View source for Enterprise risk management

{{Short description|Business methods and processes}}
'''Enterprise risk management''' ('''ERM''') in business includes the methods and processes used by organizations to manage risks and seize opportunities related to the achievement of their objectives.  ERM provides a framework for [[Risk management|risk management]], which typically involves identifying particular events or circumstances relevant to the organization's objectives (threats and opportunities), assessing them in terms of likelihood and magnitude of impact, determining a response strategy, and monitoring process.  By identifying and proactively addressing risks and opportunities, business enterprises protect and create value for their stakeholders, including owners, employees, customers, regulators, and society overall.

ERM can also be described as a risk-based approach to managing an enterprise, integrating concepts of internal control, the Sarbanes–Oxley Act, [[General Data Protection Regulation|data protection]] and [[Social:Strategic planning|strategic planning]].  ERM is evolving to address the needs of various stakeholders, who want to understand the broad spectrum of risks facing complex organizations to ensure they are appropriately managed.  Regulators and debt rating agencies have increased their scrutiny on the risk management processes of companies.

According to Thomas Stanton of Johns Hopkins University, the point of enterprise risk management is not to create more bureaucracy, but to facilitate discussion on what the really big risks are.<ref>{{cite web|last1=Thomas Stanton|title=Enterprise Risk Management|url=https://www.youtube.com/watch?v=voGyHN-tWMg|website=YouTube|publisher=TEDxJHUDC|date=Feb 18, 2017|quote=The whole point of enterprise risk management is not to create another layer of bureaucracy, but rather to have your chief risk officer facilitate the conversations and then the discussions about priorities – what are the really big risks we’ve got to grapple with.}}</ref>

==ERM frameworks defined==
There are various important ERM frameworks, each of which describes an approach for identifying, analyzing, responding to, and monitoring risks and opportunities, within the internal and external environment facing the enterprise.  Management selects a ''risk response strategy'' for specific risks identified and analyzed, which may include:

#Avoidance: exiting the activities giving rise to risk
#Reduction: taking action to reduce the likelihood or impact related to the risk
#Alternative Actions: deciding and considering other feasible steps to minimize risks 
#Share or Insure: transferring or sharing a portion of the risk, to finance it
#Accept: no action is taken, due to a cost/benefit decision

Monitoring is typically performed by management as part of its internal control activities, such as review of analytical reports or management committee meetings with relevant experts, to understand how the risk response strategy is working and whether the objectives are being achieved.

===Casualty Actuarial Society framework===
In 2003, the Casualty Actuarial Society (CAS) defined ERM as the discipline by which an organization in any industry assesses, controls, exploits, finances, and monitors risks from all sources for the purpose of increasing the organization's short- and long-term value to its stakeholders."<ref name = "CASOverview2003-8">{{cite journal
| author         = Enterprise Risk Management Committee
| title          = Overview of Enterprise Risk Management
| publisher      = Casualty Actuarial Society
| date           = May 2003
| url            = http://www.casact.org/research/erm/overview.pdf
| pages          = 8
| access-date     = 2008-09-15
}}
</ref> The CAS conceptualized ERM as proceeding across the two dimensions of ''risk type'' and ''risk management processes.''<ref name = "CASOverview2003-8" /> The risk types and examples include:<ref name = "CASOverview2003-9-10">{{cite journal
| author         = Enterprise Risk Management Committee
| title          = Overview of Enterprise Risk Management
| publisher      = Casualty Actuarial Society
| date           = May 2003
| url            = http://www.casact.org/research/erm/overview.pdf
| pages          = 9–10
| access-date     = 2008-09-15
}}
</ref>
;Hazard risk: Liability torts, Property damage, Natural catastrophe
;Financial risk: Pricing risk, Asset risk, Currency risk, Liquidity risk
;Operational risk: Customer satisfaction, Product failure, Integrity, Reputational risk; Internal Poaching; Knowledge drain
;Strategic risks: Competition, Social trend, Capital availability

The risk management process involves:<ref name = "CASOverview2003-911-13">{{cite journal
| author         = Enterprise Risk Management Committee
| title          = Overview of Enterprise Risk Management
| publisher      = Casualty Actuarial Society
| date           = May 2003
| url            = http://www.casact.org/research/erm/overview.pdf
| pages          = 11–13
| access-date     = 2008-09-15
}}
</ref>
#'''Establishing Context:''' This includes an understanding of the current conditions in which the organization operates on an internal, external and risk management context.
#'''Identifying Risks:''' This includes the documentation of the material threats to the organization's achievement of its objectives and the representation of areas that the organization may exploit for competitive advantage.
#'''Analyzing/Quantifying Risks:''' This includes the calibration and, if possible, creation of probability distributions of outcomes for each material risk.
#'''Integrating Risks:''' This includes the aggregation of all risk distributions, reflecting correlations and portfolio effects, and the formulation of the results in terms of impact on the organization's key performance metrics.
#'''Assessing/Prioritizing Risks:''' This includes the determination of the contribution of each risk to the aggregate risk profile, and appropriate prioritization.
#'''Treating/Exploiting Risks:''' This includes the development of strategies for controlling and exploiting the various risks.
#'''Monitoring and Reviewing:''' This includes the continual measurement and monitoring of the risk environment and the performance of the risk management strategies.

===COSO ERM framework===
The COSO "Enterprise Risk Management-Integrated Framework" published in 2004 (New edition COSO ERM 2017 is not Mentioned and the 2004 version is outdated) defines ERM as a "…process, effected by an entity's board of directors, management, and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its [[Risk appetite|risk appetite]], to provide reasonable assurance regarding the achievement of entity objectives."<ref name = "COSO Summary">{{cite journal
| title          = Enterprise Risk Management — Integrated Framework: Executive Summary
| publisher      = Committee of Sponsoring Organizations of the Treadway Commission
| date           = September 2004
| url            = http://www.coso.org/Publications/ERM/COSO_ERM_ExecutiveSummary.pdf
| access-date     = 2008-09-16
}}
</ref>

The COSO ERM Framework has eight components and four objectives categories.  It is an expansion of the COSO Internal Control-Integrated Framework published in 1992 and amended in 1994. The eight components are:

* Internal Environment
* Objective Setting
* Event Identification
* Risk Assessment
* Risk Response
* Control Activities
* Information and Communication
* Monitoring

The four objectives categories - additional components highlighted - are:
* '''Strategy''' - high-level goals, aligned with and supporting the organization's mission
* '''Operations''' - effective and efficient use of resources
* '''Financial Reporting''' - reliability of operational and financial reporting
* '''Compliance''' - compliance with applicable laws and regulations

===ISO 31000: the new International Risk Management Standard===
[[ISO 31000]] is an International Standard for Risk Management which was published on 13 November 2009, and updated in 2018. An accompanying standard, ISO 31010 - Risk Assessment Techniques, soon followed publication (December 1, 2009) together with the updated Risk Management vocabulary ISO Guide 73. The standard set out eight principles based around the central purpose, which is the creation and protection of value.<ref>{{Cite book |last=Hopkin |first=Paul |url=https://www.worldcat.org/oclc/1300754988 |title=Fundamentals of risk management : understanding, evaluating and implementing effective enterprise risk management |date=2022 |others=Clive Thompson |isbn=978-1-3986-0286-1 |edition=6th |location=London |oclc=1300754988}}</ref>

==Implementing an ERM program==

===Goals of an ERM program===
Organizations by nature manage risks and have a variety of existing departments or functions ("risk functions") that identify and manage particular risks.  However, each risk function varies in capability and how it coordinates with other risk functions.  A central goal and challenge of ERM is improving this capability and coordination, while integrating the output to provide a unified picture of risk for stakeholders and improving the organization's ability to manage the risks effectively.

===Typical risk functions===
The primary risk functions in large corporations that may participate in an ERM program typically include:

* Strategic planning - identifies external threats and competitive opportunities, along with strategic initiatives to address them 
* Marketing - understands the target customer to ensure product/service alignment with customer requirements
* Compliance & Ethics - monitors compliance with code of conduct and directs fraud investigations
* Accounting / Financial compliance - directs the Sarbanes–Oxley Section 302 and 404 assessment, which identifies financial reporting risks
* Law Department - manages litigation and analyzes emerging legal trends that may impact the organization
* Insurance - ensures the proper insurance coverage for the organization
* Treasury - ensures cash is sufficient to meet business needs, while managing risk related to commodity pricing or foreign exchange
* Operational Quality Assurance - verifies operational output is within tolerances
* Operations management - ensures the business runs day-to-day and that related barriers are surfaced for resolution
* Credit - ensures any credit provided to customers is appropriate to their ability to pay
* Customer service - ensures customer complaints are handled promptly and root causes are reported to operations for resolution
* Internal audit - evaluates the effectiveness of each of the above risk functions and recommends improvements
* Corporate Security - identifies, evaluates, and mitigates risks posed by physical and information security threats

===Common challenges in ERM implementation===
Various consulting firms offer suggestions for how to implement an ERM program.<ref>[http://www.protiviti.it/downloads/PRO/pro-gb/ProtivitiBulletin6.pdf ERM Implementation Advice]</ref>  Common topics and challenges include:<ref>[http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/WhitePapersArticlesGuidetoEnterpriseRiskManagementFrequentlyAskedQuestions!OpenDocument ERM Frequently Asked Questions]</ref>

* Identifying executive sponsors for ERM.
* Establishing a common risk language or glossary.
* Describing the entity's [[Risk appetite|risk appetite]] (i.e., risks it will and will not take)
* Identifying and describing the risks in a "risk inventory".
* Implementing a risk-ranking methodology to prioritize risks within and across functions.
* Establishing a risk committee and or Chief Risk Officer (CRO) to coordinate certain activities of the risk functions.
* Establishing ownership for particular risks and responses.
* Demonstrating the cost-benefit of the risk management effort.
* Developing action plans to ensure the risks are appropriately managed.
* Developing consolidated reporting for various stakeholders.
* Monitoring the results of actions taken to mitigate risk.
* Ensuring efficient risk coverage by internal auditors, consulting teams, and other evaluating entities.
* Developing a technical ERM framework that enables secure participation by 3rd parties and remote employees.

===Internal audit role===
{{Accounting}}
In addition to information technology audit, internal auditors play an important role in evaluating the risk-management processes of an organization and advocating their continued improvement.  However, to preserve its organizational independence and objective judgment, Internal Audit professional standards indicate the function should not take any direct responsibility for making risk management decisions for the enterprise or managing the risk-management function.<ref>[http://www.theiia.org/download.cfm?file=283 Role of Internal Auditing in ERM] {{webarchive|url=https://web.archive.org/web/20130905225145/http://www.theiia.org/download.cfm?file=283 |date=2013-09-05 }}</ref>

Internal auditors typically perform an annual risk assessment of the enterprise, to develop a plan of audit engagements for the upcoming year.  This plan is updated at various frequencies in practice.  This typically involves review of the various risk assessments performed by the enterprise (e.g., strategic plans, competitive benchmarking, and SOX 404 top-down risk assessment), consideration of prior audits, and interviews with a variety of senior management.  It is designed for identifying audit projects, not to identify, prioritize, and manage risks directly for the enterprise.

==Current issues in ERM==
The risk management processes of corporations worldwide are under increasing regulatory and private scrutiny. Risk is an essential part of any business. Properly managed, it drives growth and opportunity. Executives struggle with business pressures that may be partly or completely beyond their immediate control, such as distressed financial markets; mergers, acquisitions and restructurings; disruptive technology change; geopolitical instabilities; and the rising price of energy.

===Sarbanes–Oxley Act requirements===
Section 404 of the Sarbanes–Oxley Act of 2002 required U.S. publicly traded corporations to utilize a control framework in their internal control assessments. Many opted for the COSO Internal Control Framework, which includes a risk assessment element.    In addition, new guidance issued by the Securities and Exchange Commission (SEC) and [[Organization:Public Company Accounting Oversight Board|Public Company Accounting Oversight Board]] in 2007 placed increasing scrutiny on top-down risk assessment and included a specific requirement to perform a [[Finance:Fraud|fraud]] risk assessment.<ref>[http://www.pcaob.org/Rules/Docket_021/2007-05-24_Release_No_2007-005.pdf PCAOB Auditing Standard No 5] {{webarchive|url=https://web.archive.org/web/20070627001642/http://www.pcaob.org/Rules/Docket_021/2007-05-24_Release_No_2007-005.pdf |date=2007-06-27 }}</ref>  Fraud risk assessments typically involve identifying scenarios of potential (or experienced) fraud, related exposure to the organization, related controls, and any action taken as a result.

===NYSE corporate governance rules===

The [[Company:New York Stock Exchange|New York Stock Exchange]] requires the Audit Committees of its listed companies to "discuss policies with respect to [[Risk assessment|risk assessment]] and [[Risk management|risk management]]."  The related commentary continues: "While it is the job of the CEO and senior management to assess and manage the company’s exposure to risk, the audit committee must discuss guidelines and policies to govern the process by which this is handled. The audit committee should discuss the company’s major financial risk exposures and the steps management has taken to monitor and control such exposures. The audit committee is not required to be the sole body responsible for risk assessment and management, but, as stated above, the committee must discuss guidelines and policies to govern the process by which risk assessment and management is undertaken. Many companies, particularly financial companies, manage and assess their risk through mechanisms other than the audit committee. The processes these companies have in place should be reviewed in a general manner by the audit committee, but they need not be replaced by the audit committee."<ref>{{Cite web |url=https://www.nyse.com/pdfs/finalcorpgovrules.pdf |title=NYSE Listing Standards Part 7d |access-date=2017-08-27 |archive-url=https://web.archive.org/web/20140611083439/http://www.nyse.com/pdfs/finalcorpgovrules.pdf |archive-date=2014-06-11 |url-status=dead }}</ref>

===ERM and corporate debt ratings===

Standard & Poor's (S&P), the debt rating agency, plans to include a series of questions about risk management in its company evaluation process.  This will rollout to financial companies in 2007.<ref>[http://www.treasuryandrisk.com/article-print.php?article=714 S&P Ratings - Treasury & Risk Article] {{webarchive|url=https://web.archive.org/web/20070928191041/http://www.treasuryandrisk.com/article-print.php?article=714 |date=2007-09-28 }}</ref>  The results of this inquiry is one of the many factors considered in debt rating, which has a corresponding impact on the interest rates lenders charge companies for loans or bonds.<ref>[http://www.mgt.ncsu.edu/pdfs/erm/sp_erm_busdevbk.pdf S&P ERM for Financial Institutions]</ref> On May 7, 2008, S&P also announced that it would begin including an ERM assessment in its ratings for non-financial companies starting in 2009,<ref>[http://www.towersperrin.com/tp/getwebcachedoc?webc=HRS/USA/2008/200806/ERM_NonFinanFAQ.pdf S&P ERM FAQs]</ref> with initial comments in its reports during Q4 2008.<ref>[http://www.towersperrin.com/tp/getwebcachedoc?webc=HRS/USA/2008/200805/ERM4Corp.pdf S&P ERM Announcement]</ref>

===IFC Performance Standards===

International Finance Corporation Performance Standards<ref>{{Cite web|url=http://www.ifc.org/wps/wcm/connect/topics_ext_content/ifc_external_corporate_site/sustainability-at-ifc/policies-standards/performance-standards/ps1|title = Performance Standard 1}}</ref> focus on the management of Health, Safety, Environmental and Social risks and impacts. The third edition was published on January 1, 2012 after a two-year negotiation process with the private sector, governments and civil society organizations. They have been adopted by the [http://www.equator-principles.com/ Equator Principles] Banks, a consortium of over 118 commercial banks in 37 countries.

===Data Privacy===
Data privacy rules, such as the [[Social:European Union|European Union]]'s [[General Data Protection Regulation]], increasingly foresee significant penalties for failure to maintain adequate protection of individuals' personal data such as names, e-mail addresses and personal financial information, or alert affected individuals when data privacy is breached. The EU regulation requires any organization--including organizations located outside the EU--to appoint a Data Protection Officer reporting to the highest management level<ref>{{Cite web|url=https://www.ferma.eu/ferma-eciia-cyber-risk-governance-report-0|title=FERMA ECIIA Cyber Risk Governance Report {{!}} Ferma|website=www.ferma.eu|language=en|access-date=2018-10-01}}</ref> if they handle the personal data of anyone living in the EU.

==Actuarial response==

===Casualty Actuarial Society===
In 2003, the Enterprise Risk Management Committee of the Casualty Actuarial Society (CAS) issued its overview of ERM.<ref name = "CASOverview2003">{{cite journal
| author         = Enterprise Risk Management Committee
| title          = Overview of Enterprise Risk Management
| publisher      = Casualty Actuarial Society
| date           = May 2003
| url            = https://www.casact.org/area/erm/overview.pdf
| access-date     = 2008-09-15
}}
</ref> This paper laid out the evolution, rationale, definitions, and frameworks for ERM from the casualty actuarial perspective, and also included a vocabulary, conceptual and technical foundations, actual practice and applications, and case studies.<ref name = "CASOverview2003" />

The CAS has specific stated ERM goals, including being "a leading supplier internationally of educational materials relating to Enterprise Risk Management (ERM) in the property casualty insurance arena,"<ref name = "CASgoal">{{cite web
 | url = http://www.casact.org/about/ERM_SAMs.pdf
 | title = ERM SAM Goals
 | access-date = 2008-09-15
 |date=March 2008 
 | work = CAS Centennial Goal and SAM Goals
 | publisher = Casualty Actuarial Society
}}
</ref> and has sponsored research, development, and training of casualty actuaries in that regard.<ref name = "CASERMPage">{{cite web
 | url = http://www.casact.org/research/erm/
 | title = Enterprise Risk Management Web Site
 | access-date = 2008-09-15
 | year = 2008
 | publisher = Casualty Actuarial Society
}}
</ref> The CAS has refrained from issuing its own credential; instead, in 2007, the CAS Board decided that the CAS should participate in the initiative to develop a global ERM designation, and make a final decision at some later date.<ref name="CASCred">{{cite web
 |url         = http://www.casact.org/about/governance/bod/061707ES.pdf
 |title       = Executive Summary: CAS Board of Directors Meeting
 |access-date  = 2008-09-15
 |date        = June 17, 2007
 |publisher   = Casualty Actuarial Society
 |url-status     = dead
 |archive-url  = https://web.archive.org/web/20100627193942/http://www.casact.org/about/governance/bod/061707ES.pdf
 |archive-date = June 27, 2010
}}
</ref>

===Society of Actuaries===
In 2007, the Society of Actuaries developed the Chartered Enterprise Risk Analyst (CERA) credential in response to the growing field of enterprise risk management.<ref name = "CERA1">{{cite web
 | url = http://www.ceranalyst.org/overview.asp
 | title = Credential Overview
 | access-date = 2008-09-15
 | year = 2008
 | publisher = Society of Actuaries
}}
</ref> This is the first new professional credential to be introduced by the SOA since 1949.<ref name = "CERA2">{{cite web
 | url = http://www.ceranalyst.org/cera-facts-overview.asp
 | title = CERA Fast Facts
 | access-date = 2008-09-15
 | year = 2008
 | publisher = Society of Actuaries
}}
</ref> A CERA studies to focus on how various risks, including operational, investment, strategic, and reputational combine to affect organizations. CERAs work in environments beyond insurance, reinsurance and the consulting markets, including  broader financial services, energy, transportation, media, technology, manufacturing and healthcare.<ref name = "CERA2" />

It takes approximately three to four years to complete the CERA curriculum which combines basic actuarial science, ERM principles and a course on professionalism. To earn the CERA credential, candidates must take five exams, fulfill an educational experience requirement, complete one online course, and attend one in-person course on professionalism.<ref name = "CERA2" />

===CERA Global===
Initially all CERAs were members of the Society of Actuaries<ref name = "CERA3">{{cite web
 | url = http://www.ceranalyst.org/benefits.asp
 | title = Benefits
 | access-date = 2008-09-15
 | year = 2008
 | publisher = Society of Actuaries
}}
</ref> but in 2009 the CERA designation became a global specialized professional credential, awarded and regulated by multiple actuarial bodies;<ref name = "CERA4">{{cite web
 | url = http://www.ceraglobal.org/about/treaty
 | title = The CERA Treaty
 | access-date = 2015-01-12
 | year = 2009
 | publisher = CERA Global
 | archive-url = https://web.archive.org/web/20150112142729/http://www.ceraglobal.org/about/treaty
 | archive-date = 2015-01-12
 | url-status = dead
 }}</ref>
for example [[Finance:Chartered Enterprise Risk Actuary|Chartered Enterprise Risk Actuary]] from the Institute and Faculty of Actuaries.

==See also==
{{Div col|colwidth=22em}}
* [[Actuarial science]]
* [[Airmic]]
* [[Finance:Basel III|Basel III]]
* Benefit risk
* Committee of Sponsoring Organizations of the Treadway Commission
* Cost risk
* [[Credit risk]]
* {{slink|Financial risk management#Corporate finance}}
* Information Quality Management
* [[ISO 31000]]
* [[Social:SWOT analysis|Market risk and strategic planning]]
* [[Finance:Operational risk management|Operational risk management]]
* [[Philosophy:Optimism bias|Optimism bias]]
* Risk adjusted return on capital
* [[Risk appetite]]
* [[Finance:Risk management tools|Risk management tools]]
* [[Organization:RiskLab|RiskLab]]
* [[ISA 400 Risk Assessments and Internal Control]]
* SOX 404 top-down risk assessment
* [[Finance:Three lines of defence|Three lines of defence]]
* Total Security Management
* Web Presence Management
* [[Gordon–Loeb model]] for cyber security investments
* Certifications:
** [[Finance:Certified Risk Professional|Certified Risk Professional]] ([[Organization:Institute of Risk Management|Institute of Risk Management]])
** Chartered Enterprise Risk Actuary (Institute and Faculty of Actuaries) 
** [[Chartered Enterprise Risk Analyst]] (Society of Actuaries)
{{div col end}}

==References==
{{Reflist|2}}

==External links==
*{{cite web|last1=Thomas Stanton|title=Enterprise Risk Management|url=https://www.youtube.com/watch?v=voGyHN-tWMg|website=YouTube|publisher=TEDxJHUDC|date=Feb 18, 2017}}
*[https://web.archive.org/web/20100705072108/http://www.theirm.org/documents/SARM_FINAL.pdf Airmic / Alarm / IRM (2010) "A structured approach to Enterprise Risk Management (ERM) and the requirements of ISO 31000"]
*Hopkin, Paul "Fundamentals of Risk Management 2nd Edition" Kogan-Page (2012) {{ISBN|978-0-7494-6539-1}}


{{DEFAULTSORT:Enterprise Risk Management}}
[[Category:Actuarial science]]

{{Sourceattribution|Enterprise risk management}}