COSO, ERM, BSC

1. Enterprise Risk Management
R. Srinivasan

2. Definition of Risk Management
• Risk management is a scientific approach to
dealing with pure risks by anticipating possible
accidental losses and designing and
implementing procedures that minimize the
occurrence of loss or the financial impact of
the losses that do occur. (Fundamentals of
Risk and Insurance, Vaughan and Vaughan)
• Meaning: Risk as uncertainty concerning the
occurrence of a loss.

3. Types of Risks
• Strategic Risk. ...
• Compliance Risk. ...
• Financial Risk. ...
• Operational Risks. ...
• Reputational Risk. ...

4. Types of Risks…
• Strategic Risk: They are the risks associated with
the operations of that particular industry. These
kind of risks arise from:
– Business Environment: Buyers and sellers interacting
to buy and sell goods and services, changes in supply
and demand, competitive structures and introduction
of new technologies.
– Transaction: Assets relocation of mergers and
acquisitions, spin-offs, alliances and joint ventures.
– Investor Relations: Strategy for communicating with
individuals who have invested in the business.

5. • Financial Risk: These are the risks associated with the
financial structure and transactions of the particular
industry.
• Operational Risk: These are the risks associated with the
operational and administrative procedures of the particular
industry.
• Compliance Risk (Legal Risk): These are risks associated
with the need to comply with the rules and regulations of
the government.
• Other risks: There would be different risks like natural
disaster(floods) and others depend upon the nature and
scale of the industry.
• 65 Different Risks
Types of Risks…

6. Business risk
– Business risk is the possibility of business
loss or failure. There are three kinds of
business risks:
economic
natural
human

7. Economic risks
– Economic risks occur from changes in overall business
conditions. These changes can include:
the amount or type of competition
changing consumer lifestyles
population changes
limited usefulness or style of some products
product obsolescence
inflation
recession
government regulation

8. Natural risks
• Natural risks are risks resulting from natural causes
such as:
• Unexpected losses from some natural risks (e.g., fire)
can be insured against; other natural risks
(unpredictable weather) cannot be insured against.
floods
tornadoes
hurricanes
fires
lightning
droughts
earthquakes
unexpected changes in
weather conditions

9. Human risks
– Human risks are caused by human mistakes,
as well as the unpredictability of customers,
employees, or the work environment. Human
risks include:
customer dishonesty—theft, fraudulent payment,
or nonpayment
employee error, negligence, incompetence, and
theft
customer or employee accidents

10. 10
Economic Natural Human
Competition
Consumer Lifestyle Changes
Population Changes
Obsolescence
Limited Product Usefulness
Government Regulation
Inflation
Recession
Floods
Tornadoes
Hurricanes
Fires
Lightning
Snowstorms
Earthquakes
Droughts
Mistakes
Theft
Fraud
Computer Crime
Customer/Employee
Unpredictability
Work Environment
Unpredictability
Types of Risk

11. Known and Predictable Risk Categories
• Product size – risks associated with overall size of the software to
be built
• Business impact – risks associated with constraints imposed by
management or the marketplace
• Customer characteristics – risks associated with sophistication of
the customer and the developer's ability to communicate with the
customer in a timely manner
• Process definition – risks associated with the degree to which the
software process has been defined and is followed
• Development environment – risks associated with availability and
quality of the tools to be used to build the project
• Technology to be built – risks associated with complexity of the
system to be built and the "newness" of the technology in the
system
• Staff size and experience – risks associated with overall technical
and project experience of the software engineers who will do the
work

12. Risk Components and Drivers
• The project manager identifies the risk drivers that affect the following risk
components
– Performance risk - the degree of uncertainty that the product will meet its
requirements and be fit for its intended use
– Cost risk - the degree of uncertainty that the project budget will be
maintained
– Support risk - the degree of uncertainty that the resultant software will be
easy to correct, adapt, and enhance
– Schedule risk - the degree of uncertainty that the project schedule will be
maintained and that the product will be delivered on time
• The impact of each risk driver on the risk component is divided into one of
four impact levels
– Negligible, marginal, critical, and catastrophic
• Risk drivers can be assessed as impossible, improbable, probable, and
frequent

13. Contents of a Risk Table
It consists of five columns
Risk Summary – short description of the risk
Risk Category – one of seven risk categories (slide 9)
Probability – estimation of risk occurrence based on group
input
Impact – (1) catastrophic (2) critical (3) marginal (4)
negligible
RMMM – Pointer to a paragraph in the Risk Mitigation,
Monitoring, and Management Plan

14. Assessing Risk Impact
• Three factors affect the consequences that are likely if a risk does occur
– Its nature – This indicates the problems that are likely if the risk occurs
– Its scope – This combines the severity of the risk (how serious
was it) with its overall distribution (how much was affected)
– Its timing – This considers when and for how long the impact will
be felt
• The overall risk exposure formula is RE = P x C
– P = the probability of occurrence for a risk
– C = the cost to the project should the risk actually occur
• Example
– P = 80% probability that 18 of 60 software components will have
to be developed
– C = Total cost of developing 18 components is $25,000
– RE = .80 x $25,000 = $20,000

15. Risk Equation
Risk = Vulnerability x Threat x Impact
*Probability
• Vulnerability = An error or a weakness in the
design, implementation, or operation of a system.
• Threat = An adversary that is motivated to exploit
a system vulnerability and is capable of doing so
• Impact = the likelihood that a vulnerability will be
exploited or that a threat may become harmful.
• *Probability = likelihood already factored into
impact.

16. Strategic Risk Management
Enterprise Risk Management (“ERM”) is a strategic
business discipline that supports the achievement of an
organization’s objectives by addressing the full spectrum
of its risks and managing the combined impact of those
risks as an interrelated risk portfolio.
Strategic Risk Management (“SRM”) is a business
discipline that drives deliberation and action regarding
uncertainties and untapped opportunities that affect an
organization’s strategy and strategy execution.

18. Types of Risk
• Strategic – Goals of the Organization
• Operational – Processes that Achieve Goals
• Financial – Safeguarding Assets
• Compliance – Laws and Regulations
• Reputational – Public Image

19. Responses to Risk
Severity
Frequency
High Transfer Avoid
Low Accept Accept/Transfer
Low High

20. Enterprise Risk Management (ERM)
• A process, effected by an entity’s board of directors, management
and other personnel, applied in strategy setting and across the
enterprise, designed to identify potential events that may affect the
entity, and manage risks to be within its risk appetite, to provide
reasonable assurance regarding the achievement of entity
objectives. (COSO)
• A rigorous approach to assessing and addressing the risks from all
sources that threatent he achievement of an organization’s strategic
objectives. In addition, ERM identifies those risks that represent
corresponding opportunities to exploit for competitive advantage.
(Tillinghast-Towers Perrin consultancy group)
• Any issue that impact an organization’s ability to meet its
objectives. (Developing A Strategy to Manage Enterprisewide Risk in
Higher Education, NACUBO)

21. Integrated Control Framework

22. RISK MANAGEMENT IN AIRLINES
Risk Management
 Mercer Management Consulting analyzed aviation industry risks (1991-
2001):
 The primary risk facing the industry four categories
hazard,
strategic,
financial and
operational.
 Failure to manage the risks resulted in the evaporation of $46 billion in
shareholder value

23. RISK MANAGEMENT IN AIRLINES
Key Risks for Airlines
 Strategic risks are defined by business design choices
 Challenges from a new form of competition shifts in
customer preference and
industry consolidation
 These challenges may be mitigated through traditional responses
creating a culture focused on the customer,
developing a rigorous strategic planning process or
maintaining an independent board of directors.

24. An Example
 Many risks can be lessened through the selection of the business design
 For example, Southwest has designed a business that
attracts customers in good times and in bad
because it is simple operationally and,
therefore, cost effective
use of secondary airports insulates from competitive pressure
low debt levels make the company less vulnerable to interest rate
fluctuations.
profit sharing and fun culture reduce the chance of labor
difficulties.

25.  Financial risks involve
the management of capital and cash,
including exogenous factors
affect the predictability of revenue and cash
 Financial solutions may include the design of financial transactions
structured finance,
derivatives,
insurance,
contingent financing and
debt equity offerings.

26. RISK MANAGEMENT IN AIRLINES
Risk Mitigation
Mitigating financial risk:
 Techniques to mitigate financial risks are the most advanced
 There is a large third-party market dedicated to the effort,
 including banks,
 credit specialists,
 derivative markets and others.
 Hedging is a common way to manage the financial risk
 no airline input is more volatile than fuel
 hedging is not a core competency, and
 as long as competitors are not hedged, it will be a level playing field.
 When fuel prices rise dramatically, airlines cannot pass all of the cost on to
their customers.

27. RISK MANAGEMENT IN AIRLINES
Risk Mitigation
 Mercer analyzed the effect of year 2000 hedging strategies:
 While many airlines were able to maintain profits in the face of price increases,
more aggressive strategies could have been used to further improve results.
 If such tools are not further leveraged, earnings will continue to be vulnerable.
 A new technique for financial risk management involves guarantees for credit card
transactions
 In the new arrangement, a guarantor “insures” the refunds to the bank, which
then releases the cash in the escrow account.

29. FINANCIAL RISKS AT TURKISH AIRLINES
Financial Risk Management
Credit risk management:
 Effective receivables management.
 Managing the risk through obtaining guarantees for its receivables.
Liquidity management:
 Maintain adequate reserves, banking facilities and reserve borrowing facilities
Capital risk management:
 The capital structure of the THY consists of debt, which includes the
borrowings and equity comprising issued capital, reserves and retained
earnings.
 The top management of the THY assesses the cost of capital and the risks
associated with each class of capital.
 The Group provides the optimization of the capital diversification through
obtaining new debts, repayment of the existing debts and/or capital increase.

30.  Operational risks arise from the more tactical aspects
crew scheduling,
accounting and information systems,
e-commerce activities.
 Operational risks can be mitigated through organizational solutions,
process redesign,
organization structural changes,
improved communication,
contingency planning,
performance measurement and reward systems,
capital allocation and pricing.

31. Mitigating strategic risk:
 Lufthansa’s diversification into non-flying businesses was designed
In 1994 four companies being created:
Lufthansa Technique, Lufthansa Cargo, Lufthansa Service, and
Lufthansa Systems.
Revenue growth has been highest 70 percent in 1995.
 Not all of the divisions have been successful.
Swissair pursued a similar strategy but they couldn't succeed

32. RISK MANAGEMENT IN AIRLINES
Risk Management
 Aviation encompasses a full spectrum of risk factors:
 International airline is exposed
general entrepreneurial risks and
industry-specific risks.
 Key areas of exposure are
 capacity and utilization risks,
 strategy-related risks,
 political risks,
 operational risks,
 procurement risks,
 labor agreement risks,
 financial and treasury management risks.

33. Conclusion
 Enterprise Risk Management (ERM) also comprise financial, strategic risks
which will give many advantage to THY
 With formation of ERM it’s planning to
identify risk appetite,
risk strategy and
create risk transparency
to create a strong risk organization, to inculcate sharing risk
culture and effective risk processes.
 Risk management is an ongoing process, not a one-time event.
 If economy is a chain and every sector is its ring, every sector has to keep
its ring strong.
 Over the long-term, the only alternative to risk management is crisis
management.