Guiding Principles for Implementing Enterprise Risk Management (ERM)

Transcription

1 1 Guiding Principles for Implementing Enterprise Risk Management (ERM) SEAC Conference New Orleans November 15-17, 2006 Hubert Mueller (860) Towers Towers Perrin Perrin 0 ERM raises many implementation challenges for senior executives Stakeholders have challenged senior executives to ask questions with regard to integrated, enterprise-level risk analysis and their decision-making: How can we identify the key and emerging risks that deserve senior management attention? How do we measure and manage operational risks to the same degree as financial risks? How much capital do we need and what return should we get on it? How should we deploy capital to business segments and evaluate their performance? How do we select our growth strategies, given our risk environment? How can we maximize our return on capital, given our risk appetite? How do we best invest our assets, given the structure of our exposures? How much, and on what terms, should we insure and hedge? How should we report our risk management results and communicate with external audiences about our risk management programs? How do we build a risk culture within the organization? How do we coordinate all of this? And how do we get started? 1

2 2 Enterprise Risk Management should address key management issues at each stage of the journey from compliance to value creation Companies Need to Manage Risks from Many Interrelated Areas Internal/External Dimension Marketing Economy Legal/social Regulatory/political Competition Insurance People Processes Hazards Other Financial/Operational Dimension ERM Stages Compliance and Governance Diagnostics and Analytics Solution Options Execution Management Issues What are my risks? What is their impact? What can we do about them? How do I take action? 2 Guiding Principles: ERM as a means to add value to an organization 1. ERM serves strategic purpose not for audit ERM is more than an audit. Risk management optimizes the risk/return relationship not only the avoidance of risk 2. ERM generates economic value Create value by reducing the cost of capital and by increasing profits through better risk-based decision making 3. ERM is focused on managing risks in an integrated manner, as a portfolio of risks Analyze risks in combination to reveal systemic risks and interactions, and explicitly considers the interrelationships and correlations between risks 4. ERM considers both downside risks and upside opportunities Optimize the risk/return profile of the enterprise 5. ERM is best operationalized by making it part of the normal business process Coordinate with corporate planning and the allocation of capital and resources to fully integrate into the mainstream of business decision-making 3

3 3 1. ERM serves strategic purpose not for audit All businesses must take risks to earn returns. Risk management should therefore be the optimization of the risk/return relationship and not only the avoidance of risk Audit examines whether specified procedures and processes are being followed. It reduces risk, but does not consider the risk/return tradeoff Audit strategically mitigates risk, however, what to audit and how much time and effort to invest in audit is determined through a risk management process Audit Approach Starts with a checklist of risks Defensive: Focuses only on downside risks Analyzes risks in silos Supports monitoring and reporting ERM Approach Articulates strategy and identifies risks to achieving strategic objectives Considers unexpected upside scenarios; identifies opportunities for risk taking based on relative ability to manage risks vs. competition Considers interaction of risks to expose areas of concentration and diversification Supports decision making 4 Risk Triage process filters strategic risks from tactical risks Strategic Risks Corporate Risk Filters Business Business Tactical Risks 5

4 4 2. ERM generates value: Risk--Value Framework Maximize value by relating a firm s decisions on the risks it takes to the decisions on the capital it uses to finance its business Return on Risk Value Creation Value Management Costs Risk Structure Portfolio of Enterprise Risks How much capital do I need? Adequacy Risk and Management What type of capital do I need? Portfolio of Resources Structure Economic 6 3. ERM is focused on managing risks in an integrated manner, as a portfolio of risks Why manage risks in an integrated manner? Systemic risks Risks which in isolation are small within each organization, but because of common causes can in the aggregate across the enterprise pose a significant risk Concentration of risk Separate risk events that have common consequences Correlation of risks When companies fail, often it is because several related risks occur simultaneously. Important to understand the interactions among risks The lack of perfect correlation of risks means that the aggregate financial risk is less than the sum of each individual risk may be overspending on risk management if managing risks independently Exposure of risk Understand relative exposure across all risks to optimally allocate resources (financial and human) to mitigate risks Use risk analysis to develop risk-adjusted performance of business units a best practice in the financial services sector 7

5 5 Risk identification should capture the Anatomy of Risk Benefits of recognizing the anatomy of risk: Illustrates interactions among causal factors and consequences across risks to identify systemic risks and risk concentration Consequence 1 Cause 1 Risk Event 1 Consequence 2 Systemic Risk Cause 2 Consequence 3 Cause 3 Risk Event 2 Consequence 4 Consequence 5 Concentration of Risk Cause 4 Risk Event 3 Consequence ERM considers both downside risks and upside opportunities A fundamental objective of ERM is to optimize the risk/return trade-offs The downside of each business activity is the risk of financial loss, the upside is higher profitability When evaluating options to mitigate the downside of risks, need to also consider whether it reduces the upside Identify and embrace risks that the company can manage better than competitors An insurance company that believes it can better price auto risk pursues riskier (and more profitable) drivers and even identifies competitors who are offering lower prices Better management of political, foreign exchange and supply chain risks creates a competitive advantage in considering strategy to enter developing countries These are generally core business risks, such as risks directly related to the manufacturing and distribution of core products 9

6 6 5. ERM is best operationalized by making it part of the normal business process, fully integrated into the decision-making activities ERM Analysis Business Plan Insurable risks Mortality Assets Current Assets Liabilities Current Liabilities Property/Casualty Human Resources Fixed Assets Long-Term Liabilities Equity Market risks Interest rate Equity markets Foreign exchange Other Credit risks Impact of Risk- Management Decisions Expenses Costs Taxes Net Income Revenues Operating Income Other Income Operational Risks Business Risks Business interruption Corporate image, brands Economic cycles Cash Flow Begin End Operation Operation Investment Investment Financing Financing 10 Use assessment method that reflects true nature of risks This is what risks look like.. but the traditional method of assessing risks distorts the picture Probability Likelihood Expected loss $ Risks High >y% Med x% - y% Probability Expected loss $ Low < x% Low < $x Med $x - $y High >$y Impact Simplifies distribution of loss scenarios into a single scenario which scenario? Probability Underemphasizes real risks: low likelihood of large losses Expected loss $ Likelihood x Impact represents expected loss not risk 11

7 7 Implementing ERM: A 4-stage process at any level of the firm Identify Quantify Solve Execute What are my risks? Who is watching them? How much do they weigh? What is their impact What can we do about them? How do we decide? How do I take action? What value does it create? 12 The ERM Framework links strategy to the organization and processes that drive risk-based decision-making ERM Framework Strategy Risk definition Goals and objectives Risk tolerance levels and guidelines Organization Governance Accountability: Roles and Responsibilities Identify Quantify Solve Execute Process Tools Monitoring and Reporting 13