This was a prime example of the perception surrounding the terms “risk management” and “risk manager,” and how they’ve been equated solely to insurance coverage and insurance professionals in the past.   I’ve witnessed this misrepresentation of the terms so many times that I felt not just inspired, but a public obligation, to write this article and help clear the confusion with the terminology that began long ago.

PASSING THE SMELL TEST

In the early 1960’s, two professors, Robert Mehr and Bob Hedges, developed the concept of Enterprise Risk Management. These two could easily be called the Godfathers of Risk Management. They published the first text to fully address the subject of business risk, “Risk Management in the Business Enterprise.”  The book introduced how risk management of an entire business could maximize efficiency, which would result in greater productivity. The basic premise was that all business risks should be managed, not simply those that could be “insured.”

Suffice it to say that over time, the term “risk management” began to take on a more limited meaning, referring just to insurable risks (for a slightly more elaborate outline see history of enterprise risk management). Now, some 45 years later, many large public firms are finally returning to the original roots of risk management. The Risk Managers of these firms manage the risk exposures of the entire business, not just those risks that are insurable. Mehr and Hedges would be very happy about this if they were here with us today. And, I might add, this helps put my mind at ease as well.

You see, having been heavily involved in construction for much of my lifetime and having witnessed many different construction business failures, it became evident to me that the causes for each failure all boiled down to risk. However, it never seemed to make sense that insurance brokers and agents called themselves risk managers, especially since they only provided a form of management that addressed insurable risk. It just never sat right with me. First of all, they really didn’t address anywhere close to all of the business risks that exist. Second, out of all the business failures I had witnessed, none were the result of having too little insurance or poor loss control procedures. When I finally came to understand how risk management evolved over the years it was somewhat of an awakening.

THE ENTERPRISE RISK MANAGEMENT PROCESS

Robert Mehr and Bob Hedges came up with the steps for the risk management process, and the basic form is still in practice to this day:

• Risk Identification (Identify all the risk factors; all the possible causes for loss in a typical company)
• Risk Analysis (Analyze the risk; assess and measure the potential for loss in the company to be examined)
• Risk Response (Determine what to do; either assume, transfer or reduce the risk)
• Risk Control (Implement internal controls to reduce or transfer the risk)
• Risk Monitoring (Select a method for monitoring results and put it in practice)

As originally intended, risk management would encompass management of the entire business enterprise; hence, the field became known as Enterprise Risk Management (ERM for short). ERM requires examination of all risks that an organization faces and applies directly to four distinct types of risk: Operational Risk, Financial Risk, Strategic Risk, and Hazard Risk.

For the most part, only hazard risks are insurable.  Thus, insurance brokers should have called themselves hazard risk managers instead of just “risk managers”.  Now, with the reemergence of ERM, traditional insurance-based “risk managers” are being pushed into a wider arena of risk management, one that incorporates all other areas of business risk, many new forms of risk analysis, and a wider array of risk control mechanisms.

The primary challenge of expanding risk management across the enterprise is that, because it involves so many different aspects of an organization’s operations, traditional insurance-based risk managers (who focus only on hazard risk) are simply not qualified as enterprise risk managers. They simply don’t have the experience or expertise necessary to have a firm grasp of all aspects of a business, and there are already signs they are losing their hold on the “risk manager” title. In fact, the fastest growing position in the business world today is that of Chief Risk Officer (CRO). As ERM continues to filter down from public companies to smaller and smaller private companies, you can expect a CRO type individual to become part of every management team. After all, the adoption rate of the ERM process has already reached 40% in public firms.

In order for risk managers to evolve from insurance minded professionals to ones who understand the risks of an entire business enterprise, they will have to learn the language and the approach of each business area, either alone or as a team. If they are to act as a team, the team leader will need to have a basic understanding of all the steps involved in the entire process of risk management and the methodology used in each business area. Clearly, traditional risk managers will need to obtain additional skills to be involved with enterprise risk management.

TYPES OF RISK MANAGERS

There is no doubt Enterprise Risk Management is making its way from large public firms to firms in the private arena. It is being dictated by credit providers of large public firms as a result of Sarbanes-Oxley and, given the current credit environment, may soon be expected of private firms too. It may not be long until ERM becomes an expected and necessary way for all companies to operate.

Since risk management has expanded to cover risk across the entire enterprise, one of the largest challenges has been finding individuals capable of understanding and managing such risk. Since insurance agents or brokers who only provide insurance advice to their clients do not fit the bill, corporate decision makers only have a couple options:

1. Salaried employees who can learn to manage a wider scope of risk for their company than traditional risk managers (often chief financial officers or treasurers); and
2. Independent consultants who provide comprehensive Enterprise Risk Management services.

Individuals who perform at this level are called CRO’s. They are in very high demand today and typically are drawing salaries even higher than the CFO. As time progresses, I expect that there will be a lot of CRO’s working on a consultancy basis since smaller firms won’t be able to find, much less afford individuals qualified to identify, assess, and control all of the risks in a business enterprise. Obviously, such individuals must be very specialized in a particular industry to serve their clients well.

To choose the best type of risk manager for their companies, corporate decision makers must now consider the potential increase in profits that the adoption of the Enterprise Risk Management process can bring. For those early adopters, employing an experienced professional in Enterprise Risk Management is the key to real benefit. If that person is a consultant, he can be used as the de facto enterprise risk manager who can be relied upon to retrain traditional risk managers already on staff so they can gain the full knowledge of how to control risk across the enterprise. As time will tell, the true risk manager will not be the traditional insurance professional who addresses Hazard risk, but will be the individual who can address Operational, Financial, and Strategic risk as well. That is how risk management is evolving and what is expected of a risk manager in many companies today.

Thus, will the real risk manager, please stand up!

By:  David F. Druml, ERM Specialist a My Risk Control, LLC

Excerpts from “Journal of Risk Management of Korea Volume 12, Number 1” D’Arcy, Stephen P., Professor of Finance, University of Illinois at Urbana-Champaign, May 30, 2001

This weeks Case ‘n Point looks at the question on all our minds, “Is risk management doing its job?” Our real-world example isn’t based on just one story. We’ve encountered this scenario so many times that we’ve provided the quintessential example. As always, the names have been changed to protect the innocent parties.

The certificate of insurance description box must read: “Jake’s General Contracting is named as general liability additional insured.”

Top of page 1

THIS CERTIFICATE IS ISSUED AS A MATTER OF INFORMATION ONLY AND CONFERS NO RIGHTS UPON THE CERTIFICATE HOLDER. THIS CERTIFICATE DOES NOT AMEND, EXTEND OR ALTER THE COVERAGE AFFORDED BY THE POLICIES BELOW.

Top of page 2

If the certificate holder is an ADDITIONAL INSURED,  the policy(ies) must be endorsed. A statement on this certificate does not confer rights to the certificate holder in lieu of such endorsement(s).

He shared with me how cash flow had put him out of the construction business. His claim to fame was the installation of high end custom wood work in plush offices and homes. As he became bigger, he just was not prepared for the cash flow crunch that he would experience. He shared with me his frustrations at getting paid from General Contractors who always had an excuse for not paying, and he used a few choice words. It was obvious that he had experienced what has put so many companies out of business, a cash shortage. He indicated he was making good money, and I believe that because custom millwork brings a good margin and there is not a lot of competition for highly specialized woodwork. He had different types of wood shipped in from all over the world and he shared with me how even though he was profitable, when he pursued the bigger work, cash flow became too much of an issue and he was forced to reinvent himself. This certainly is a familiar story.

There is a basic collection tenet that states “the longer the bill is outstanding, the less the chance of collection.” Although this particular construction company was able to collect its money, the bill was outstanding just too long, often up to 90 days according to his description. This brings us to the importance of conducting cash flow projections. You see, if he had been able to project the cash demands for his company, he may have found the cash resources in advance to continue it. That is why it is imperative to continually assess the timeliness and the probability of collecting open accounts receivable. This is particularly important in the construction industry because of the sizable dollar amounts that can be withheld. It is also important to recognize that the longer the bill remains outstanding the more likely you could be talking about a bad debt, and that possibility needs to be taken into account in cash flow projections as well.

Particularly in tough economic times as we are now experiencing, each owner, developer, and general contractor has to be scrutinized before doing business with them and finding out that they themselves have run out of cash. Since it is difficult to accurately predict when down cycles will come and go, a continuous aggressive collection effort will assist in increasing cash flow and lowering doubtful accounts. Therefore, accounts receivable personnel and/or project management must regularly meet with senior managers to discuss potential collection issues that might arise. If a contractor does not regularly perform this task, it will usually fail to react fast enough to manage potential cash shortages. Failing to do this exercise over a long period of time can result in overstated receivables and a misrepresentation of the financial strength of a company, potentially misleading management, banks and bonding companies. Since bad debt expense directly impacts the bottom line of the financial statement, a bank or surety may believe it was misled in its credit decisions by the contractor’s failure to reveal the bad debt in advance. When a bad debt expense suddenly arises after being uncollectible for a long period of time, key bank and bonding relationships may be damaged.

The summary of all this is that cash is king, and failing to perform cash flow projections is a major risk factor in industries that experience fast moving cash like construction. To lessen the risk of potential harm, a contractor must project speed of receipts, have meetings to identify potential collection problems, try to recognize bad debt in advance and aggressively collect open accounts receivable. Only by doing cash flow projections can you take all these factors into account and avoid a surprise cash flow shortage. In the case of my new contractor acquaintance, every story has a silver lining. He decided to go into high end millwork as a manufacturer only. Now he gets paid up front for the expensive woods he uses and gets paid within 30 days as a vendor having a much needed product that is not easily found elsewhere. Hurray for him, he avoided being another one of the many construction companies that have simply failed by running out of cash, even while making a profit.

Creditors

In the case of mortgages that went bad, because loans could be packaged and resold, an anything goes atmosphere developed and many risk management practices were thrown out the window. Many loans were provided based on simple applications that provided minimal financial information. The fallout of this lending environment is showcased on Mortgage Lender Implode-o-Meter. In the case of IndyMac, a large portfolio of non-performing Alt-A loans, sometimes called liar loans, and risky construction and land development lending, left the bank with very little cushion in a falling housing market. Other banks impacted by losses only relied on financial data, failing to consider all the risks of lending to high risk industries such as construction and auto dealerships.

For instance, how many lenders gave adequate consideration to potential increases in fuel costs and its effect on buying habits? Just ask a Hummer dealership with vehicles anchored on the lot in concrete how well-prepared they were. For that matter, Mike Shedlock makes a convincing argument that the entire U.S. auto industry appeared to be caught off guard by changing consumer sentiment. It’s well worth reading. The fallout is that we could very easily see the implosion of a U.S. Big 3 auto maker, and more bank failures are almost certain to follow. Bank Implode-o-Meter provides a sobering play-by-play.

As a predictable reaction to experiencing losses, and watching other banks fail, the New York Times is reporting that Worried Banks Sharply Reduce Business Loans. Equally predictable, however, is that the reduction in business loans comes too late to significantly reduce losses, and will actually do more economic harm than good at an aggregate level.

Guarantors (Sureties)

In the case of sureties, dependency on old financial data, insufficient attention to all risk factors, and generally loose credit set up the industry for a fall. The industry was ill-prepared for any shock to the system, and 9/11 proved that, exacerbating losses that would not reverse until 2005.

Surety Industry Losses - Data from Surety Association of America

Riding a wave of construction spending and bubbling real estate valuations, the surety industry posted good results for the years ending 2005-2007. However, we doubt that trend will continue past year end 2008 into 2009; the industry still remains exposed to economic shocks:

In the past quarter, many contractors have been cutting volume significantly, some in half! Imagine trying to carry the same overhead on 50% of your previous sales. Most companies don’t know how to manage that kind of fall off, and many won’t, ending in failures that sureties will have to support. Chubb recently reported a large surety loss of $75 million and a surety combined ratio of “128.4% due to one large loss.” While many sureties “appear” to have learned their lessons from the loose practices of the early part of the decade by implementing tighter underwriting guidelines, we still expect to see more of these “surprise” losses. Why? Because, for the most part, sureties still aren’t using all the underwriting data they should be, and many contractors are just now starting to feel the brunt of a severely tightening construction environment.

So what does all this mean? In simple terms, neither banks, sureties, nor those receiving credit are accounting for all potential risks and, consequently, their decisions were made without due consideration for all the risk factors present. Although it is typical to see a high number of business failures in risky industries during downturns, if we want improved underwriting practices (a better functioning economy), losses shouldn’t be accepted with an “oh, well” mentality.

The Underwriting Deficiency Problem

So how could some of these losses be prevented? It is inevitable that there will be truly unexpected, “Black Swan” events that lead to unpredictable losses. It is impossible to completely foresee these events. That said, financial companies suffer more predictable, common losses everyday because of flaws in the underwriting process. These flaws generally fall into two categories: unusually high tolerance for risk and poor underwriting data. Addressing these issues can lead to better, more predictable results:

1) Unusually High Tolerance for Risk

This problem can never be fixed completed, but a good first step is an integrated risk management program that includes rigid policies and procedures that must be strictly adhered to when making decisions to grant credit. Unfortunately, most financial institutions already have strict underwriting guidelines in place; they simply are not followed on a consistent basis. When markets soften and competition increases, it’s all too common for underwriters to “bend” guidelines to win business. Not bending guidelines, in fact, becomes very difficult because pressure mounts from management, and sometimes Wall Street, to maintain consistent revenue growth. This causes companies to tolerate a higher level of risk than they should. Ultimately, this is a management or psychological issue. The more pressing issue is lack of useful, truly predictive data:

2) Incomplete or Misleading Underwriting Information

A common complaint we hear from underwriters and credit providers is that they just don’t have a good sense of what goes on behind the four walls of their potential clients. No matter how much financial information they receive, there’s always the lingering uncertainty of how valid the data really is. At the end of the day, financial data is only good as the inputs used. How is an underwriter supposed to know if the inputs are correct? More importantly, how are they supposed to know whether strong financials are due to a company playing Russian Roulette with risk as discussed in the “Success Paradox”, or due to a company being truly well-run? Basically, credit decisions, are only as good as the information they are based upon. If accurate or actionable information is unavailable, underwriting decisions will suffer, especially when underwriters have to guess how predictive the data really is. There are three primary causes of poor underwriting data: insufficiency, inaccuracy, and obsolescence:

a) Insufficiency is a lack of data and usually a poor excuse for underwriting failures. There are plenty of management training programs that teach “if you are missing something, then go get it.” Some underwriters do, but a lot don’t. For optimum results, all data that can help predict the likelihood of a loss should be considered. Unfortunately, sometimes data is simply either not available entirely or not available in an easily usable form.

b) Inaccuracy is caused by (1) fraudulent data or (2) poorly compiled data, and is a constant concern in every company. The old adage “garbage in – garbage out” really applies here. If the data is not accurate, then underwriting decisions will be impacted. Most inaccurate data in business stems from poor accounting procedures.

c) Obsolescence refers to data that is old and can be misleading. In most industries, data less than one year old is typically good enough to make credit decisions. However, in risky, volatile industries, cash moves through the companies very quickly. In these industries, data more than even a few months old often leads to poor credit decisions. That is why creditors should always want the most recent information available.

So how can these problems be solved?

Finding a Fix

Up until now, almost all underwriting decisions have been based primarily upon quantitative data, that is, financial information. However, pure logic tells us that financial information alone has not served to adequately stem the losses that have occurred.  To fix the problem of data insufficiency, obviously more data would be better and would help in underwriting decisions.  That is why qualitative data about an individual or company can greatly assist in underwriting decisions.  In the case of mortgage lending, would losses have been reduced if consideration was given to the risk of deflated home values, the risk of concentrated loan types, or the risk associated with lending to those with a single source of income? The answer is yes, and all of that is qualitative data.  In the case of construction lending, would losses have been reduced if banks had considered the risk of a contractor’s revenue concentration in one type of work of large proportions, or the risk that developers would not be able to pay them if houses did not sell?  The answer is again yes, and all that too is qualitative data.

So why isn’t qualitative data considered to a greater degree? There simply has been no standardized means to collect qualitative risk data. And if it was collected, there has been no way to compile and understand it. To further compound the problem, qualitative data is typically subjective and difficult to quantify. Consequently, although qualitative risk data can fill a number of credit underwriting deficiencies, it simply isn’t available in a useful form. As a result, it hasn’t been relied upon for credit decisions. It just didn’t fit into the tried and true world of numerical reporting… until now.

Recent Catalysts for Change to Underwriting Practices

Although computers and the Internet have played a role in the development of qualitative information for use in credit decisions, the real catalyst has been the emergence of Enterprise Risk Management (ERM), which has come onto the shores of corporate America in a strong wave. Ever since the Enron fiasco, the Arthur Andersen debacle, and the response with Sarbanes Oxley, attention has turned more than ever toward examination of business practices and metrics to assure that handling of company records follows strict procedures and guidelines.  The immediate response to Sarbanes Oxley was the development of corporate governance systems designed to not only incorporated procedures for handling company records, but also install business controls. However, these systems initially failed to consider all business practices that could impact profitability. In addition, they typically looked at practices in somewhat of an on or off manner; either practices were in place or they weren’t. ERM on the other hand, considers all business practices that can impact profitability and examines them in a variable form, i.e. not in place, poorly in place, functional but needing improvement, acceptably in place, etc. As such, it provides a more holistic view of the entire corporate framework and the inherent risk to enterprise objectives. Recently, S&P and other rating agencies have begun to review how well companies utilize Enterprise Risk Management, as part of their credit rating procedures. However, the rating agencies reviews seem to be more focused on whether an ERM system exists in a company and less on actually assessing the value of the controls in place.

A true enterprise risk assessment determines whether a company has the necessary systems and controls in place to maintain profitability, whether its accounting procedures are strong enough to produce reliable financial information, and whether it’s exposed to undue risk as a result of overlooked exposures. Data from the risk assessment is analyzed to reveal profitability risk, potential increases in failure risk, and has the added benefit of validating the quality of financial information generated by a company. In addition, it is usually available within a week of assessment, a much shorter time frame than financial reports. By providing additional underwriting information and analyzing the quality of accounting practices in an almost real-time manner, enterprise risk data addresses the three causes of poor underwriting data: insufficiency, inaccuracy, and obsolescence. With this data, a credit granting decision can be made without that unknown hanging over the underwriter. Just what goes on behind those four walls no longer needs to be a mystery. Now it can be known.

A Long Awaited Solution

To be truly effective as an underwriting tool, there must be a standardized system for gathering and analyzing enterprise risk data. In addition, because the risk factors in each type of business vary considerably, any system that attempts to collect qualitative risk data and quantify it must be designed specific to an industry. For example, a risk factor in the restaurant industry would be the presence of rodents, which is not really a concern in the construction industry.

MyRiskControl.com utilizes the patent-pending DGR Risk Analysis System, which is licensed from Druml Group, Inc. The DGR Risk Analysis System provides a standardized means for assessing and analyzing qualitative risk in a business enterprise. The source data required to produce a MyRiskControl Report comes from a standardized risk assessment, which can be performed either by a Certified Professional Assessor of Enterprise Risk or by a company’s own personnel. Although both approaches can produce accurate reports, company personnel could have inherent biases or lack a full understanding of all the risk factors. Certified Professional Assessor of Enterprise Risk are trained to be fully knowledgeable about each risk factor to ensure the greatest accuracy and neutrality of the resulting risk analysis report.  In turn, the risk analysis report scores and rates the overall severity of risk present in the assessed company.  MyRiskContol Reports are often provided to banks, sureties, and other creditors or guarantors trying to obtain a more complete picture of their prospects. As a result, credit underwriters no longer have to work solely on financial data, but can get a much clearer view of the current and projected health of their applicants to avoid undue risks. Now when choosing whether to grant credit, underwriters no longer have to play their own high stakes game of Russian Roulette.

1. A company has proper risk controls in place and is successful/profitable
2. A company does not have proper risk controls in place and is successful/profitable
3. A company has proper risk controls in place and is unsuccessful/unprofitable
4. A company does not have proper risk controls in place and is unsuccessful/unprofitable

The Success Paradox

The term “Success Paradox” has been used to refer, among other things, to individuals that are economically successful not being as happy as those less economically well-off, to the increased vulnerability of developed countries to diseases such as measles, and to the concept that an enterprise, such as a poverty NGO, can put itself out of business if it is successful.

All these references are useful, but our use of the term is specifically in reference to situations where a risk is present and successful mitigation of that risk, in hindsight, reduces the risk’s perceived importance. One great example is the Y2K problem. Since there were no major catastrophes related to Y2K, there is a tendency for people to assume it was not really a problem in the first place! However, the fact that no catastrophes occurred might also be attributable to the excellent risk mitigation efforts of thousands of companies and individuals working diligently to fix the exposure.  In essence, effective ERM can cause a business to run very smoothly, which actually lessens the perceived value of the ERM implementation.

The Four Quadrants

In the first quadrant, effective ERM leads to enterprise success.  This quadrant describes a company that is maximizing long-term profitability.  If management understands the role that effective risk controls played in the success, they will appreciate its importance.  However, it is often the case that the perceived importance of the risk controls will be diminished, just as Y2K controls were downplayed after a relatively uneventful Jan 1, 2000.  This is the Success Paradox.

The second quadrant, however, is slightly different in that it deals with chance/luck. It is analogous to Russian Roulette.  In this situation, a Russian Roulette play might assume there is no danger to the game because no damage occurred from his “turn”. In a sense, he is still successful/profitable, but that does not mean his actions were risk free, or that he made the right decision to play. He just got lucky, which is the operative word; he could very well have died.

The third quadrant, is one we rarely encounter.  With effective risk controls in place, companies rarely are unsuccessful.  They may go out of business, but this is usually due to, among other reasons, wanting to exit the industry or simply shutting down due to retirement.

The fourth quadrant is one in which poor risk management controls and operations lead to business failure.

Prevalence

Because effective risk controls do not exist in most businesses, quadrants one and three are the most rare.  Companies in quadrant one are usually at the top of their industry.  They have spent a good deal of time implementing effective risk controls and have excellent long-term strength and security to show for it.  They rarely experience business failure, more commonly just closing up shop in an orderly business when they decide to exit a business.

The second quadrant is the most prevalent in the business world, and especially in the construction industry.  Most companies skate by with ineffective risk controls in place; they may stay in business but do not maximize long-term profitability and remain susceptible to numerous risk exposures.  Unfortunately, many of them are not so lucky and find themselves in the fourth quadrant.  That is why tens of thousands of contractors go out of business each year; poor risk controls leading to undue exposure to risk.  Millions more simply get “lucky” and remain to battle the risk gods another year.

Our goal with MyRiskControl.com is to make quadrant one the most prevalent in the construction industry.  How do we do that?  By making ERM simple, affordable, accessible and easily manageable.  In essence, by bringing ERM to the masses and an extremely cost effective manner.  Speaking of costs, we’re often asked what the typical ROI is for implementing an ERM program.  Unfortunately, this isn’t an easy question so it will be the subject of a future post.

Myth Number 7: You Can Manage Risk Only from the Center

No one is likely to argue that strong, central risk management is a bad thing. Unfortunately, many organizations make the mistake of investing only in a centralized function because it’s too difficult to federate, and they don’t know how to push risk management to lower levels of responsibility in the organization. It’s a classic issue of consistency vs. quality of information.

But, accurate information lies at the business line level. Organizations must augment their centralized risk management efforts with localized, distributed data, and the only way to reliably and cost-effectively do that is to invest in automated technology solutions.

Along this line of thinking, he continues:

ERM needs to be deployed bottom-up so that business managers are the first-line managers of risk, embedding enterprise risk management within the day-to-day business processes of the firm. They must understand the risk/reward trade-offs involved in their own decision-making. Risk management should create a bias for action, surfacing problems as they arise and empowering the entire organization to be risk managers.

This is one of the most important aspects of a well thought out Enterprise Risk Management system.  There must be management and employee buy-in at all levels; otherwise ERM implementations tend to suffer from the same pitfalls that plague most change management:

Unclear rationale for change

Lack of understanding of the urgency of change

Inadequate employee mobilization and engagement

Complacency (resistance to change because of prior success)

Too many initiatives at one time, overloading change management capacity

Mixed messages from top and middle management

Short-term thinking and lack of follow-through, especially in long-term initiatives

Without proper buy-in, and the creation of a true risk management culture within an organization, the change for ERM success falls significantly.  There are simply too many risk factors for a centralized risk manager to deal with.

Myth Number 3: It Just Takes Common Sense

“There are really no cookbook solutions. One has to use creativity and a lot of common sense.” This was a May 16, 2000 email response from Enron Corp. risk expert Vince Kaminski, when asked by a colleague to recommend a good book on operational risk.

As Enron proved, creativity is a no-no and common sense alone just doesn’t suffice when it comes to risk management. As business activities have become more complex, so has risk management. The sheer magnitude of the regulations leaves many firms struggling to put in place processes and infrastructure Relevant Products/Services that are able to identify and control the compliance risks they face.

Risk management covers a wide variety of risk disciplines, including operational, compliance, financial controls, legal, liquidity, business strategy and technology, each of which has its own nuances and specialized models for assessing risk. It may not be rocket science, but it does require application of sophisticated models and analytics, aided with accompanying software tools.

While many of the steps taken in the ERM process seem like common sense, the process as a whole should not be approached in a “common sense” fashion.   Common sense would say to focus first on the fires that need to be put out right now.  Otherwise you might not even have a business tomorrow!  Unfortunately, oftentimes, there’s only enough time in the day for dealing with “fire drills” and when you’re done, you’re too exhausted to do the little things that fall under the category of “sharpening the axe”.

When running a business, it’s easy to forget about all the details of all the various disciplines required to prevent business failure and promote a strong, secure company.  When we talk to companies about certain risk factors, we often hear the same response:

“I never thought about that (or I never realized that could cause harm to my business)”

That’s why an ERM framework is so important.  Used properly, it ensures that adequate policies and procedures are in place to prevent against all the risks you “never thought about” or the ones you did think about but never had time to address.

“Against the background of an ever tougher risk environment and growing demands from investors, regulators and rating agencies, PricewaterhouseCoopers says that many insurers and other financial services organisations are asking questions about the effectiveness of enterprise risk management and its ability to deliver a return on investment or meet the expectations of stakeholders.”

The article is worth reading.  One of the key points made is:

“…the study found that enterprise risk management is, in many cases, neither relevant to nor clearly understood by business teams. It is not fully embedded into strategic decisions and its integration into day-to-day decision making and frontline risk taking within many insurance companies remains limited, potentially undermining its ability to deal with a more complex risk environment and more exacting stakeholder expectations”

This article mainly addresses ERM within financial institutions.  These companies have a very real need for ERM, especially with a broad range of exposures to interest rates, natural disasters, and general economic turmoil.

That said, the takeaways apply to all business enterprises.  In essence, ERM adoption can be held back due to it’s complexity and the inability of current practitioners to properly teach the marketplace about its proper use.  Many look to Enterprise Risk Management as a holy grail that will lead to zero losses, and soaring profits.  Unfortunately, this ideal can be quite damaging, especially for those expecting quick results and not fully realizing the amount of work and effort that is actually necessary to make real, lasting change.

Since the topic of Enterprise Risk Management can be quite overwhelming, it’s important that practitioners work to translate it’s implementation into actionable items that can be performed by individuals with no prior experience.   By doing so, everyone in an enterprise can be involved and take ownership in the process, helping create a risk management culture, rather than a dictatorial risk management approach that almost always fails.