AFERM EXPERTS SAY...

One way to generate more active involvement in Enterprise Risk Management (ERM) is to make sure your stakeholders truly have “skin in the game.”  As in any human activity, people get involved and stay involved with ERM efforts and practices when they can see personal benefit from the involvement.

People generally perceive benefit in two ways.  Some will only see benefit in saving their skins, and such individuals tend to concentrate on threats.  Others will see benefit in improving their game and will tend to focus on opportunities.  It has been my experience that people with an opportunistic mindset tend to be more engaged than people focused on self-preservation; however, either set of individuals will have personal reasons for being involved and active.

Now, it turns out the amount of skin anyone in the enterprise may have depends on their role in the game.  The enterprise defines those roles, either directly and specifically or not, by how enterprise goals and objectives translate to individual strategies and plans.  The enterprise also defines how the individuals play the game by the culture it creates and nurtures.  A culture that promotes continual improvement, encourages taking appropriate risks, and exercises appropriate accountability and rewards innovation will foster opportunistic thinking.  A culture that focuses on maintaining the status quo, on punishing failure, on protection rather than promotion, and does not have clearly defined goals and objectives will foster risk intolerance.

Where does the risk management come in?  Remember, the reason for risk management, whether practiced at the enterprise or individual level, is to improve the likelihood of successfully meeting or exceeding our goals and objectives.  When an enterprise’s goals, objectives, strategies, and plans are translated to individual stakeholders and they accept their role, they will have something to lose and will embrace risk management practices.

To build a more effective ERM community, consider the following:

• At the top, clearly define enterprise goals and objectives with strategies and plans to achieve those goals
• Actively and regularly scrutinize the enterprise’s goals, objectives, strategies, and plans for the purpose of making them better
• Delegate the strategies and plans to the stakeholders and make it clear that the enterprise expects them to adapt their delegated strategies and plans into supporting plans of their own
• Promote a culture that encourages people to identify and spend more resources on opportunities and fewer resources on threats.

Question asked by Anonymous

AFERM EXPERTS SAY...

It is important to establish a common definition of risk culture.  The Risk Management Society (RMA) defines risk culture as “the set of encouraged and acceptable behaviors, discussions, decisions and attitudes towards taking and managing risk within an institution.”  In my opinion, this definition appropriately focuses on attitudes and behaviors as the driving force behind organizational culture because it is ultimately the people, and not the processes and procedures, that determine ERM program success.  A useful model to think about with respect to promoting culture is the Attitude-Behavior-Culture (A-B-C) model where culture derives from repeated behaviors, behavior is influenced by attitude, and attitude is influenced by culture.  (Hillson, 2013) https://www.pmi.org/learning/library/understanding-risk-culture-management-5922

Culture change efforts can focus on shaping attitudes and reinforcing the desired behaviors associated with the desired risk culture.  Considering strategies in relation to the A-B-C model, knowledge and understanding are key to shaping attitude.  There are several approaches that an agency can consider, including frequent communications, specific training on the ERM program, using ERM as a common thread woven throughout agency-provided training, and providing other learning forums.  Strategies to address the behavior component could include setting expectations and reinforcing the desired risk management behaviors.  Creating clearly defined risk appetite statements for employees allows them to apply the statements to the decisions they make within their assigned responsibilities.  Adding a risk management core competency or performance goal to performance appraisals can be useful.  Additionally, having clearly defined and enforced risk management policies and processes that guide behavioral expectations, along with recognizing and rewarding the desired behaviors, are significant ways to establish and reinforce how the agency expects its employees to behave, individually and collectively.  The final culture component of the A-B-C model can be addressed through periodically assessing the risk culture of the organization and by setting the right tone at the top, and through an effective and transparent risk governance process.  These aspects are the most important according to Hillson, and the results of a 2013 study conducted by RMA.  www.rmahq.org/WorkArea/DownloadAsset.aspx?id=5452

It is important to remember that changing culture is very much an evolutionary endeavor and not a revolutionary one.  It is one of the most difficult leadership challenges, takes considerable effort and time and is difficult to measure progress.

Hillson, D. (2013). The A-B-C of risk culture: how to be risk-mature. Paper presented at PMI® Global Congress 2013—North America, New Orleans, LA. Newtown Square, PA: Project Management Institute.

Question asked by Anonymous

AFERM EXPERTS SAY...

As with most questions of discretion and management choice, the appropriate course of action is dependent upon considerations beyond residual risk rating or exceeding the agency’s established risk tolerance boundaries or risk appetite level.  ERM informs the resource allocation and internal decision-making processes and should not necessarily trigger the focus of resources in any one direction.  There may be a range of other factors that agency leaders must consider when deciding where and how to address key risks.  For example, the risk may stem from entirely external factors beyond the control of the agency and may require extensive deliberation and negotiation before an acceptable course of action to influence these factors is set and resources focused to respond.  There may be broader political considerations that motivate leaders to elect to apply resources to one risk over another.  The decision of where to focus may also be influenced by the resources at hand.  It may be the better decision to apply existing resources to one risk over another because the agency has those resources available but needs to attain the resources needed to address another risk.  Finally, the actions available to the agency may have already been exhausted, and nothing else can be done to reduce the likelihood or minimize the impact if the event materializes, but the residual risk still exceeds the established risk appetite level.  Simply monitoring leading key risk indicators may be the only option.

AFERM EXPERTS SAY...

To answer the second question first, risk responses are not internal controls.  Industry professionals know that agencies identify risks, develop risk responses, and then implement internal controls.  If risk responses are not internal controls, then what is the relationship between the two?

Internal controls ensure that the objective of a risk response is carried out effectively.  When comparing risk responses and internal controls to the construction of a building, one could say that the risk response is more of the “blueprint” or “architectural diagram” and the internal control is the “engineered solution.”  Internal controls ensure the execution of the risk response.  In addition, the relationship between risk responses can be one to one, or one to many, and in some rarer circumstances, many to one.  One risk response could be affected by one internal control or by several.  Multiple risks responses could be affected by one internal control if the risk responses are very similar or if the internal control is complex and multi-faceted.

Now, what happens if an organization already has internal controls, and how is that considered when establishing the likelihood of risk?  There are three parts to this process.  In part one, “inherent risks” are identified based on risk impact (calculated using probabilities of incidence and severity), assuming a world without controls.  In part two, the agency develops a risk response, applies an internal control, and re-measures, which leads to “controlled risk.”  In part three, agencies measure the risk impact and/or output over time given the implementation of the control to determine if there is any “residual risk.”  As such, internal controls become very important in parts two and three when establishing the likelihood of risk.

AFERM EXPERTS SAY...

This question touches on an important distinction within ERM program implementation.  There is a significant difference between a fully compliant ERM program and a fully capable ERM program.  Compliance focuses on the contents of an ERM program, while capability focuses on what an ERM program can achieve.

A fully compliant ERM program can be established in 1-2 years, seeking to institute an Enterprise Risk Board, a governance structure, risk appetite statement, updated Statement of Assurance, risk profile, etc.  It is not as easy to build an ERM program that is mature, fully functioning, integrated, and outcome-oriented.  In a smaller, less complex agency with leadership buy-in, this could range from 5-7 years.  However, in a larger, complex, decentralized agency, it could take 5-10+ years.  It is important that agencies not be discouraged by those projections.  Effective ERM is meant to be a long-term, evolving endeavor.