ERM - Enterprise Risk Management

Issues and Cases

Jean-Paul Louisot, Christopher H. Ketcham

• Publisher: Wiley
• Year: 2014
• ISBN:
  9781118539514
• Edition: 1
• Topic: Business
• Subtopic: Finance
• Index: Business

A wealth of international case studies illustrating current issues and emerging best practices in enterprise risk management

Despite enterprise risk management's relative newness as a recognized business discipline, the marketplace is replete with guides and references for ERM practitioners. Yet, until now, few case studies illustrating ERM in action have appeared in the literature. One reason for this is that, until recently, there were many disparate, even conflicting definitions of what, exactly ERM is and, more importantly, how organizations can use it to utmost advantage. With efforts underway, internationally, to mandate ERM and to standardize ERM standards and practices, the need has never been greater for an authoritative resource offering risk management professionals authoritative coverage of the full array of contemporary ERM issues and challenges. Written by two recognized international thought leaders in the field, ERM-Enterprise Risk Management provides that and much more.

• Packed with international cases studies illustrating ERM best practices applicable across all industry sectors and business models
• Explores contemporary issues, including quantitative and qualitative measures, as well as potential pitfalls and challenges facing today's enterprise risk managers
• Includes interviews with leading risk management theorists and practitioners, as well as risk managers from a variety of industries
• An indispensable working resource for risk management practitioners everywhere and a valuable reference for researchers, providing the latest empirical evidence and an exhaustive bibliography

Part 1
ERM Articles

These articles are organized according to the major steps in the risk management process as expressed in the ISO 31000 framework. The steps are:

• Establishing the internal and external contexts
• Risk assessment (including identification, analysis, and evaluation)
• Select appropriate risk management techniques; Implement appropriate risk management techniques
• Monitor results and revise
• Communicate and consult with all internal and external stakeholders

1
Establishing the Internal and External Contexts

Establishing context includes understanding why the organization is engaged in ERM, the need and scope of the ERM program, and how the organization defines ERM. Defining strategy is often the first step for the organization because all risk management is associated with critical risks to strategy.

1.1 MANAGING RISKS TO ENABLE STRATEGY

Jean-Paul Louisot

Université Paris 1 Panthéon-Sorbonne, Directeur pédagogique du CARM_Institute, Paris, France

Christopher Mandel

SVP, Strategic Solutions, Sedgwick, Inc., long term senior risk management practitioner/leader

1.1.1 The Origin of Modern Risk Management

Spectacular events occurred during the final decades of the twentieth century that fed the “fear of the millennium”. The first decade of the twenty-first century also fed fears, including alternating natural events or technological catastrophes, increasing terrorism, social upheavals like the “Arab Spring” that began in 2011, the Asian tsunami in 2004, and the typhoon in Japan in 2013. Traditional media, expanded by social media, did not miss an opportunity to blame the ravages of globalization, the brittleness of the world socio-economic system or to question its long-term sustainability. It is clear that the relationships between the different actors in the system are becoming more and more complex while their interdependencies are increasing. This is precisely the state of the system that might be explained by the tenets of chaos theory.

The last millennium came to a close with the resource-intensive campaign to prevent the anticipated damages of Y2K, the bug that was supposed to crash all computer activity on December 31, 1999. Apparently, to the general public at least, nothing serious occurred at midnight and some concluded, a little too quickly, that the threat was only a fabrication of IT consultants to ensure their business development for the previous three years. For risk management professionals Y2K was a vivid illustration of the fundamental paradox of the trade: the catastrophe was avoided thanks to heavy investments, and the success of the risk treatment avoided IT Armageddon! In France, it was ironic, however, that the Y2K crisis teams were activated when two exceptional storms, Martin and Luther, with winds close to 150 miles per hour hit the country right in the middle of the Christmas season in 1999. This is the main reason why the railway system, SNCF, and the electricity utility, EDF, were able to react promptly and save the day, and enhance their reputation.

The third millennium started with the fireworks of the September 11 terrorists attacks and ten days later by the AZF¹ complex explosion in Toulouse; a series of financial catastrophes, initiated as early as August 2001 with the Enron collapse; and natural events such as the tsunami in Southeast Asia at Christmas 2004, and more recently in the spring and summer of 2011 the tsunami in Japan and catastrophic floods in several countries. These events and others revealed dependencies, sometimes to unaware actors who suffered massive contingent business interruptions. The rise of aberrant situations brings about ruptures that leaders in the private as well as the public sectors must learn to address aggressively in order to avoid their degenerating into full-blown crises.

In such a context, it is all too clear that the traditional and static approach to managing risk, mainly organized around the purchase of insurance cover to protect physical assets, has become totally obsolete. We are well overdue in making room for a dynamic and global vision, integrating recently identified “black swan” type risks like the interconnected effects of global supply chain and terrorism. It is essential to encompass the world of threats and opportunities, not only from an inside out view formed at the board level, but enlightened by an outside in view reflecting the expectations and fears of all main stakeholders.

1.1.2 Strategic Risk Management?

The recently developed concept of strategic risk management can add value to the risk management process, provided it is interpreted as including the risk management disciplines of influencing, development and implementation of organization strategy, the ultimate responsibility for which rests with the board and the C-suite. The generic term used here, “organization”, refers to all types of enterprises, private, for-profit enterprises as well as NGOs, healthcare providers, local authorities, etc. But nations themselves have to organize their internal (police and judicial system) as well as external (national defense) security in an ever more complex and fluid environment, not to speak of their reputation in the light of the fight against corruption and money laundering. Political leaders should therefore regularly review their approach and engage in an iterative risk assessment and management approach.

However, both academics and practitioners of risk management are aware that managing uncertainties is contained within a comprehensive package of concepts, principles, framework and process, well summarized in the ISO 31000:2009 standard. Risk management implementation in any given field requires a specific understanding of internal and external contexts, all the more complex when the system is open. No organization functions effectively today as an autocratic entity but, nevertheless, hospitals (in national healthcare countries), local authorities and nations have more authority to consider, and possibly a longer time frame to take into account, in their decision making processes in other than crisis situations.

All that said, the emergence of the term strategic risk management as a “new discipline” is probably unnecessary. This new term attempts to emphasize risks to strategy, a more than appropriate emphasis. However, this emphasis is one that should not have been necessary, had risk managers risen to the challenges posed by the original expansion of the discipline, i.e. enterprise risk management (ERM). ERM was always intended to capture the strategic emphasis now highlighted by SRM, but many failed attempts at ERM missed this opportunity. There are many reasons why ERM has failed in many venues, but that aside, we didn't need to add another moniker to enable what has always been assumed as central to ERM strategy. However, we can take this opportunity to leverage the new labeling as a de facto rebranding or risk management/enterprise risk management, often useful to initiatives that have failed to get the traction necessary for long-term acceptance and success.

1.1.3 Ethics, Sustainable Development, and Governance (ESG)

It is only in the last three decades, after the fall of the former USSR destroyed the communist alternative to the “free” economy model, that courses in ethics started to appear in the curriculum of MBA programs in leading universities. Business ethics became part of public speeches of leaders, both political and industrial, and took different forms: “sustainable development” when it comes to environment issues; “governance” or “compliance” in connection with societal issues and transparency.

But are these leaders' intentions followed by actions? Ethics cannot remain a nice concept only, it must become an integral part of the management toolkit; in commercial entities of course, but even more so in public entities where there is growing public demand for integrity and transparency. There is ethics only in ethical behavior; this is why a better phrase would be “ethics in action”.

Obviously, if issues were black and white, most human beings would have a clear choice that would be obvious. But the set of values underlying an ethical behavior is in constant evolution, it changes through time and space. This notion of an active and progressive ethic implies that the decision makers must be ready at all times to question organizational objectives, and that managers and supervisors in the organization be willing to question themselves continuously in light of the set of fundamental values at issue.

In any decision process, ethics in action opposes the “could” and the “should”. It questions the basic definition and meaning at the heart of the approach of many consultants spec...

Table of contents

• Cover
• Series
• Titlepage
• Copyright
• Contributor List
• About the Editors
• Acknowledgements
• Introduction
• ISO 31000 and Guide 73: 2009 Select Terms and Their Definitions1
• PART 1 ERM ARTICLES
• PART II CASE STUDIES
• ERM References for Practitioners
• Further Reading
• Index
• End User License Agreement