1) The document discusses effective risk management frameworks and how they have evolved to view risk more broadly across potential positive and negative impacts. 2) It presents a risk management heat map approach that evaluates both risks and opportunities based on their likelihood and impact on organizational objectives. 3) This provides greater strategic and tactical value to management compared to only considering how to avoid negative risks, and helps an organization identify opportunities from uncertainties.

1. Article reprinted from Spring 2012
BIZGrowth Strategies
IDEAS TO HELP GROW YOUR BUSINESS
Management & Performance
Effective Risk Management – Substance over Form
O ur previous issue introduced risk management as a “new
business core competence” and explained its importance
throughout all levels of an organization. This article describes
Risk Management Heat Map Developed by Jay Mattingly
what an effective risk management framework looks like. Management addresses these key risks and opportunities in its plans and priorities.
Note: Some adjustment to current priorities may be required.
A fully-developed risk management framework would have the
following components: 1) common risk language; 2) risk principles; 3 3
O - 21
3) risk framework; and 4) risk process. Driving the risk model would Impact of Objectives
R - 11
Impact of Objectives
be the organization’s view of risk.
2 R-3 2
Risk Redefined R - 72
Perspectives on risk management have evolved significantly 1 O-8 1
over the past two decades driven initially by the perception O - 14 R - 34
that “risk” equates to a negative event. While the impact
of negative events continues to drive the urgency for risk 1 2 3 3 2 1
management, organizations have found the risk management
process to be more effective when viewed across the gambit of Opportunities Likelihood Likelihood Risks
both positive and negative events.
ISO 31000, the first International Standard on risk management
issued in 2009, defines risk as “the effect of uncertainty on risk event, the evaluation of the impact, and the development of
objectives.” It expresses the view that risk events can also create a mitigation strategy. Our new model goes further by evaluating
positive impacts. What is significant here is that organizations the opportunities presented by this uncertainty. In our scenario
should look at the impact of uncertainty as potentially negative the opportunity exists to obtain alternative accommodation in
and positive. Organizations that are able to manage an uncertain the same area for reduced rent in a location that better suits the
event effectively can potentially transform a negative event into a needs of the business. In this case the mitigation strategy (how
positive outcome. The writers of the ISO standard recognized that to avoid the negative event) is replaced with the management
the framework and process to evaluate negative events would also decision to move into a new facility.
equally apply to positive outcomes.
The important difference here is that risk management more
The Alternative effectively complements the organization’s decision-making by
The “Risk Management Heat Map”* illustrates this new view moving beyond the sole recognition of potential negative events to
of risk management – evaluating risk from both a positive and the identification of opportunities created from this uncertainty.
negative impact on the organization’s objectives. The likelihood Monitoring: the Last Word
and impact of events can be categorized into either negative risks
or opportunities. Using this approach provides greater value to We have described the new thinking behind the development
management in both strategic and tactical discussions. The direct of a risk management model and its improved impact on
© Copyright 2013. CBIZ, Inc. NYSE Listed: CBZ. All rights reserved.
linkage to the organization’s objectives provides greater relevance the organization. However, the last word in assessing the
for the risk management function. effectiveness of any risk management system is effective
monitoring designed to identify deficiencies and make
Scenario improvements. Without a qualified, independent evaluation of your
ABC Retail Company has been told that its building lease may system of risk management much of this effort
not be renewed. The company has evaluated this risk to have would be in vain.
a significant impact on the business objectives. Traditional risk *From a PPT presentation by Dorothy Gjerdrum,
management philosophies would consider the identification of this ARM-P, at the 2010 Governance, Risk and
Compliance Conference.
business is growing yours
W. Remonde Brangman,
CBIZ MHM, LLC • Bethesda, MD
our 301.951.3636 • rbrangman@cbiz.com