{"id":2432,"date":"2024-02-28T07:21:59","date_gmt":"2024-02-28T07:21:59","guid":{"rendered":"https:\/\/sudhadigital.com\/GMSI\/?p=2432"},"modified":"2024-03-09T14:51:09","modified_gmt":"2024-03-09T14:51:09","slug":"enterprise-risk-management-integrated-framework","status":"publish","type":"post","link":"https:\/\/gmsisuccess.in\/?p=2432","title":{"rendered":"Enterprise Risk\u00a0Management \u2014 Integrated\u00a0Framework"},"content":{"rendered":"

Any one of a variety of risks could threaten an organization\u2019s success and lead to a decrease in stakeholder value, including: globalization, technology, demands for customized products and services, shifts in regulation, mergers and restructurings, accounting and reporting deficiencies, and complex financial instruments. Leaders must be aware of a holistic approach to risk management and the need for a stronger governance structure.<\/p>\n

Today\u2019s organizations are\u00a0concerned about:
\n\u2022 Risk Management
\n\u2022 Governance
\n\u2022 Control
\n\u2022 Assurance (and Consulting)<\/p>\n

ERM Defined:
\n\u201c\u2026 a process, effected by an entity\u2019s\u00a0board of directors, management and\u00a0other personnel, applied in strategy\u00a0setting and across the enterprise,
\ndesigned to identify potential events that\u00a0may affect the entity, and manage risks\u00a0\u00a0to be within its risk appetite, to provide\u00a0reasonable assurance regarding the\u00a0\u00a0achievement of entity objectives.\u201d
\nSource: COSO Enterprise Risk Management \u2013 Integrated Framework. 2004. COSO.<\/p>\n

Why ERM Is Important :
\nERM supports value creation by enabling\u00a0management to:
\n\u2022 Deal effectively with potential future\u00a0events that create uncertainty.
\n\u2022 Respond in a manner that reduces\u00a0the likelihood of downside outcomes\u00a0and increases the upside.<\/p>\n

Enterprise Risk Management\u00a0\u2014 Integrated Framework:<\/p>\n

This COSO ERM framework defines\u00a0essential components, suggests a\u00a0common language, and provides clear\u00a0\u00a0direction and guidance for enterprise risk\u00a0management.<\/p>\n

The ERM Framework\u00a0Entity objectives can be viewed in the\u00a0context of four categories:\"The
\n\u2022 Strategic
\n\u2022 Operations
\n\u2022 Reporting
\n\u2022 Compliance<\/p>\n

The ERM Framework\u00a0ERM considers activities at all levels\u00a0of the organization:
\n\u2022 Enterprise-level
\n\u2022 Division or\u00a0subsidiary
\n\u2022 Business unit\u00a0processes<\/p>\n

Risk management is an activity best undertaken offensively, before disasters strike. When it is done\u00a0reactively,\u00a0<\/em>it can be too late. With the ever-increasing number of risks in business \u2013 from cyberattacks to global pandemics \u2013 it\u2019s essential that companies adopt a proactive approach to measuring and managing risks in all their forms, and in such an endeavor, the key people involved should be not the PR spokespeople and crisis managers but the management accountants. Thankfully, management accountants have a clear source of guidance on ERM in the form of\u00a0Committee of Sponsoring Organizations of the Treadway Commission\u2019s (COSO) Enterprise Risk Management Framework<\/u><\/a>. IMA is one of five co-sponsors of COSO, which was established to help increase fraud deterrence in organizations. I serve on the COSO Board as lead director.<\/p>\n

The\u00a0COSO framework<\/a>\u00a0was designed to give professionals and companies a detailed way of thinking about and acting on ERM that transcends the traditional approach to crisis management. Five components form the backbone of ERM:<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Governance and Culture<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Strategy and Objective Setting<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Performance<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Review and Revision<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Information, Communications and Reporting<\/p>\n

But for these to work, ERM must be linked directly to a company\u2019s overall strategy.<\/p>\n

A key part of that process is answering the following questions:<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Do you have documented crisis management plans in place?<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Do you create an environmental scan, including internal and external factors like natural disasters?<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Do you have types of risks identified and prioritized in your risk matrix?<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Do you regularly assess changes in your internal and external environment?<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Do you have a communications process for key stakeholders?<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Do you proactively discuss your comprehensive portfolio of risks?<\/p>\n

Discussing the answers to these questions openly is critical. Documenting roles and responsibilities that result is also paramount because it makes clear what is expected from employees and management. Every decision undertaken by key stakeholders is made with the long-term sustainability of the business in mind. This is imperative when crisis hits.<\/p>\n

Management accountants often have the clearest line of sight into a company\u2019s finances and supply chains, so they have the most responsibility when it comes to ERM. It is paramount management accountants understand their roles transcend traditional finance. They need to work cross-functionally, with IT, HR and sustainability departments, among others, to gauge non-financial risks across the organization. Factoring these risks into the bigger picture enables them to construct a holistic risk framework. This is the critical role management accountants play in moving ERM from reactive measures to proactive ones.<\/p>\n

\n

Process for Establishing an ERM Framework<\/h2>\n

1. Common language around risk<\/h3>\n

The risk management function (or equivalent) must establish and educate the organization on common terminology regarding risk. A common definition of risk is \u2013 the potential for loss, or the diminished opportunity for gain, which can obstruct the achievement of the firm\u2019s business objectives. Common terminology will facilitate communication across business units.<\/p>\n<\/div>\n

2. Risk management steering committee<\/h3>\n
\n

It is important to establish a senior management level committee to provide oversight of the implementation of the ERM Framework. In addition the committee will help delineate the roles and responsibilities within the Framework.<\/p>\n

3. Roles and responsibilities<\/h3>\n

Roles and responsibilities must be clearly defined and understood throughout the organization.<\/p>\n

    \n
  • Board of directors & CEO\u00a0<\/em>\u2013 have ultimate accountability for all risks. Risk management practices must be discussed periodically and risk management related policies must be reviewed and approved.<\/li>\n
  • Senior management\u00a0<\/em>\u2013 design, implement, and maintain an effective Framework. Develop policies and procedures, establish and monitor the risk appetite, and report regularly to the board of directors. Promote a risk-aware culture.<\/li>\n
  • Business units\u00a0<\/em>\u2013 identify, assess, measure, monitor, control, and report risks to senior management. Manage relevant risks within the framework established by senior management. Ensure compliance with policies and procedures.<\/li>\n
  • Support functions (i.e. Legal, HR, IT, etc)<\/em>\u00a0\u2013 provide support to business units in developing and enforcing policies and procedures.<\/li>\n
  • Internal Audit & Compliance<\/em>\u00a0\u2013 monitor and provide independent assurance of the effectiveness of the Framework.<\/li>\n
  • Risk management<\/em>\u00a0\u2013 coordinate the establishment of the Framework and provide risk management expertise.<\/li>\n<\/ul>\n

    4. ERM methodology<\/h3>\n

    Develop a methodology for the ERM Framework. This should include definitions of key risk terms, descriptions of roles and responsibilities, and clear procedures for risk identification, assessment, measurement, mitigating, monitoring, and reporting.<\/p>\n

    5. Risk appetite statements<\/h3>\n

    A formally written document that comprises all of the key business areas. The document should take into account the firm\u2019s strategic direction and objectives. It should clearly outline the firm\u2019s capacity to take risk and its tolerance for potential loss. In addition, a risk appetite must be regularly reviewed and approved by senior management and board of directors.<\/p>\n

    6. Risk identification<\/h3>\n

    This can be completed via risk control self-assessment (RCSA) approach; coordinated by risk management and conducted with subject-matter-experts. This method uses a risk taxonomy to identify applicable risks, inherent risk levels, quality of internal controls, and residual risk levels. The process consists of the following steps:<\/p>\n

      \n
    • Identify applicable risks and describe the business activity that exposes the business unit to the risk. This includes credit, market, liquidity, operational, event, and strategic risk.<\/li>\n
    • Establish the inherent risk level\u00a0(H, M, L)<\/em>\u00a0and typical annual damage. Inherent risk is anything that prevents the achievement of business objectives without consideration of internal controls. Typical annual damage, if applicable, can be estimated based on subjective judgment of the business unit with consideration to both past (actual losses) and potential future occurrences.<\/li>\n
    • Assess and rank the quality of internal controls\u00a0(H, M, L)<\/em>\u00a0and reason for the assessment. Internal controls mitigate the inherent risk and involve the implementation of policies, procedures and standards.<\/li>\n
    • Calculate the residual risk level\u00a0(H, M, L)<\/em>\u00a0which remains after taking into account relevant internal controls. For example, a Medium inherent risk and Low quality of internal controls will result in a High residual risk level.<\/li>\n<\/ul>\n

      Note:\u00a0H<\/strong>igh,\u00a0M<\/strong>edium,\u00a0L<\/strong>ow<\/em>\u00a0are popular scales in the financial services industry; however, other ranking scales may be used. Another method of identifying risks is to evaluate all processes within the firm and create a list of potential risk sources (known as Business Process Mapping). This step should be completed by the risk management department in conjunction with knowledgeable and well-seasoned employees of various departments within the firm. This method allows for open communication\/ discussion and can reveal individual risks, risk interdependencies, and areas of control or risk management weakness. Other techniques include, actuarial models, scenario analysis, external data collection, and comparative analysis.<\/p>\n

      7. Risk prioritization<\/h3>\n

      Using the results of the RCSA for each business unit, prioritize key risks based on the residual risk levels. Discuss all High residual risks with the risk management steering committee and set risk mitigation plans.<\/p>\n

      8. Risk mitigation plans (RMPs)<\/h3>\n

      RMPs must be established by taking a risk-based approach to address the areas with the greatest control weaknesses and largest potential for loss. Firms will generally run out of resources before they run out of risk therefore the High risk items must be given priority. Target completion dates and responsible owners must be selected to facilitate the risk mitigation process.<\/p>\n

      9. Risk monitoring and reporting<\/h3>\n

      Key risks that were identified must be monitored and periodically reported to senior management and board of directors. ERM BenefitsEstablishment of an ERM Framework is not a one-time exercise that only involves a few participants. It is an intensive, dynamic and continuous process that requires firm-wide participation. When implemented successfully ERM will produce many benefits to the organization. An effective ERM Framework will:<\/p>\n

        \n
      • Allow an organization to gain a clear picture of its overall exposure to risk<\/li>\n
      • Improve firm-wide understanding of risks and controls<\/li>\n
      • Reduce operational losses<\/li>\n
      • Improve the deployment of capital<\/li>\n
      • Align risk appetite and strategy (business objectives)<\/li>\n
      • Facilitate board and senior management oversight<\/li>\n
      • Breakdown silos between various departments and across all risks (promote transparency)<\/li>\n
      • Result in a more efficient use of resources<\/li>\n
      • Improve regulator, rating agency, and shareholder perception<\/li>\n
      • Enhance internal control<\/li>\n
      • Promote a culture of risk awareness<\/li>\n<\/ul>\n

        After considering the benefits of implementing an ERM Framework, it is surprising to see that only 36% of institutions participating in Deloitte\u2019s Sixth Global Risk Management Survey had an ERM program in place. Although 72% reported that the benefits of ERM outweigh the costs.<\/p>\n

        ERM challenges<\/h2>\n

        Enterprise risk management implementation is not considered an easy task. It requires organizational agreement\/cooperation and a strong senior management team. Although there are clear benefits to ERM, challenges also exist. By examining some of these challenges, organizations will be better prepared to establish their own enterprise risk management programs. Challenges that an organization might run into include:<\/p>\n

          \n
        • Defining a common risk language<\/li>\n
        • Demonstrating the benefits\/value of ERM (e.g. cultural issues)<\/li>\n
        • Establishing ownership for particular risks and responses<\/li>\n
        • Identifying risks and quantifying potential damage<\/li>\n
        • Prioritizing risks across the organization<\/li>\n
        • Developing RMPs to ensure the risks are appropriately managed<\/li>\n
        • Risk reporting- deciding what information should be shared and how<\/li>\n
        • Ensuring RMPs are carried out<\/li>\n
        • Formulating the risk appetite statements<\/li>\n
        • Lack of reliable data & insufficiency of technology (MIS)<\/li>\n<\/ul>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

          Any one of a variety of risks could threaten an organization\u2019s success and lead to a decrease in stakeholder value, including: globalization, technology, demands for customized products and services, shifts in regulation, mergers and restructurings, accounting and reporting deficiencies, and complex financial instruments. Leaders must be aware of a holistic approach to risk management and […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"set","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[17],"tags":[],"class_list":["post-2432","post","type-post","status-publish","format-standard","hentry","category-risk-management"],"_links":{"self":[{"href":"https:\/\/gmsisuccess.in\/index.php?rest_route=\/wp\/v2\/posts\/2432","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/gmsisuccess.in\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/gmsisuccess.in\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/gmsisuccess.in\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/gmsisuccess.in\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2432"}],"version-history":[{"count":2,"href":"https:\/\/gmsisuccess.in\/index.php?rest_route=\/wp\/v2\/posts\/2432\/revisions"}],"predecessor-version":[{"id":2439,"href":"https:\/\/gmsisuccess.in\/index.php?rest_route=\/wp\/v2\/posts\/2432\/revisions\/2439"}],"wp:attachment":[{"href":"https:\/\/gmsisuccess.in\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2432"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/gmsisuccess.in\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2432"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/gmsisuccess.in\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2432"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}