The Executive Guide to Enterprise Risk Management

Linking Strategy, Risk and Value Creation

C. Chappell

• Publisher: Palgrave Macmillan
• Year: 2013
• ISBN:
  9781137374547
• Topic: Business
• Subtopic: Corporate Finance
• Index: Business

An executive level guide to implementing or extending an enterprise risk management (ERM) framework in an organization. Avoiding complex modeling topics, and unnecessary theory, this book cuts to the heart of the topic, describing what ERM is, why it is important, what constitutes ERM and how it can be implemented to add value to an organization.

1

Introduction

For years, the desire for enterprise risk management (ERM) frameworks has been driven by regulatory demands and companies seeking stronger credit ratings to ensure that capital can be raised more cheaply. Acquiring a budget for such developments is easiest when driven by a regulatory demand. However, this can make it more difficult to achieve buy-in and a belief in the benefits of such a framework when attempting to embed it in the business. Simplistically, the value to the business is achieved by answering the question ‘What’s in it for me?’

For most companies, the challenge remains as to how to stop ERM frameworks from becoming white elephants.

Publications outline the major benefits of an ERM framework, including improved business performance resulting from a clearer view of which activities add value, and greater transparency around the rationale for making the decision to take on certain risks. Why is this different from the past?

For a period up to the 1990s, some companies had used accounting techniques to control the volatility of their earnings. Management relied on the ‘good times’ (times of making premium returns on risks) to provide the return to restore the margins held to manage future fluctuations. In the current business environment, these practices are no longer acceptable. Economically, this is not sustainable in the longer term as it suggests risks are not being understood properly or managed. ERM helps management understand its risks and provides a framework to ensure they can be managed or mitigated. The old adage of ‘know your business’ is now more true than ever – at its core, knowing your business is about knowing what the risks are, why you are taking them and how they are mitigated.

The vision for ERM is that it enables the business to grow shareholder value through making smart risk-return-based decisions.

This means

–optimising the risk-return opportunities, allocating capital appropriately to support initiatives that grow the business and identify, reduce or balance the amount of capital-backing areas from which insufficient benefit is being achieved;

–developing a charge for products and services in a way that reflects the risks being taken;

–being able to ask the questions that should be asked to understand the uncertainties that exist within opportunities, such that the Board can make fully informed and balanced decisions – a ‘no surprises’ culture.

Running a successful business is about pursuing the right business strategy based on the opportunities that exist given the company’s financial and managerial capabilities. ERM ensures the business has the right information, available at the right time to identify and assess opportunities and make decisions with an explicit understanding of the key issues.

In turn, this gives rise to increased organisational effectiveness as a result of the business having the right information available to make decisions such that opportunities can be entered and exited in a timely manner to optimise the return. This capability will enhance the company’s reputation across many stakeholders, including regulators and rating agencies, by evidencing the executive is skilled enough to manage the uncertainties, demonstrably reducing the likelihood of insolvency directly or indirectly. This is what leads to improved access to capital markets over the long term, with reduced costs of financing, as it is clear that you ‘know your business’.

This book examines four questions to be addressed when seeking to create a successful ERM framework:

1.How can I utilise the risk management tools to help me optimise my strategy?

2.How does risk appetite help me meet my performance objectives and help me assess risk-return optimisation and allocate capital efficiently and effectively?

3.How can I challenge the experts to test whether my information is robust?

4.How do I develop a culture that will support the traits of people in great companies – courage, humility, self-control and passion?

2

Defining Enterprise Risk Management

This chapter seeks to define risk and enterprise risk management (ERM). In particular, it will provide an executive’s view of the purpose of an ERM framework.

Since the inception of ERM, a lot of time, effort and financial resources have been dedicated to the enhancement of companies’ ability to manage risk. Within the phrase ‘enterprise risk management’, the use of the term ‘risk’ is now rather misleading as it has evolved over the same period from a word that related to the ability to apply internal controls to a word used to cover how a business is managed strategically. This has led to a lot of confusion and debate about what ERM is and how it interacts with other aspects of managing a business.

The term ‘risk’ is more usefully articulated as the ‘uncertainty of outcome, good or bad’.

Some observers define risk as the quantifiable element, and ‘uncertainty’ as the non-quantifiable dimension. However, we find this difficult as all aspects of what we do involve making some form of judgment about the implications of events based on available information. Not all that information is directly relevant, and those judgments themselves may not be borne out in practice. Hence, the line between risk and uncertainty being quantifiable and non-quantifiable may only exist in the minds of those who live in the mathematical ‘modelled world’, rather than those who operate in the ‘real world’.

The following framing of ERM may add to the growing list of definitions:

Enterprise risk management is a framework that supports the way in which a company runs its business, and that defines its approach to assessing and managing the uncertainty of the outcome of its plan consistently with how it manages its capital and value creation activities.

An alternate approach to defining ERM is through the eyes of a chief executive officer (CEO) as he or she meets the Board to position the strategy and how it will be delivered:

‘As CEO, I am aiming to deliver the business plan, which encapsulates our vision for the organisation over the coming years. I want to make sure the plan is delivered in a manner that is within the boundaries we established as “our way of getting things done around here”, and that manages the dynamic tensions between the various stakeholder groups.

The plan outlines the uncertainties and volatility that we face over the planning horizon, the sorts of issues that might emerge to prevent us from achieving the plan, and what we believe we can do to keep things on track should these arise.

As an executive team, we are fully aware that events may occur that give rise to new opportunities, and we have a framework that helps us, on an ongoing basis, identify these opportunities, determine the implications of taking them and understand how we can go about harnessing them.

As the plan is broken down into bite-sized segments, such as the budget and forecast for the coming year, I have outlined how we make sure that information of sufficient quality is delivered in a timely manner in order for us to assess what is happening and whether we need to take action in full knowledge of all the relevant facts. This includes the systems and tools that underpin getting the right information to the decision-makers at the right time and in a way that can help them make those decisions.

To make this process operate efficiently and effectively, my management team needs to have the appropriately delegated authority to take action on a day-to-day basis so that they can manage the delivery of their components of the plan. To avoid confusion and angst about what we do within the business, the Board needs to clarify where the authority that has been delegated starts and ends, to ensure that when an event occurs that is significant, others have been engaged appropriately, or if it is sufficiently material, the Board has been engaged.

In order to ensure that the Board feels comfortable delegating this authority to the executive team, we have ensured that the executive team

–has an appropriate skill set and expertise to deliver their responsibilities within these delegated authorities,

–knows how to behave appropriately when faced with decisions or the need to communicate information, and

–are remunerated in a way that encourages the right sort of behaviour and actions.

Having agreed upon this framework, we will cascade this down and through the organisation in a consistent manner, communicating the link between the strategy and employees’ operational limits and performance objectives so that people are not working in silos and know how what they do impacts the delivery of the plan for the whole organisation’.

This is a top-down view of ERM, which concerns how a company goes about doing things. The advantage of adopting this approach is that it highlights the key value-adding areas, which is useful when trying to build a business case for a Board to assist them to understand what benefit they will obtain for the investment in time and money.

It is also essential to separate ERM from the historic role of risk functions, as it is now evolving to include more about seeing risk management as the identification of strategic opportunities rather than purely a process for monitoring internal controls.

The driver for evolution is that people invest in companies for them to take risks in order to earn a return. Where there is risk, there is opportunity to make a return – the decision is whether that is a risk-return trade-off that the company wants to take.

Figure 2.1   A business operating model

Figure 2.1 outlines the holistic ERM framework, shaping and informing the business strategy and operating through the key processes that deliver the results throughout the year – effectively the Business Operating Model. Additionally, if one can imagine the information flows between these components, it is possible to develop a report that includes these aspects, which under Solvency 2, the new European regulatory framework, would be known as an Own Risk and Solvency Assessment.

The ERM framework in Figure 2.1 illustrates how risk management is integral to the development of the strategic plan and facilitates an understanding of which risks are producing an optimal profile of returns and how capital can be allocated effectively to make this happen. Achieving this is as much about the capabilities to understand the risks we choose to take and the reasons why we did not take others.

The ERM framework illustrates how decision-making needs to be supported by the infrastructure and models capable of delivering accurate information in a timely manner, with management in full knowledge of the shortcomings of the models so that they can apply their judgment effectively.

The delegation of authority exists to help us respond operationally to day-to-day fluctuations and issues efficiently and effectively, escalating for approval when events and situations are more extreme.

Those to whom authority has been delegated need to act as behavioural role models, as others will be watching them for clues to the appropriate way to react, respond and manage issues when they arise.

3

Developing a Business Strategy

This chapter provides coverage of the various dimensions of a business strategy (i.e. the profit strategy, the risk strategy and the capital strategy) and how executives can question proposals to gain insight into the challenges facing its delivery. In particular, it will outline:

–how to shape a profit strategy,

–how to develop a risk strategy,

–the purpose of a capital strategy,

–the difference between solvency and capital management.

The purpose of a business strategy

The key question is: what is the difference between business planning and business strategy?

The core to a business strategy is developing the ‘competitive advantage’ or determining ‘what makes us different from others’. Without the threat from competition, there would be little need for a strategy, as the company could just plan how it would continue over the coming years without any need to differentiate itself. Thus, the...

Table of contents

• Cover
• Title
• 1 Introduction
• 2 Defining Enterprise Risk Management
• 3 Developing a Business Strategy
• 4 Performance Measurement
• 5 Stress and Scenario Testing
• 6 Operationalising the Management of Solvency and Capital
• 7 Risk and Capital Modelling
• 8 Structuring the Use of Risk Information
• 9 Risk Culture
• 10 The Board and the New Chief Risk Officer
• Appendices
• Notes
• Index