Hello ERM - It's Time to Go
•
0 likes•269 views
Often, the best way to help your child grow up is to kick him/her out of the house. However, there’s always that anxiety – will they thrive, get hurt, fail? Many internal audit and/or risk functions became volunteer parents of their organization’s ERM programs, bringing enthusiasm and commitment to the role. However, ERM (and ESRM) works best when it’s owned and embedded into the fabric of the business. Unfortunately, most ERM programs fail within three years or less after leaving the nest. Why? Explore common challenges and proven strategies for coaxing ERM safely and successfully from the nest. Presentation by: Brian Link, CIA, VP – GRC Strategy & Partnerships, Resolver Inc.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Hello ERM - It's Time to Go
Similar to Hello ERM - It's Time to Go (20)
More from Resolver Inc.
More from Resolver Inc. (20)
Recently uploaded
Recently uploaded (20)
Hello ERM - It's Time to Go
- 2. I am the VP, GRC Strategy and Partnerships brian.link@resolver.com
- 3. I remember back when IA helped launch our ERM program – those were good times.
- 4. Let’s see, COSO ERM… kind of a strange bird, never really flew. ASNZ 4360 - it was a bit more pragmatic and action- oriented. ISO 31000 – wait, isn’t that 4360? COSO ERM update – new and improved… perhaps it will fly?
- 10. Go forth and identify, assess and manage risk! Don’t forget about inherent risk, risk appetite, linkage to strategy, KRIs, the three lines of defense. …I’ll be here if you need me!
- 12. Now I can relax a bit and get back to my day job. I’m sure the little one will be OK. He was flying, wasn’t he? I mean, his wings were flapping… right?
- 13. believe their organization has a “complete formal enterprise-risk management process in place”. indicate that their organization’s risk management process is “not at all” or “minimally” viewed as a proprietary strategic tool. of the organizations have boards that “mostly” or “extensively” review the top risk exposures NC State University Poole College of Management Enterprise Risk Management
- 14. Lack of alignment with strategy and business activities Inadequate planning and communication A focus on past risks rather than the future Lack of integration into business decisions Viewing the risk assessment or assessment of risk plan as the end of risk management process
- 15. Poor governance and “tone at the top” Practicing ELM instead of ERM Misunderstanding the “if you can’t measure it, you can’t manage it” mindset Not integrating risk management with strategy-setting and performance management Ignoring the dysfunctionalities and “blind spots” of the organization’s culture
- 16. Is something else inhibiting progress?
- 17. ALIGNMENT CAPABILITY RESOURCES MOTIVATION
- 18. ▪ Align and embed risk assessment within planning & budgeting cycles ▪ Create a framework that places everyone, literally and figuratively, on the same page ▪ Connect the dots – all the way through to resilience and recovery ALIGNMENT
- 21. • IT • Plant / Physical • People • Financial • Reputation • Planning & Budgeting • Procure to Pay • Market to Order • Order to Cash • Hire to Retire • Acquire to Retire • Idea to Offering • Plan to Inventory • Payroll • Key / Non-key • Detective • Preventative • Mitigating • Manual • IT-dependent Manual • IT General Controls • IT Application Controls • Policies • Control Environment – Including Culture Strategic • Competition • Disruptive Tech • Macro-Economic • Reputation • Environment & Social Operational • Physical Security • IT Security • IT Ops • HR • Supplier Compliance • Regulatory • Legal • Ethics • Fraud Financial • Reporting • Credit / Counterparty • Market • Liquidity • Model • Insurance Standards, Frameworks or Guidelines • IFRS • COSO ICF • IIA – IPPF • ISO 31000 • COBIT 5 • NIST • ISO 27XXX Laws & Regulations • Bank Act • SOX • Privacy • AML • FCPA • Business Groups • Functions • Geography • Locations / Sites • Cyber • Physical Security • Health & Safety • Environment • Whistleblower • Fraud • Issue / Incident • Case Management • Business Continuity • Disaster Recovery • Crisis Management • Capital Projects • M&A • KPIs • KRIs • Limits & Thresholds • Analytics Key Stakeholders • Shareholders • Institutional Investors • Public-at-Large • Labor Unions • Ratings Agencies • Underwriters Changes / Opportunities: • Customer Expectations • Competitive Landscape • Labour Market • Economic Conditions • Technology
- 23. LOSS TRIANGLESTEADY STATE RECOVERED STATE ADVERSE EVENT PREVENT RESPOND RECOVERPREPARE Recovery premium Recovery deficit RECOVERED STATE Loss Triangle ALIGNMENT
- 24. Source: Oxford Metrica, Resilience Index 2015 ALIGNMENT
- 25. ▪ Provide a clear definition of what risk is / is not ▪ Cast out the academic definition of Inherent risk ▪ Avoid Impact X Likelihood = Risk Rating ▪ Add a 3rd dimension such as Control Effectiveness, Management Preparedness, tec. CAPABILITY
- 26. Encourage respondents to identify the specific events that might trigger a failure. Objective: Reach the moon safely, land on it, and then return to Earth. Risk: Failure to land on the Moon. Risk: Oxygen tank explosion
- 27. Inherent Risk • Assumes no controls - really? • Too academic • Turns participants off to the risk assessment process, overall Enter – Maximum Foreseeable Consequence • Plausible, worst case scenario • Gives participants the license to think out of the box CAPABILITY
- 28. ▪ Equipment (very specialized) ▪ Information (paper files), servers ▪ Inventory ▪ Raw material ▪ Sales $$$$$$$ ▪ New toll supplier relationships ▪ Appreciation of CM team value and benefits of testing ▪ Validation of insurance coverages ▪ Knowledge that your key competitor can’t wait to see you drown CAPABILITY CAPABILITY
- 29. 3 MAXIMUM FORESEEABLEIMPACT CONTROL EFFECTIVENESS (or, MANAGEMENT PREPAREDNESS) 1 MonitorRemediate 4 2 What is a plausible, worst-case scenario/impact? HighLow High Potential CSA- focus Potential IA-focus CAPABILITY
- 30. believe that a “barrier” or “significant barrier” to ERM is that there are insufficient resources allocated to ERM. have not provided or only minimally provided training and guidance on risk management. NC State University Poole College of Management Enterprise Risk Management RESOURCES
- 31. Understand employee engagement Adopt/build an ERM framework
- 32. 1. Why - Committing to a meaningful purpose 2. How - Choosing the best way of fulfilling that purpose 3. What - Making sure that one is performing work activities competently, and 4. When - Making sure that one is making progress to achieving the purpose Purpose Mastery Empowerment Impact MOTIVATION
- 33. ▪ A non-cynical climate—freedom to care deeply ▪ Clearly identified passions—insight into what we care about ▪ An exciting vision—a vivid picture of what can be accomplished ▪ Relevant task purposes—connection between our work and the vision ▪ Whole tasks—responsibility for an identifiable product or service MOTIVATION
- 34. ▪ Delegated authority—the right to make decisions ▪ Trust—confidence in an individual’s self-management ▪ Security—no fear of punishment for honest mistakes ▪ A clear purpose—understanding what we are trying to accomplish ▪ Information—access to relevant facts and sources MOTIVATION
- 35. ▪ Knowledge—an adequate store of insights from education and experience ▪ Positive feedback—information on what is working ▪ Skill recognition—due credit for our successes ▪ Challenge—demanding tasks that fit our abilities ▪ High, non-comparative standards—demanding standards that don’t force rankings MOTIVATION
- 36. ▪ A collaborative climate—co-workers helping each other succeed ▪ Milestones—reference points to mark stages of accomplishment ▪ Celebrations—occasions to share enjoyment of milestones ▪ Access to customers—interactions with those who use what we’ve produced ▪ Measurement of improvement—a way to see if performance gets better MOTIVATION
- 37. To motivate employees who work beyond basic tasks, give them these three factors to increase performance and satisfaction: ▪ Autonomy — Our desire to be self directed. It increases engagement over compliance. ▪ Mastery — The urge to enhance and expand our skills. ▪ Purpose — The desire to do something that has meaning and is important. Businesses that only focus on profits without valuing purpose will end up with poor customer service and unhappy employees (i.e. more risk) MOTIVATION
- 39. indicate that the board of directors is asking “somewhat” to “extensively” for increased senior executive involvement in risk oversight. admit they were caught off guard by an operational surprise “somewhat” to “extensively” in the last five years NC State University Poole College of Management Enterprise Risk Management
- 40. ✓ Clear linkage to objectives ✓ Supportive “tone from the top” ✓ A purpose, delivered with passion (OK, perhaps slightly exaggerated)