ERM Process and Framework Overview

Recording of this session via any media type is strictly prohibited.
ERM Definition
RIMS
A strategic business discipline that supports the achievement
of an organization’s objectives by addressing the full spectrum
of its risks and managing the combined impact of those risks
as an interrelated risk portfolio.

Traditional Risk Management Department

ERM Governance Model

Classifications of Risk

Risk Quadrants

RIMS Risk Maturity Model
Uses 5 maturity levels based on CMM applied
to 7 attributes:
• Adoption of ERM-based approach
• ERM process management
• Risk appetite management
• Root cause discipline
• Uncovering risks
• Performance management
• Business resiliency and sustainability

Enterprise Risk Management
Framework and Process

Framework and Process

ISO 31000 Framework and Process
Source: ISO
31000:2009

COSO ERM
Source: COSO – Enterprise Risk Management – Integrated Framework

SWOT Analysis Table

Key Performance Indicators
A key performance indicator (KPI) measures progress
toward an organization’s goals, provides an
attainable standard for a specific activity, and gives
the focus or direction the activity is to take.

Purpose of Key Risk Indicators (KRIs)
Effective KRIs provide objective, quantifiable
information about emerging risks and trends in existing
risks that can affect an organization’s success. A KRI can
reveal an upward trend in the level of a risk that, if it
continues, will exceed the designated risk threshold for
that risk.

Internal Control and Risk Management
Internal control – a system or process that an
organization uses to achieve its operational goals,
internal and external financial reporting goals, or
legal and regulatory compliance goals.

COSO Internal Control Framework
Source: COSO Internal Control – Integrated Framework

Three Lines of Defense Model
Source: FERMA/ECIIA

Risk Treatment Techniques

Risk Modeling

Influence Diagrams and Probabilities
GEV Industries hires inexperienced and experienced
workers to operate simple and complex machines.
Accident rates vary by worker experience and
complexity of machine.
GEV would like to estimate accident rates if it (a)
assigns workers randomly to machines or (b) assigns
workers to machines based on experience.

Influence Diagram
Worker
Experience
Accident
Rate
? Machine
Complexity
Cost of
Risk
Worker assignment to machines

Simple
machines
Complex
machines
Inexperienced
workers
Experienced
workers
40 160 60 140
Machine and Worker Data
Inexp. worker (30%) Exp. Worker (70%)
Simple machine (20%) 6% 14%
Complex machine (80%) 24% 56%
Random Worker Assignments Probabilities
Accident Conditional Probability
Inexperienced Experienced
Simple Machine 5% 0%
Complex Machine 40% 10%

Inexp. worker Exp. worker
Simple machine .3% 0.0%
Complex machine 9.6% 5.6%
Accident Probability
Random Worker Assignments Probabilities
Total accident probability = 15.5%

Inexp. worker Exp. worker
Simple machine 1% 0%
Complex machine 4% 7%
Accident Probability
Worker Assignments by Experience
Total accident probability = 12%

Twenty percent of PDQ Transport’s trucks have advanced
safety equipment and 80% do not. Thirty of PDQ’s drivers are
inexperienced and 90 are experienced. Assuming drivers are
assigned randomly to trucks, what is the probability that an
inexperienced driver is assigned to a truck without advanced
safety equipment?
A: 18%
B: 20%
C: 24%
D: 60%

Value at Risk (VaR)

A $500,000, 2 percent VaR means losses are
expected to be
A: $10,000.
B: less than $500,000 2 percent of the time.
C: $490,000.
D: greater than $500,000 2 percent of the time.

Market Value Surplus (MVS)

Economic Capital

Market Value Surplus Example
Autumn Assurance Group has assets at fair value of $100
million. The present value of Autumn’s liabilities is $85
million. The market value margin is $5 million. Using
probability models, Autumn determines that its VaR is $8
million because it expects to incur an $8 million or greater
loss of capital at a .5 percent probability over a one-year
period.
1. What is Autumn’s MVS?
2. What is Autumn’s economic capital?
3. Does Autumn have excess capital or a deficiency in
capital?

Questions?

Evolution of Risk Management
Insurance
Management
Risk
Management
Enterprise Risk
Management

ERM Value Proposition
• Identify key risks
• Employ risk-based decision making
• Improve internal control
• Improve risk governance
• Comply with legal and regulatory
requirements

Solvency I and II (Insurance Cos)
Solvency I
• Early 1970s
• Focused on capital
adequacy
Solvency II
• 3 pillars
• 1 – Risk-based capital
• 2 – Risk management and
governance
• 3 – Transparent reporting
• Includes an own risk and
solvency assessment (ORSA)

Basel II and III (Banks)
Basel II
• Issued in 2004
• Minimum capital
requirements using weights
for different types of credit
risk
Basel III
• Response to the Great
Recession
• Operational risk added
• Risk management
framework
• Board of directors role
(approve framework, risk
appetite, governance)

ERM Process Model

Risk Identification Tools – Risk Register
Event
ID
Risk
Scenario
Likelihoo
d
Impact Risk Level Risk
Treatment
(present)
Proposed
improvement
action
Next
Review
Date
1
Loss of
personal
computer
3 1
None None Remove
from list
2
Damage to
reputation
2 4
Review policy Implement … 2 months
3
Loss of
state
funding 3 5
None •Increase
lobbying
•Step up
giving
campaign
1 month
….
Public University

Risk IdenficationTools - Risk Map
2
1
3 1
2
3
Loss of a personal computer
Damage to reputation
Loss of state funding
Public University

Inherent and Residual Risk
Inherent
Treat
Residual
Treat
Optimum

A risk map showing a large difference between
inherent and residual risk indicates that the
A: current risk treatment is ineffective.
B: risk does not need to be treated.
C: current risk treatment is effective.
D: risk exceeds the organization’s risk tolerance.

Decision Tree

Earnings at Risk

Earnings at risk of $200,000 with 90 percent
confidence are projected to be
A: $180,000.
B: less than $200,000 10 percent of the time.
C: $200,000 90 percent of the time.
D: greater than $200,000 10 percent of the
time.

Risk Management Environment and Culture

Risk Centers and Owners
Risk center – unit within an organization at
which level a risk (or risks) is most effectively
managed
Risk owner – individual accountable for
identification, assessment, treatment, and
monitoring of risks in a specific environment

Advantages of Risk Centers
Reduces the scope of risk analysis
Allows for the involvement of operational
managers
Helps focus on the organization’s strategic goals
and operational objectives
Ensures that risks are managed at the most
appropriate level in the organization

Risk Attitude
Risk Avoiding Risk Seeking
Risk
Optimizing

ERM Process and Framework Overview

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to ERM Process and Framework Overview

Similar to ERM Process and Framework Overview (20)

Recently uploaded

Recently uploaded (20)

ERM Process and Framework Overview

Editor's Notes