Question asked by Frank Clark

AFERM EXPERTS SAY...

COVID-19 is a classic black swan event.  Black swan events, as defined by Nassim Taleb, cannot be prevented and can be prepared for only by emphasizing agency antifragility. The COVID-19 pandemic is a realized issue with the emphasis on solving the immediate problems. However, an agency’s objectives and strategies my be influenced in the medium-to-long-term.

ERM processes should include recurring opportunities to survey current conditions and future assumptions and adjust objectives and strategies as appropriate.  The COVID-19 pandemic is certainly one of those opportunities.  Once adjustments are put into place, an agency can examine known uncertainties and their treatment plans.  They can also explore new uncertainties that could impact the revised objectives and strategies.   Risk appetite statements and thresholds should also be reviewed, as what was once considered to be important may not be as important now.  Agencies should examine existing uncertainties in the light of new understanding.  Impact assessments may change and may no longer meet the adjusted appetite thresholds.  New uncertainties that emerge from the altered future landscape must be examined against the updated risk appetite.

Question asked by Anonymous

AFERM EXPERTS SAY...

Realized problems are by definition issues, also known as deviations from expectations.  The events and conditions that caused the concern have already occurred and are usually referred to in the past tense.  By comparison, unrealized problems, also known as risks, are usually referred to in the future tense or as “what if “ questions.  The key to distinguishing unrealized risks from realized risks is to look at where they are in time and how they are described.  In summary, when an issue is identified in past tense it is typically a realized problem while an issue identified in future tense, or as a “what if” statement, represents a potential threat or opportunity.

Question asked by Anonymous

AFERM EXPERTS SAY...

In the government there is no profit metric or insolvency risk.  However, there are costs associated with responding to uncertainties and benefits resulting from those efforts.  For government entities the balancing act occurs between response costs and the benefits received from the results.

When an uncertainty has the potential for positive or direct impact, measuring the benefit received is straightforward and can occur after the fact.  However, when uncertainty has potential for negative impact measuring the benefits received becomes more challenging.  This results from measuring an outcome that, if the response effort is successful, does not occur.

In both situations the business case for responding to a particular uncertainty hinges on the organization’s ability to estimate response costs against the benefits received.  As such, an organization’s confidence in those estimates becomes vital to the decision making process.

Full question: I am a recent college graduate and am trying to gain more information on the world of risk management. What information would be helpful for a young adult with a finance degree and specialization in insurance/risk management. I have been reading up on ERM frameworks and am currently working in a claims role. There is extensive information out there and have no idea where to look.

Question asked by Chris Harley

AFERM EXPERTS SAY...

At the most fundamental level risk is defined by the Internal Organization for Standardization (ISO), which says risk is the impact of uncertainty on objectives.  There are three important pieces to that definition in order of need: objectives, uncertainties, and impacts.

Understanding risk begins with objectives and the plans put in place to attain them. Stemming from those plans are the uncertainties in executing those plans.  Uncertainties have the potential to impact the plans and subsequently the ability to achieve your objectives.

It is important to note that you can’t manage uncertainties themselves, but you can manage how you respond to them.  That is where risk management comes in.  Risk management is a collection of practices that can help you identify uncertainties, prioritize objectives and plans to identify which uncertainties to address, and determine the appropriate response or non-response.

The particular practices used will vary depending on the enterprise and its objectives.  For example, the homeowner’s ‘enterprise’ objectives may include minimizing catastrophic loss from a wide range of uncertainties.   As such, taking out homeowner’s insurance is a contingency response to those risks.  Conversely, an insurance company’s objectives would include profitability and growth.  Risk Management practices may include demographic analysis, damage assessment techniques, and probability simulations.  Responses may include insurance for the insurance company, also called reinsurance.

My advice is to begin with a fundamental understanding of risk management as the principles are the same for the individual and the enterprise.  The Project Management Institute, the Risk Management Society, the Risk Management Association, the Institute of Risk Management, and of course, AFERM are all excellent sources for getting started.  The AFERM Summit held each year (October 29th and 30th in downtown D.C.) is a great opportunity to network with other risk management professionals.

Thank you for your question Chris, and good luck in your career!

AFERM EXPERTS SAY...

Version 1.1 of the National Institute of Standards and Technology (NIST) Framework for Improving Critical Infrastructure Cybersecurity, released in July 2018, makes it much easier for CROs and Chief Information Officers (CIO) to align the cybersecurity framework with the agency’s ERM program.  Revised definitions and the introduction of various terms (e.g., risk tolerance) makes the NIST framework align more closely with existing ERM terminology and approaches.  Additionally, Version 1.1 explicitly acknowledges that the NIST framework is not intended to be rigidly applied, but instead, tailored to the needs and environment of the organization.  As stated on page vi, “The decision about how to apply it is left to the implementing organization.”  The greater compatibility with ERM and the flexibility and encouragement to tailor both risk management efforts to the organization provide the basis for integrating cybersecurity within the broader ERM framework.  Figure 2 on page 12 shows an example of how the NIST framework integrates with overall agency risk management efforts.  The revised framework can be found here.