf
Unit 3 Emotional Intelligence and Spiritual Intelligence.pdf
 
PANDITA RAMABAI- Indian political thought GENDER.pptx
PANDITA RAMABAI- Indian political thought GENDER.pptxPANDITA RAMABAI- Indian political thought GENDER.pptx
PANDITA RAMABAI- Indian political thought GENDER.pptx
 
Understanding Accommodations and Modifications
Understanding  Accommodations and ModificationsUnderstanding  Accommodations and Modifications
Understanding Accommodations and Modifications
 
HMCS Vancouver Pre-Deployment Brief - May 2024 (Web Version).pptx
HMCS Vancouver Pre-Deployment Brief - May 2024 (Web Version).pptxHMCS Vancouver Pre-Deployment Brief - May 2024 (Web Version).pptx
HMCS Vancouver Pre-Deployment Brief - May 2024 (Web Version).pptx
 
FICTIONAL SALESMAN/SALESMAN SNSW 2024.pdf
FICTIONAL SALESMAN/SALESMAN SNSW 2024.pdfFICTIONAL SALESMAN/SALESMAN SNSW 2024.pdf
FICTIONAL SALESMAN/SALESMAN SNSW 2024.pdf
 
AIM of Education-Teachers Training-2024.ppt
AIM of Education-Teachers Training-2024.pptAIM of Education-Teachers Training-2024.ppt
AIM of Education-Teachers Training-2024.ppt
 
Including Mental Health Support in Project Delivery, 14 May.pdf
Including Mental Health Support in Project Delivery, 14 May.pdfIncluding Mental Health Support in Project Delivery, 14 May.pdf
Including Mental Health Support in Project Delivery, 14 May.pdf
 
FSB Advising Checklist - Orientation 2024
FSB Advising Checklist - Orientation 2024FSB Advising Checklist - Orientation 2024
FSB Advising Checklist - Orientation 2024
 
Simple, Complex, and Compound Sentences Exercises.pdf
Simple, Complex, and Compound Sentences Exercises.pdfSimple, Complex, and Compound Sentences Exercises.pdf
Simple, Complex, and Compound Sentences Exercises.pdf
 
OS-operating systems- ch05 (CPU Scheduling) ...
OS-operating systems- ch05 (CPU Scheduling) ...OS-operating systems- ch05 (CPU Scheduling) ...
OS-operating systems- ch05 (CPU Scheduling) ...
 
SPLICE Working Group: Reusable Code Examples
SPLICE Working Group:Reusable Code ExamplesSPLICE Working Group:Reusable Code Examples
SPLICE Working Group: Reusable Code Examples
 
VAMOS CUIDAR DO NOSSO PLANETA! .
VAMOS CUIDAR DO NOSSO PLANETA!                    .VAMOS CUIDAR DO NOSSO PLANETA!                    .
VAMOS CUIDAR DO NOSSO PLANETA! .
 
NO1 Top Black Magic Specialist In Lahore Black magic In Pakistan Kala Ilam Ex...
NO1 Top Black Magic Specialist In Lahore Black magic In Pakistan Kala Ilam Ex...NO1 Top Black Magic Specialist In Lahore Black magic In Pakistan Kala Ilam Ex...
NO1 Top Black Magic Specialist In Lahore Black magic In Pakistan Kala Ilam Ex...
 
Model Attribute _rec_name in the Odoo 17
Model Attribute _rec_name in the Odoo 17Model Attribute _rec_name in the Odoo 17
Model Attribute _rec_name in the Odoo 17
 

Executive Perspectives on Top Risks for 2017Key Issues B.docx

  • 1. Executive Perspectives on Top Risks for 2017 Key Issues Being Discussed in the Boardroom and C-Suite Research Conducted by North Carolina State University’s ERM Initiative and Protiviti Executive Summary i · Protiviti · North Carolina State University ERM Initiative Introduction The impact of the Brexit vote in the U.K., increased volatility in commodity markets, polarization surrounding the 2016 presidential election in the United States, terrorist events, asset bubbles in China, continued discussion about fair wages and income equality that includes calls for raising the minimum wage, and ongoing instability in the Middle East and the unprecedented Syrian immigration in Europe are only some of the drivers of uncertainty affecting the global business
  • 2. outlook for 2017. Entities in virtually every industry and country are reminded all too frequently that they operate in what appears to many to be an increasingly risky global landscape. Rapidly escalating concerns about political and economic stability, data breaches and related cyberattacks, and continued incidents of terrorism vividly illustrate the reality that organizations of all types face risks that can suddenly propel them into global headlines, creating complex enterprisewide risk events that threaten brand, reputation, and, for some, their very survival. Boards of directors and executive management teams cannot afford to manage risks casually on a reactive basis, especially in light of the rapid pace of disruptive innovation and technological developments in a digital world. Protiviti and North Carolina State University’s ERM Initiative are pleased to provide this executive summary that highlights key findings in our full report focusing on the top risks currently on the minds of global boards of directors and executives. This executive summary highlights results from our fifth annual risk survey of
  • 3. directors and executives to obtain their views on the extent to which a broad collection of risks are likely to affect their organizations over the next year. Our respondent group, comprised primarily of board members and C-suite executives, provided their perspectives about the potential impact in 2017 of 30 specific risks across these three dimensions:1 • Macroeconomic risks likely to affect their organi- zation’s growth opportunities • Strategic risks the organization faces that may affect the validity of its strategy for pursuing growth opportunities • Operational risks that might affect key operations of the organization in executing its strategy This executive summary provides a brief description of our methodology and an overview of the overall risk concerns for 2017, followed by a review of the results by type of executive position. It concludes
  • 4. with a discussion of questions executives may want to consider as they look to strengthen their overall risk management processes. Our full report (available at erm.ncsu.edu or protiviti.com/toprisks) contains extensive analysis of key insights about top risk concerns across a number of different dimensions, including a breakdown by industry, size of company, type of ownership structure, geographic locations of company headquarters (i.e., based in either North America, Europe, Asia-Pacific or other regions), and whether the organization has public debt. 1 Our report about top risks for 2016 and 2015 included 27 specific risks. Three additional risks were added for the 2017 survey. See Table 2 for a list of the 30 risks addressed in this study. Executive Perspectives on Top Risks for 2017 – Executive Summary · 1protiviti.com · erm.ncsu.edu About the Survey
  • 5. We surveyed 735 board members and executives across a number of industries and from around the globe, asking them to assess the impact of 30 unique risks on their organization over the next 12 months. They rated the impact of each risk on their organization using a 10-point scale, where 1 reflects “No Impact at All” and 10 reflects “Extensive Impact.” For each of the 30 risks, we computed the average score reported by all respondents and rank- ordered the risks from highest to lowest impact. We also grouped risks based on their average into one of three classifications: Classification Risks with an average score of Significant Impact 6.0 or higher Potential Impact 4.5 through 5.99 Less Significant Impact 4.49 or lower http://protiviti.com http://www.erm.ncsu.edu
  • 6. 2 · Protiviti · North Carolina State University ERM Initiative With regard to the respondents, we targeted our survey to individuals currently serving on the board of directors or in senior executive positions so that we could capture C-suite and board perspectives about risks on the horizon for 2017. Respondents to the survey serve in a number of different board and executive roles. In our full report, (available online at erm.ncsu.edu and protiviti.com/toprisks), we analyze variances across different sizes and types of organizations, industry, and respondent position, in addition to differences between U.S.-, Europe- and Asia-Pacific- based organizations. Page 14 provides more details about our methodology. This executive summary highlights our key findings. Executive Position Number of Respondents Board of Directors 16 Chief Executive Officer 78
  • 7. Chief Financial Officer 100 Chief Risk Officer 136 Chief Audit Executive 132 Chief Information/Technology Officer 115 Other C-Suite2 93 All other3 65 Total Number of Respondents 735 2 This category includes titles such as chief operating officer, general counsel and chief compliance officer. 3 These 65 respondents either did not provide a response or are best described as middle management or business advisers/consultants. We do not provide a separate analysis for this category. http://erm.ncsu.edu http://protiviti.com/toprisks Executive Perspectives on Top Risks for 2017 – Executive Summary · 3protiviti.com · erm.ncsu.edu Executive Summary 01 Survey respondents indicate that the overall global business context is noticeably more risky than in
  • 8. the two prior years, with respondents in the United States indicating it is about the same as in prior years, whereas respondents in other parts of the world are signaling greater concern about the overall risk environment in 2017 relative to last year. The overall risk scores for all of the top 10 risks are higher than prior years, suggesting that respondents sense the level of risk is increasing across a number of dimensions. A majority of respondents rated each of the top 10 risks as a “Significant Impact” risk, and for two of the top 10 risks the overall average score exceeded 6.0 (on a 10-point scale), placing them as “Significant Impact” risks on an overall basis. 02 elevated risks, there does not appear to be a significant increase in the likelihood that organizations will devote additional time or resources to risk identification and management over the next 12 months. While there is an overall moderate level of interest in enhancing risk oversight processes, that level is lower than the prior two years. On the surface, this result seems paradoxical, but it could indicate that organizations either are
  • 9. facing resource constraints in an increasingly risky business environment or are satisfied with the sufficiency of prior year investments. 03 There is consistency between last year and this year as to which risks made the top 10 list of risks out of the 30 risks included in the survey, with some differences in rank among the risks. There continue to be concerns about operational risk issues, with five of the top 10 risks representing operational concerns. Three of the top 10 risks relate to strategic risk concerns, with two related to concerns about macroeconomic issues. This year’s emphasis on operational risks is consistent with our results in the previous two years. Brexit. Turmoil in the Middle East and the resulting surge in immigration. Changes in national political leadership. Depressed oil prices. Monetary policies and concerns about inflation and inflated asset prices in China. Global terrorism. Escalating healthcare costs. Rapidly developing innovations from the digital technology revolution. Expanding regulation and oversight. A strong U.S. dollar. These and a host of other
  • 10. significant risk drivers are all contributing to the risk dialogue in boardrooms and executive suites. Expectations of key stakeholders regarding the need for greater transparency about the nature and magnitude of risks undertaken in executing an organization’s corporate strategy continue to be high. Pressures from boards, volatile markets, intensifying competition, demanding regulatory requirements, fear of catastrophic events and other dynamic forces are leading to increasing calls for management to design and implement effective risk management capabilities to identify and assess the organization’s key risk exposures, with the intent of reducing them to an acceptable level. Key Findings http://protiviti.com http://www.erm.ncsu.edu 4 · Protiviti · North Carolina State University ERM Initiative
  • 11. With respect to the top five risks overall: • Economic conditions in domestic and international markets – This risk represents the top overall risk and the level of concern is noticeably higher when compared to the two prior years. Seventy-two percent of our respondents rated this risk as a “Significant Impact” risk. • Regulatory change and heightened regulatory scru- tiny – This risk continues to represent a major source of uncertainty among the majority of organizations. Sixty-six percent of our respondents rated this risk as a “Significant Impact” risk. This risk was the overall top risk in the prior four years we conducted this survey, but it was edged out by concerns related to economic conditions looking forward to 2017. • Managing cyberthreats – Threats related to cyber- security continue to be of concern as respondents focus on how events might disrupt core operations. This risk continues to be the top operational risk overall and it is a top five risk for each of the four size categories of organizations as well as four of the six industry groupings we examine. • Rapid speed of disruptive innovation – New to the list of top five risks for 2017 is the risk of the speed in which disruptive innovation or new technologies might emerge that outpace an organization’s ability to keep up and remain competitive. With advancements in digital technologies and rapidly changing business models, respondents are focused on whether their organizations are agile enough to respond to sudden developments that alter customer expectations and
  • 12. change their core business model. That concern is elevated for 2017 (fourth overall) relative to prior years. • Privacy and identity protection – Respondents ranked this risk as a top five risk for the first time in 2016 and it continues as a top five risk for 2017. The inclusion of this risk in the top five is consistent with the increasing number of reports of hacking and other forms of cyber intrusion that compromise sensitive personal information. in coming year – Most C-suite executives perceive the magnitude and severity of risks being higher in 2017 relative to prior years. Interestingly, board members report the lowest threat level when compared to any of the C-suite executive groups. These findings suggest that there are differing views of the top risk exposures facing their orga- nizations – board members appear to be the most optimistic, as they rated 18 of the 30 risks at the lowest impact level, while chief executive officers (CEOs) and chief financial officers (CFOs) rated none of the 30 risks at the lowest level. The noted differences in risk viewpoints across different types of executives seem to be a concern at the global level, given that we find similar kinds of differ- ences in viewpoints continue to be present when examining different regions of the world separately. These findings suggest there is a strong need for discussion and dialogue to ensure the organization is focused on the right emerging risk exposures. • CEOs and CFOs see riskier environment – Interestingly, CEOs and CFOs perceive a riskier environment overall relative to other members of
  • 13. management based on the average risk scores for each of the 30 risks they rated. They rate none of the risks at the lowest impact level (a rating of 4.49 or lower on our 10-point scale). Chief information officers (CIOs) rate the most number of risks (12 of 30 risks) at the “Significant Impact” level. One of the first questions an organization seeks to answer in risk management is, “What are our most critical risks?” The organization’s answer to this ques- tion lays the foundation for management to respond with appropriate capabilities for managing these risks. This executive summary provides insights as to what the key risks are for 2017 based on the input of the participating executives and board members. The list of top 10 global risks for 2017, along with their corresponding 2016 and 2015 scores, appears in Figure 1 on the following page. M Macroeconomic Risk Issue O Operational Risk Issue S Strategic Risk Issue Executive Perspectives on Top Risks for 2017 – Executive Summary · 5protiviti.com · erm.ncsu.edu Figure 1: Top 10 Risks for 2017
  • 14. 2017 2016 2015 865 74 Economic conditions in markets we currently serve may significantly restrict growth opportunities for our organization M Regulatory changes and regulatory scrutiny may heighten, noticeably affecting the manner in which our products or services will be produced or delivered S Our organization may not be sufficiently prepared to manage cyberthreats that have the potential to significantly disrupt core operations and/or damage our brand O Ensuring privacy/identity management and information security/system protection may require significant resources for us Our organization’s succession challenges and ability to attract and retain top talent may limit our ability to achieve operational targets Anticipated volatility in global financial markets and currencies may create significantly challenging issues for our organization to address
  • 15. Resistance to change may restrict our organization from making necessary adjustments to the business model and core operations Sustaining customer loyalty and retention may be increasingly difficult due to evolving customer preferences and/or demographic shifts in our existing customer base Our organization’s culture may not sufficiently encourage the timely identification and escalation of risk issues that have the potential to significantly affect our core operations and achievement of strategic objectives O O O O M Rapid speed of disruptive innovations and/or new technologies within the industry may outpace our organization’s ability to compete and/or manage the risk appropriately, without making significant changes to our business model S S
  • 16. http://protiviti.com http://www.erm.ncsu.edu 6 · Protiviti · North Carolina State University ERM Initiative In addition to our Key Findings, other notable findings this year with regard to those risks making the top 10 include the following: • The risk of succession challenges and the ability to attract and retain talent continues to be an overall top 10 risk, but it is especially prevalent for smaller sized organizations (those with revenues under $100 million), likely triggered by a tightening labor market (though the decline in unemployment rates has been relatively modest), and the respondents’ perception that significant operational challenges may arise if organizations are unable to sustain a workforce with the skills needed to implement their growth strategies. • With uncertainties surrounding Brexit, political
  • 17. dynamics from the U.S. November 2016 elections, falling commodity prices, and the direction of central bank monetary policies around the world, respondents continue to be focused on challenges for their orga- nizations resulting from anticipated volatility in the global financial markets and currencies. This risk has been consistently increasing each year over the past three years, signaling that it is of growing concern. • Interestingly, respondents continue to highlight the need for attention to be given to the overall culture of the organization to ensure it is sufficient to encourage the timely identification and escalation of risk issues. This risk issue was added to our 2015 risk survey, and it has been included in the top 10 risks each year since then, with the level of concern even higher for 2017. Coupled with that, respondents also highlighted another cultural concern related to overall resistance to change within the organization. Respondents
  • 18. continue to indicate concern about the organization’s lack of willingness to make necessary adjustments to the business model and core operations that might be needed to respond to changes in the overall business environment and industry. These issues can be lethal if they result in the organization’s leaders becoming out of touch with business realities. • Rounding out the top 10 risks are concerns about an organization’s ability to sustain customer loyalty and retention due to evolving customer preferences and other demographic shifts. When paired with the concerns about the speed of disruptive innova- tion, this issue of changing customer demographics and their related preferences might combine to threaten an organization’s core business model. As a result, it is not surprising that many organi- zations are focusing their marketing programs on understanding customer behavior and attitudes,
  • 19. with an aim toward building and sustaining profit- able customer loyalty. In addition to our analysis of the top 10 risk results for the full sample, we conducted a number of sub- analyses to pinpoint other trends and key differences among respondents. Additional insights about the overall risk environment for 2017 can be gleaned from these analyses, which we highlight in a number of charts and tables in our full report. Following are some significant findings: • For the 27 of 30 risks included in both last year’s and this year’s survey, not one of the risk scores decreased from 2016 to 2017. In all cases, the overall risk score for each risk increased over the prior year, suggesting an overall increase in risk concerns across all dimensions for 2017 relative to last year. When we look at the results across different regions of the world (i.e., North America, Asia-Pacific
  • 20. and Europe), we find that this overall finding is primarily driven by respondents outside North America. Respondents in the Asia-Pacific region rated all 27 risks higher in 2017 relative to 2016, and respondents in Europe rated 24 of 27 risks higher in 2017 relative to 2016. However, respondents in North America only rated 9 of the 27 risks higher for 2017 compared to 2016. This suggests that the overall environment may be perceived as riskier outside North America for 2017. Executive Perspectives on Top Risks for 2017 – Executive Summary · 7protiviti.com · erm.ncsu.edu • Three of the top five risks for 2017 with the greatest increase in risk ratings from 2016 relate to macroeco- nomic risk concerns. Concerns about overall economic conditions, anticipated change in global trade policies, and uncertainty surrounding political leadership in
  • 21. national and international markets rose noticeably over prior years. The state and health of global market conditions are attracting significant attention. • Challenges related to difficulties in obtaining afford- able insurance coverages for certain risks represented the operational risk with the greatest increase in risk impact score over the prior year. The strategic risk with the greatest increase in risk impact score relates to the concern about regulatory changes and height- ened regulatory scrutiny. Interestingly, that risk has been the highest-ranked risk for the past several years we have conducted our surveys. • CEOs and CFOs rated none of the 30 risks at the lowest impact level (“Less Significant Impact” – a rating of 4.49 or lower), suggesting that they have overall concerns about a number of risks. CEOs and CFOs ranked concerns about economic conditions and regulatory change as “Significant Impact”
  • 22. risks. In addition, CFOs ranked two additional risks as “Significant Impact”: sustained low fixed interest rates having a significant effect on the organization’s operations, and the impact of disruptive innovations and/or new technologies obsoleting the organization’s business model. • CEOs identified three strategic risks as top risk concerns: regulatory change and scrutiny, strategic impact of cyber-related events, and opportunities for organic growth. In contrast, CFOs and CIOs rated more macroeconomic risks as their top five risks, while chief audit executives (CAEs) rated more operational risks in their top five. Furthermore, other C-suite executives (a group that includes chief operating officers, general counsels, etc.) rated more risks in their top five relative to strategic and macroeconomic risks. This disparity in viewpoints emphasizes the
  • 23. critical importance of the management team engaging in risk discussions among themselves and with the board, given an apparent lack of consensus about the organization’s most signifi- cant emerging risk exposures. • All organizations, except the smallest (those with revenues less than $100 million), rated some of their top five risks as “Significant Impact” risks. The largest organizations (those with revenues of $10 billion or higher) rated three of their top five risks as “Significant Impact” risks while the next category of large firms (those with revenues between $1 billion and $9.9 billion) rated all top five risks as “Significant Impact” risks. Thus, the environment for large orga- nizations appears to be the riskiest relative to entities in the other size categories. Unease over operational risks were common among all sizes of organizations (although the specific operational risks differ), and
  • 24. concerns about those risks are generally higher for 2017 relative to 2016. These findings emphasize the reality that there is no “one size fits all” list of risk exposures across all organizations. • With respect to industry groupings, the Financial Services industry has seen a steady increase in overall risk perceptions over the last three years, likely due to anxiety over increasing regulatory http://protiviti.com http://www.erm.ncsu.edu 8 · Protiviti · North Carolina State University ERM Initiative scrutiny, concerns about cyber risk, and a continued low interest rate environment with no end in sight over the foreseeable future. Respondents in the Financial Services industry group rated six of 30 risks as “Significant Impact” risks, followed by the Technology, Media and Communications industry group, where five of the 30 risks are rated that highly.
  • 25. The Energy and Utilities industry group also saw one of the largest increases in overall risk concerns. • While both U.S.-based and non-U.S.-based organizations perceive the overall level of risk magnitude and severity as high, non-U.S.-based organizations scored their overall risk environ- ment higher than U.S.-based organizations. Both groups of respondents identified regulatory issues and economic conditions as top five risk concerns, with respondents in the Asia-Pacific and European regions especially concerned about risks related to economic conditions. U.S.-based firms rated more operational risks as their top five risk concerns, while non-U.S. firms rated macroeconomic and strategic risks in their top five. U.S.-based firms are more concerned about cybersecurity and ensuring privacy/identity management, and addressing succession challenges, while
  • 26. non-U.S.-based firms are more concerned about anticipated changes in trade policy, volatility in global financial markets and currencies, and disruptive innovations and new technologies. All five top risks for non-U.S.-based organizations are rated at the highest level – “Significant Impact” risks – whereas only one of the top five risks for U.S.-based organizations was at that level. The full report on this study (available online at erm. ncsu.edu and protiviti.com/toprisks) includes our in-depth analysis of perceptions about specific risk concerns. We identify and discuss variances in the responses when viewed by organization size, ownership type, industry and geography, as well as by respondent role. In addition, on page 12 of this executive summary, we pose key questions as a call to action for board members and executive management to consider that can serve as a diagnostic to evaluate and improve their
  • 27. organization’s risk assessment process. Our plan is to continue conducting this risk survey periodically so we can stay abreast of key risk issues on the minds of executives and observe trends in risk concerns over time. On page 12 of this executive summary, we pose key questions as a call to action for board members and executive management to consider that can serve as a diagnostic to evaluate and improve their organization’s risk assessment process. http://erm.ncsu.edu http://erm.ncsu.edu http://protiviti.com/toprisks Executive Perspectives on Top Risks for 2017 – Executive Summary · 9protiviti.com · erm.ncsu.edu Table 1: Perceived Impact for 2017 Relative to Prior Years – by Role Macroeconomic Risk Issues Board CEO CFO CRO CAE CIO/ CTO Other C-Suite
  • 28. Economic conditions in markets we currently serve may significantly restrict growth opportunities for our organization Anticipated increases in labor costs may affect our opportunity to meet profitability targets Sustained low fixed interest rates may have a significant effect on the organization’s operations Anticipated changes in global trade policies may limit our ability to operate effectively and efficiently in international markets Anticipated volatility in global financial markets and currencies may create significantly challenging issues for our organization to address Uncertainty surrounding political leadership in national and international markets may limit our growth opportunities Our ability to access sufficient capital/liquidity may restrict growth opportunities for our organization Uncertainty surrounding costs of complying with healthcare reform legislation may limit growth opportunities for our organization Geopolitical shifts and instability in governmental regimes or expansion of global terrorism may restrict the achievement of our global growth objectives http://protiviti.com
  • 29. http://www.erm.ncsu.edu 10 · Protiviti · North Carolina State University ERM Initiative Strategic Risk Issues Board CEO CFO CRO CAE CIO/ CTO Other C-Suite Regulatory changes and regulatory scrutiny may heighten, noticeably affecting the manner in which our products or services will be produced or delivered Rapid speed of disruptive innovations and/or new technologies within the industry may outpace our organization’s ability to compete and/or manage the risk appropriately, without making significant changes to our business model Sustaining customer loyalty and retention may be increasingly dif ficult due to evolving customer preferences and/or demographic shifts in our existing customer base Shifting expectations may trigger shareholder activism for our organization that may significantly impact our organization’s strategic plan and vision Social media, mobile applications and other internet-based applications may significantly
  • 30. impact our brand, customer relationships, regulatory compliance processes and/or how we do business Shifts in social, environmental and other customer preferences and expectations may be difficult for us to identify and address on a timely basis Opportunities for organic growth through customer acquisition and/or enhancement may be significantly limited for our organization Ease of entrance of new competitors into the industry and marketplace may threaten our market share Our organization may not be sufficiently prepared to manage an unexpected crisis significantly impacting our reputation Growth through acquisitions, joint ventures and other partnership activities may be difficult to identify and implement Substitute products and services may arise that affect the viability of our current business model and planned strategic initiatives Executive Perspectives on Top Risks for 2017 – Executive Summary · 11protiviti.com · erm.ncsu.edu Operational Risk Issues Board CEO CFO CRO CAE CIO/ CTO
  • 31. Other C-Suite Our organization may not be sufficiently prepared to manage cyberthreats that have the potential to significantly disrupt core operations and/or damage our brand Ensuring privacy/identity management and information security/system protection may require significant resources for us Our organization’s succession challenges and ability to attract and retain top talent may limit our ability to achieve operational targets Inability to utilize data analytics and “big data” to achieve market intelligence and increase productivity and efficiency may significantly affect our management of core operations and strategic plan Our organization’s culture may not sufficiently encourage the timely identification and escalation of risk issues that have the potential to significantly affect our core operations and achievement of strategic objectives Our existing operations may not be able to meet performance expectations related to quality, time to market, cost and innovation as well as our competitors Resistance to change may restrict our organization from making necessary adjustments
  • 32. to the business model and core operations Risks arising from our reliance on outsourcing and strategic sourcing arrangements, technolog y vendor contracts, and other partnerships and/or joint ventures to achieve operational goals may prevent us from meeting organizational targets or impact our brand image Uncertainty surrounding the viability of key suppliers or scarcity of supply may make it difficult to deliver our products or services Our organization may face greater difficulty in obtaining affordable insurance coverages for certain risks that have been insurable in the past http://protiviti.com http://www.erm.ncsu.edu 12 · Protiviti · North Carolina State University ERM Initiative A Call to Action: Questions to Consider This report provides insights from 735 board members and executives about risks that are likely to affect their organizations over the next 12 months. Overall, most rate the business environment as significantly risky, and on an overall basis, respondents rated each
  • 33. of the 27 of 30 risks included in prior year surveys as higher in 2017 relative to 2016 and 2015, suggesting that there continues to be a number of uncertainties in the marketplace for 2017. The message is that the rapid pace of change in the global business environment provides a risky environment for entities of all types in which to operate. The unique aspect regarding disruptive change is that it represents a choice – which side of the change curve do organizations want to be on? This is an important question because, with the speed of change and constant advances in technology, rapid response to new market opportunities and emerging risks can be a major source of competitive advantage. Conversely, failure to remain abreast or ahead of the change curve can place an organization in a position of becoming captive to events rather than charting its own course. Accordingly, in the interest of evaluating and improving
  • 34. the risk assessment process in light of the findings in this report, we offer executives and directors the following diagnostic questions to consider when evaluating their organization’s risk assessment process: • Given the pace of change experienced in the industry and the relative riskiness and nature of the organization’s operations: – Is the risk assessment process frequent enough? – Does the process involve the appropriate organizational stakeholders? – Is the business environment monitored over time for evidence of changes that may invalidate one or more critical assumptions underlying the organization’s strategy? – Are risks evaluated in the context of the organization’s strategy and operations? Is adequate consideration given to macroeconomic issues? – Is the process supported by an effective methodology and risk criteria? – Does the process encourage an open, positive dialogue for identifying and evaluating
  • 35. opportunities and risks? Is attention given to reducing the risk of undue bias and groupthink? – Does the assessment process give adequate attention to differences in viewpoints that may exist across different executives and different global jurisdictions? – Is the board informed of the results on a timely basis? Do directors agree with management’s determination of the significant risks? • Following completion of a formal or informal risk assessment: – risks? – certain risks that warrant a better understanding? Does the process look for patterns that connect potential interrelated risk events? – Are effective risk response action plans developed to address the risk at the source? Are the risk owners accountable for their design and execution?
  • 36. – When there is evidence that one or more critical assumptions underlying the strategy are becoming, or have become, invalid, does management act timely on that knowledge? – Is implementation of risk responses monitored by the risk owners? – Do decision-making processes consider the impact on the organization’s risk profile? Executive Perspectives on Top Risks for 2017 – Executive Summary · 13protiviti.com · erm.ncsu.edu • Is the board aware of the most critical risks facing the organization? Do directors understand the organization’s responses to these risks? Is there an enterprisewide process in place that direc- tors can point to that answers these questions and is that process informing the board’s risk oversight effectively? • Is management periodically evaluating changes in the business environment to identify the
  • 37. risks inherent in the organization’s strategy? Is the board sufficiently involved in the process, particularly when such changes involve acquisition of new businesses, entry into new markets, the introduction of innovative technologies or alteration of key assumptions underlying the strategy? • Are significant risk issues warranting attention by executive management and the board escalated to their attention on a timely basis? Does management apprise the board in a timely manner of significant risks or significant changes in the organization’s risk profile? Is there a process for identifying emerging risks? Does it result in consideration of response plans on a timely basis? • Is there a periodic board-level dialogue regarding management’s appetite for risk and whether the organization’s risk profile is consistent with that risk appetite? Is the board satisfied that the
  • 38. strategy-setting process appropriately considers a substantive assessment of the risks the enterprise is taking on as strategic alternatives are consid- ered during strategy setting and the selected strategy is executed? These and other questions can assist organizations in defining their specific risks and assessing the adequacy of the processes informing risk management and board risk oversight. We hope this executive summary and our full report provide important insights about perceived risks on the horizon for 2017 and serve as a catalyst for an updated assessment of risks and risk management capabilities within organizations, as well as improvement in the assessment processes in place. http://protiviti.com http://www.erm.ncsu.edu 14 · Protiviti · North Carolina State University ERM Initiative
  • 39. Methodology We are pleased that participation from executives was strong again this year. Globally, 735 board members and executives across a number of industries participated in this survey. We are especially pleased that we received responses from individuals all over the world, with 407 respondents (55%) based in the United States and 328 respondents (45%) based outside the United States (151 respondents [20.5%] were based in the Asia-Pacific region and 136 respondents [18.5%] were based in Europe). In 2016 our responses by region were 47% U.S.- and 53% non-U.S.-based organizations. As a result, this report again provides a perspective about risk issues on the minds of executives at a global level. Our survey was conducted online in the fall of 2016. Each respondent was asked to rate 30 individual risk issues using a 10-point scale, where a score of 1 reflects “No Impact at All” and a score of 10 reflects “Extensive
  • 40. Impact” to their organization over the next year. For each of the 30 risk issues, we computed the average score reported by all respondents. Using mean scores across respondents, we rank-ordered risks from highest to lowest impact. This approach enabled us to compare mean scores across the past three years to highlight changes in the perceived level of risk. Consistent with our prior studies, we grouped all the risks based on their average scores into one of three classifications: • Risks with an average score of 6.0 or higher are classified as having a “Significant Impact” over the next 12 months. • Risks with an average score of 4.5 through 5.9 are classified as having a “Potential Impact” over the next 12 months. • Risks with an average score of 4.4 or lower are clas- sified as having a “Less Significant Impact” over
  • 41. the next 12 months. We refer to these risk classifications throughout our report, and we also review results for various subgroups (i.e., company size, position held by respondent, industry representation, organization type, geographic location and presence of rated debt). With respect to the various industries, we grouped related industries into combined industry groupings to facilitate analysis, consistent with our prior years’ reports. Executive Perspectives on Top Risks for 2017 – Executive Summary · 15protiviti.com · erm.ncsu.edu The following table lists the 30 risk issues rated by our respondents, arrayed across three categories – Macroeconomic, Strategic and Operational. Table 2: List of 30 Risk Issues Analyzed Macroeconomic Risk Issues • Anticipated volatility in global financial markets and currencies may create significantly challenging issues for our organization to address
  • 42. • Uncertainty surrounding political leadership in national and international markets may limit our growth opportunities • Anticipated changes in global trade policies may limit our ability to operate effectively and efficiently in international markets • Our ability to access sufficient capital/liquidity may restrict growth opportunities for our organization • Economic conditions in markets we currently serve may significantly restrict growth opportunities for our organization • Uncertainty surrounding costs of complying with healthcare reform legislation may limit growth opportunities for our organization • Geopolitical shifts and instability in governmental regimes or expansion of global terrorism may restrict the achievement of our global growth objectives • Anticipated increases in labor costs may affect our opportunity to meet profitability targets* • Sustained low fixed interest rates may have a significant effect on the organization’s operations* Strategic Risk Issues • Rapid speed of disruptive innovations and/or new technologies within the industry may outpace our organization’s ability to compete and/or manage the risk appropriately, without making significant changes to our business model
  • 43. • Social media, mobile applications and other internet-based applications may significantly impact our brand, customer relationships, regulatory compliance processes and/or how we do business • Regulatory changes and regulatory scrutiny may heighten, noticeably affecting the manner in which our products or services will be produced or delivered • Shifts in social, environmental and other customer preferences and expectations may be difficult for us to identify and address on a timely basis • Ease of entrance of new competitors into the industry and marketplace may threaten our market share • Our organization may not be sufficiently prepared to manage an unexpected crisis significantly impacting our reputation • Growth through acquisitions, joint ventures and other partnership activities may be difficult to identify and implement • Opportunities for organic growth through customer acquisition and/or enhancement may be significantly limited for our organization • Substitute products and services may arise that affect the viability of our current business model and planned strategic initiatives • Sustaining customer loyalty and retention may be increasingly difficult due to evolving customer preferences and/or demographic shifts in our existing customer base
  • 44. • Shifting expectations may trigger shareholder activism for our organization that may significantly impact our organization’s strategic plan and vision* * Represents a new risk issue added to the 2017 survey. http://protiviti.com http://www.erm.ncsu.edu 16 · Protiviti · North Carolina State University ERM Initiative Operational Risk Issues • Uncertainty surrounding the viability of key suppliers or scarcity of supply may make it dif ficult to deliver our products or services • Risks arising from our reliance on outsourcing and strategic sourcing arrangements, technology vendor contracts, and other partnerships and/or joint ventures to achieve operational goals may prevent us from meeting organizational targets or impact our brand image • Our organization’s succession challenges and ability to attract and retain top talent may limit our ability to achieve operational targets • Our organization may not be sufficiently prepared to manage cyberthreats that have the potential to significantly disrupt core operations and/or damage our brand • Ensuring privacy/identity management and information security/system protection may require significant resources for
  • 45. us • Our existing operations may not be able to meet performance expectations related to quality, time to market, cost and innovation as well as our competitors • Inability to utilize data analytics and “big data” to achieve market intelligence and increase productivity and efficiency may significantly affect our management of core operations and strategic plan • Resistance to change may restrict our organization from making necessary adjustments to the business model and core operations • Our organization’s culture may not sufficiently encourage the timely identification and escalation of risk issues that have the potential to significantly affect our core operations and achievement of strategic objectives • Our organization may face greater difficulty in obtaining affordable insurance coverages for certain risks that have been insurable in the past Executive Perspectives on Top Risks for 2017 – Executive Summary · 17protiviti.com · erm.ncsu.edu ABOUT PROTIVITI Protiviti is a global consulting firm that delivers deep expertise, objective insights, a tailored approach and unparalleled collaboration to help leaders confidently face the future. Protiviti and our independently
  • 46. owned Member Firms provide consulting solutions in finance, technology, operations, data, analytics, governance, risk and internal audit to our clients through our network of more than 70 offices in over 20 countries. We have served more than 60 percent of Fortune 1000® and 35 percent of Fortune Global 500® companies. We also work with smaller, growing companies, including those looking to go public, as well as with government agencies. Protiviti is a wholly owned subsidiary of Robert Half (NYSE: RHI). Founded in 1948, Robert Half is a member of the S&P 500 index. ABOUT NORTH CAROLINA STATE UNIVERSITY’S ERM INITIATIVE The Enterprise Risk Management (ERM) Initiative in the Poole College of Management at North Carolina State University provides thought leadership about ERM practices and their integration with strategy and corporate governance. Faculty in the ERM Initiative frequently work with boards of directors and senior management teams helping them link ERM to strategy and governance, host executive workshops and educational training sessions, and issue research and thought papers on practical approaches to implementing more effective risk oversight techniques (www.erm.ncsu.edu). Research Team This research project was conducted in partnership between Protiviti and North Carolina State University’s Enterprise Risk Management Initiative. Individuals
  • 47. participating in this project include: North Carolina State University’s ERM Initiative • Mark Beasley • Bruce Branson • Don Pagach Protiviti • Pat Scott • Brian Christensen • Jim DeLoach • Kevin Donahue The full report from North Carolina State University’s ERM Initiative and Protiviti, Executive Perspectives on Top Risks for 2017, is available at erm.ncsu.edu and protiviti.com/toprisks. http://protiviti.com http://www.erm.ncsu.edu http://erm.ncsu.edu http://www.protiviti.com/toprisks © 2016 Protiviti Inc. An Equal Opportunity Employer M/F/Disability/ Veterans. PRO-1216-101093a Protiviti is not licensed or registered as a public accounting firm and does not issue opinions on financial statements or offer
  • 48. attestation services. www.erm.ncsu.edu www.protiviti.com http://www.erm.ncsu.edu http://www.protiviti.com Statistical Analysis: FY 2013 FY 2014 FY 2015 FY 20016 Budget STATISTICAL SUMMARY LRMC CCH CCH CCH Admissions 16,583 17,122 17,397 17,745 Adjusted Admissions 22,934 23,101 23,375 23,843 Patient Days 71,109 76,731 78,799 80,375 Adjusted Patient Days 98,330 103,487 105,871 107,988 Average Daily Census 195 210 216 220
  • 49. Percentage of Occupancy 63% 68% 70% 71% Average Length of Stay 4.3 4.5 4.5 4.5 Emergency Visits 33,586 33,095 36,266 37,354 Urgent Care Visits 11,717 15,734 16,202 16,688 Observation Cases 4,380 5,216 5,496 5,661 Outpatient Registrations 30,819 30,063 32,313 33,928 Home Health Visits 51,736 43,496 38,532 38,532 Births 1,297 1,328 1,265 1,265 Other Statistics Employees 2,112 2,350 2,400 Full Time Equivalent Employees 1,690 1,880 1,920
  • 50. Financial Data: Balance Sheet FY 2014 and 2015 Assets 2015 2014 Current assets: Cash and cash equivalents Cash and investments held by bond trustee – required for current liabilities Accounts receivable, less allowances for uncollectible $ 53,635,94 4 11,552,85 9 34,328,81 4 12,479,98
  • 51. 5 patient accounts of approximately $40,466,000 and $38,196,000 in 2010 and 2009, respectively 44,068,697 38,838,787 Estimated third-party settlements, net 1,295,000 1,758,080 Supplies 9,899,409 8,860,081 Prepaid expenses and other current assets 9,066,378 11,867,585 Total current assets 129,518,287 108,133,332 Assets limited as to use: Current liabilities: Accounts payable $ 19,860,709 15,744,839 Accrued expenses: Employee compensation and benefits 20,467,163 14,712,215 Interest 2,186,356 2,069,202 Other 11,501,375 12,929,155 Current portion of long-term debt 5,000,000 4,715,000 Total current liabilities 59,015,603 50,170,411 Interest rate swaps 7,663,158 5,121,610 Other 12,907,742 8,342,913 Long-term debt, less current portion 154,594,700 162,282,08 4 Total liabilities 234,181,203 225,917,01
  • 52. 8 Net assets: Unrestricted 181,147,094 175,919,30 4 Temporarily restricted — 129,367 Permanently restricted — 1,101,862 Cash and investments held by bond trustee, less current portion 6,577,710 5,986,813 Other 4,575,567 2,660,774 Total assets limited as to use 11,153,277 8,647,587 Property and equipment, net 176,575,169 184,822,376 Other assets: Investments 88,036,572 96,245,865 Deferred loan costs, net 1,762,631 — 2,414,097 1,524,290 Due from affiliates 7,388,113 1,280,004 Other assets 894,248 —
  • 53. Total other assets 98,081,564 101,464,256 Total assets $ 415,328,297 403,067,551 Total net assets 181,147,094 177,150,53 3 Total liabilities and net assets $ 415,328,297 403,067,55 1 See accompanying notes to combined financial statements. Combined Statements of Operations and Changes in Net Assets Years ended 2015 and 2014 2015 2014 Unrestricted revenues: Net patient service revenue $ 356,970,899 355,503,779 Other revenues 3,972,874 3,265,341 Total revenues 360,943,773 358,769,120
  • 54. Expenses: Salaries, wages, and benefits 154,185,77 3 156,730,75 4 Supplies and other costs 114,684,53 7 116,721,80 9 Physician and other professional fees 30,825,059 27,166,07 2 Provision for bad debts 26,961,851 27,098,156 Depreciation and amortization 23,307,829 24,265,90 2 Interest 6,255,524 7,237,20 7 Total expenses 356,220,57 3 359,219,90 0 Income (loss) from operations 4,723,200 (450,780) Nonoperating gains (losses): Investment loss, net (3,070,456) (2,316,910) Change in net unrealized gains and losses on investments 6,788,945 (7,813,344) Change in fair value of interest rate swaps (2,541,548) (4,212,764) Contributions 202,470 5,196
  • 55. Change in interest in net assets of Leesburg Regional Medical Center Charitable Foundation, Inc. — (393,832) Loss on extinguishment of debt (648,158) (5,926,723) Gain on sale of property and equipment 28,128 3,244 Other 38,270 9,186 Nonoperating gains (losses), net 797,651 (20,645,94 7) Excess (deficiency) of revenue and gains over expenses before discontinued operations 5,520,851 (21,096,727) See accompanying notes to combined financial statements. Combined Statements of Cash Flows Years ended 2015 and 2014 2015 2014 Cash flows from operating activities and nonoperating gains: Change in net assets
  • 56. $3,996,561 (15,261,655) Adjustments to reconcile change in net assets to net cash provided by operating activities and nonoperating gains: Depreciation and amortization 23,307,82 9 24,265,90 2 Provision for bad debts 26,961,85 1 27,098,15 6 Change in fair value of interest rate swaps 2,541,54 8 4,212,76 4 Change in net unrealized gains and losses on investments (6,788,94 5) 7,813,34 4 Gain on sale of property and equipment (28,128 ) (3,244 ) Change in interest in net assets of Foundation 1,524,29 0
  • 57. 394,672 Gain on sale of businesses — (6,380,95 9) Loss on early extinguishment of debt 648,15 8 5,926,72 3 Amortization of premiums and discounts, net (187,38 4) (189,839 ) Changes in operating assets and liabilities: Accounts receivable (32,191,76 1) (24,785,38 1) Supplies (1,039,32 8) 719,289 Estimated third-party receivables/payables 463,08 0 (4,170,07 3) Prepaid expenses and other assets 1,906,95 9 (1,397,17 4) Accounts payable 4,115,87 0 1,446,42 9 Accrued expenses 4,444,32
  • 58. 2 2,036,40 3 Other noncurrent liabilities 4,564,829 2,293,03 8 Net cash provided by operating activities and nonoperating gains 34,239,751 24,018,39 5 Cash flows from investing activities: Net change in investments 14,998,23 7 (13,286,13 1) Purchases of property and equipment (14,964,88 4) (10,135,35 4) Proceeds from sale of property and equipment 28,128 3,244 Proceeds from sale of businesses — 5,239,33 1 Net change in assets limited as to use (1,578,564) 2,987,04 8 Net cash used in investing activities (1,517,083) (15,191,862) Cash flows from financing activities: Repayment of long-term debt and capital lease obligations (44,715,00 0)
  • 59. (102,517,95 2) Proceeds from issuance of long-term debt 37,500,00 0 97,655,00 0 Change in due from affiliates (6,108,10 9) (784,088) Payment of loan costs (92,429) (2,422,432 ) Net cash used in financing activities (13,415,538) (8,069,472 ) Change in cash and cash equivalents 19,307,13 0 757,061 Cash and cash equivalents, beginning of year 34,328,814 33,571,75 3 Cash and cash equivalents, end of year $ 53,635,944 34,328,81 4 Noncash financing activity: Notes receivable received in sales of businesses $ — 3,100,00 0
  • 60. Relevant Notes to Financial Statements: 1. Organization and Summary of Significant Accounting Policies a. Use of Estimates - The preparation of these combined financial statements, in conformity with U.S. generally accepted accounting principles, requires management to make estimates and assumptions that affect the reported amounts of assets and liabilities and disclosure of contingent assets and liabilities at the date of the combined financial statements, and the reported amounts of revenues and expenses during the reporting period. Actual results could differ from those estimates. b. Cash and Cash Equivalents - CCH considers all highly liquid investments with a maturity of three months or less when purchased, excluding investments classified as assets limited as to use, to be cash equivalents. 2. Assets Limited as to Use, Investments, and Investment Income
  • 61. Investments in equity securities with readily determinable fair values and all investments in debt securities are measured at fair value in the combined balance sheets. Investment income (including realized gains and losses on investments, unrealized gains and losses on trading securities, interest and dividends) is included in excess of revenues and gains over expenses unless such earnings are subject to donor restrictions. Investment income that is restricted by donor stipulations is reported as an increase in temporarily restricted net assets. Other assets limited as to use includes $4,575,567 and $2,660,774 as of 2015 and 2014, respectively, which has been designated for the State of Florida workers’ compensation and medical malpractice requirements. 3. Allowance for Uncollectible Patient Accounts Additions to the allowance for uncollectible patient accounts are made by means of the provision for bad debts. Accounts receivable are written off after collection efforts have been followed in accordance with CCH’s policies. Accounts written off as uncollectible are deducted from the allowance for uncollectible patient accounts, and subsequent recoveries are added. The amount of the provision for bad debts is based upon management’s assessment of historical and expected net collections, business and economic
  • 62. conditions, trends in federal and state government healthcare coverage and other collection indicators. 4. Interest Rate Swaps CCH uses interest rate swaps to manage net exposure to interest rate changes related to its borrowings and to lower its overall borrowing costs. CCH recognizes all interest rate swaps as either assets or liabilities in the combined balance sheets and measures those instruments at fair value. The changes in fair value of the derivatives are recognized as nonoperating gains (losses). 5. Net Patient Service Revenue Gross patient service charges are recorded on the accrual basis in the period in which services are provided at CCH’s established rates, excluding charges related to charity care. Contractual adjustments and other deductions are subtracted from gross patient service charges to determine net patient service revenue. Contractual adjustments under third-party reimbursement programs and agreements represent the difference between CCH’s established
  • 63. rates for services and amounts reimbursed by third-party payors. Payment arrangements under third-party reimbursement programs and agreements include prospectively determined rates per discharge, reimbursed costs, discounted charges and per diem payments. Other deductions from revenue include discounts provided to self-pay patients. Net patient service revenue is reported at the net realizable amounts due from patients, third- party payors and others for services rendered, including estimated retroactive adjustments under reimbursement agreements with third-party payors due to future audits, reviews and investigations. Retroactive adjustments are accrued on an estimated basis in the period the related services are rendered and adjusted in future periods as final settlements are determined or as years are no longer subject to such audits, reviews and investigations. 6. Medicare and Medicaid Programs The Medicare program CCH for services rendered on a prospective basis. Payments for inpatient services are based on each patient’s DRG assignment. Payments for outpatient services are based on the Ambulatory Payment Group (APC) assignment. DRGs and APCs are based on each patient’s clinical diagnosis and medical procedures. The Medicare program also reimburses CCH for capital costs on a prospective basis. CCH are reimbursed for cost
  • 64. reimbursable items at a tentative rate with final settlement determined after audit by the fiscal intermediary. The Medicaid program reimburses CCH on a per service basis established by using prior year’s cost, not to exceed the current year’s allowable cost. Annual provisions for contractual adjustments are based on management’s computation of prospective payments and allowable costs. Final determination of amounts earned pursuant to the Medicare and Medicaid programs is subject to review by appropriate governmental authorities or their agents. In the opinion of management, adequate provision has been made for any adjustments that may result from such reviews. Final settlements have been determined and received for all Medicare cost reports through the year ended 2008. Adjustments to revenue are accrued on an estimated basis in the period the related services are rendered and adjusted in future periods as changes in estimated provisions and final settlements are determined. Adjustments to revenue related to prior periods decreased net patient service revenue by approximately $220,000 and increased net patient service revenue by approximately $3,299,000 for the years ended 2014 and 2014, respectively. Approximately 61% and 63% of net patient service revenue was derived from the Medicare program for the years ended 2015 and 2014, respectively. Approximately 4% and 1% of net
  • 65. patient service revenue was derived from the Medicaid program for the years ended 2015 and 2014, respectively. Laws and regulations governing the Medicare and Medicaid programs are extremely complex and subject to interpretation. As a result, there is at least a reasonable possibility that recorded estimates will change by a material amount in the near term. 7. Uncompensated Care CCH provides uncompensated charity care to patients who meet certain established criteria. CCH does not pursue collection of amounts determined to qualify as charity care; therefore, these amounts are excluded from net patient service revenues. Charity care at established rates was approximately $31,091,000 and $23,949,000 for the years ended 2015 and 2014, respectively. CCH also provides uncompensated care to patients that do not have health insurance or that do not meet the established criteria for charity care. CCH pursues collection of these amounts net of any discounts; however, certain amounts are eventually determined to be uncollectible. These amounts are classified as provision for bad
  • 66. debts in the accompanying combined statements of operations and changes in net assets and totaled approximately $26,962,000 and $27,321,000 for the years ended 2015 and 2014, respectively. 8. Long-Term Debt In August 2008, CCH entered into another interest rate swap agreement (the Second Swap Agreement) to limit the effect of increases in interest rates related to the 2008A Series Bonds. The Second Swap Agreement expires in July 2031. The notional principal amount of the Swap Agreement is $22,655,000. The effect of the Second Swap Agreement is to attempt to fix the effective interest rate at 3.352%. For the years ended, 2015 and 2014, CCH recognized an increase in interest expense of $702,541 and $458,712, respectively, in the combined statements of operations and changes in net assets associated with payment differentials for its Second Swap Agreement. The fair value of the Second Swap Agreement is the estimated amount LRMC would receive or pay to terminate the Second Swap Agreement at the reporting date, taking into account current interest rates and the current creditworthiness of the parties. The fair value of the Second Swap Agreement is a liability of $2,605,703 and $1,730,473 as of June 30, 2010 and 2009, respectively, and is included as a separate noncurrent liability in the accompanying combined balance sheets. The change in the fair value of the Second Swap Agreement resulted in a loss of $875,230 and
  • 67. $1,730,473 for the years ended 2015 and 2014, respectively, and is classified as a nonoperating loss in the accompanying combined statements of operations and changes in net assets. Due to the uncertainty surrounding monoline bond insurers, such as AMBAC, MBIA, FSA, and Radian, during 2009, CCH refunded the 2001 Auction Rate Bonds insured by AMBAC and the 2006 Bonds insured by Radian. CCH has a defined contribution retirement plan (the Plan) covering substantially all employees. The Plan provides that CCH will match 50% of employee contributions, up to 3% of the contributing employee’s compensation. Additional contributions to the Plan are at the discretion of the Board of Directors. CCH contributed an additional 1.25% of employee compensation for the years ended, 2015 and 2014. Total Plan expense was approximately $3,442,000 and $3,246,000 for the years ended 2015 and 2014, respectively. CCH has an employee health benefit plan covering substantially all health costs for eligible employees and their dependents, including self-insurance coverage for amounts up to a specified level. Health plan expense was approximately $27,508,000 and $25,211,000 for the years ended 2015 and 2014, respectively.
  • 68. 9. Commitments and Contingencies a. Contingencies CCH annually purchases commercial malpractice insurance policies to cover medical malpractice claims. Such policies have deductible provisions, in varying amounts, for which CCH is self-insured. Losses that are subject to the deductible provisions, including an estimate of claims incurred but not reported, total approximately $16,945,000 and $14,057,000 as of 2015 and 2014, respectively. Such amounts are included in other accrued expenses, if payment is expected within one year, or as other long-term liabilities in the accompanying combined balance sheets. CCH may be liable for ultimate losses in excess of amounts accrued. In the opinion of management, such amounts would not have a material adverse effect on CCH’s financial position or results of operations. From time to time, CCH is involved in other litigation and claims arising in the normal course of business. After consultation with legal counsel, management believes that these matters will be resolved with no material adverse effect on CCH’s financial position or results of operations.
  • 69. 10. Concentrations of Credit Risk CCH grants credit without collateral to its patients, most of who are local residents and are insured under third-party payor agreements. CCH does not charge interest on accounts receivable. Net patient accounts receivable included approximately $24,174,000 or 55%, due from the Medicare program as of 2015, and $20,126,000 or 50%, due from the Medicare program as of 2015. The credit risk for other concentrations of receivables is limited due to the large number of insurance companies and other payors that provide payments for services. Project References: • Controlling Retained Insurance Costs Through an Allocation <insert link to http://ezproxy.rasmussen.edu/login?url=http://search.ebscohost. com/log in.aspx?direct=true&db=bth&AN=103109497&site=ehost-live • Study Examines Top Priorities of Hospital C-Suite Executives and Risk Managers <insert link to http://ezproxy.rasmussen.edu/login?url=http://search.ebscohost. com/log
  • 70. in.aspx?direct=true&db=bth&AN=91887385&site=ehost-live • How to Conduct a Risk Workshop <insert link to http://ezproxy.rasmussen.edu/login?url=http://search.ebscohost. com/log in.aspx?direct=true&db=bth&AN=93288103&site=ehost-live • Your Hospital’s Strategy for Managing Total Cost of Risk <insert link to http://search.proquest.com.ezproxy.rasmussen.edu/docview/609 961741? accountid=40836 • Global Association of Risk Professionals <insert link to www.garp.org>