Enterprise Risk Management

For more effective risk management, an organization needs to ascertain the risks it faces and evaluate them. The first step in building a company’s risk profile is to identify the risks. Documentation is very important for effective risk management; however, there is no single correct way to document an organization’s risk profile. An analysis of the business or stage 1 is a prerequisite to identifying risk.

The objective of the risk assessment stage is to offer an evaluation of the possibility and the impact of the risks and opportunities that have been identified if they should occur. Undertaking the assessment provides several benefits, such as providing an order of pain or gain for each opportunity and risk that has been identified.

Financial risk is the exposure to negative occurrences that reduce profitability and in extreme situations bring about company closure. These events may be bad debt, loss of an important customer, loss of overseas investments, the failure of financial systems, regulatory non-conformances or compliance issues, poor hedging choices, adverse fluctuations in exchange rates, and overdependence on a single supplier.

A business that does not address Operational Risk Management cannot claim to have an enterprise risk management process. The success of Operational Risk Management will depend on how complete the identification process is.

The pervasive technologies in today’s world are information, communication, and controls. These technologies can reduce costs, boost growth, and increase productivity. Airlines, banks, insurers, and hotels rely heavily on internet technology. Initially, the purpose of IT was to reduce administrative and bureaucratic work load, so that the staff would have more time to do their proper jobs. Now, IT is an
enabler of the business plan and growth targets. The efficient use of technology can transform companies and contribute towards improved and sustainable stakeholder value. This increase in value is generally driven by investment in technology, resource optimisation and diligent maintenance to sustain reliability. Rapid changes in technology and the merging of technologies, like computers and telecommunications, are continually recreating industrial boundaries so that old industrial sectors are almost non-existent.

For a business, legal risk may be defined as failing to: understand its legal obligations, operate within the law, have evidence to prove that it operates within the law, honour contractual agreements, recognise and effectively manage legal threats or agree on remedies for compensation with a supplier in the event of default.

Establishing and managing a successful Business Risk Management Programme has no shortcuts. There are only trade-offs concerning levels of risk and resource requirements. Despite the fact that the process of formulating risk management strategies and business continuity/contingency plans can be expensive, lengthy, and very time-consuming, it can make the difference between not surviving a risk-related event or getting through with most things intact. One benefit of this process is that information will be uncovered which can also lead to everyday operational enhancements within the business itself and also with its business partners.

From a business perspective, social risk emanates from changes in society. These changes cause fluctuations in demand, open up new business opportunities, or alter a business’ responsiveness to demand, all as a consequence of the characteristics of its workforce. Business performance capabilities are influenced by the availability, education, health, and outlook of the workforce.

Establishing and managing a successful Business Risk Management Programme has no shortcuts. There are only trade-offs concerning levels of risk and resource requirements. Despite the fact that the process of formulating risk management strategies and business continuity/contingency plans can be expensive, lengthy, and very time-consuming, it can make the difference between not surviving a risk-related event or getting through with most things intact. One benefit of this process is that information will be uncovered which can also lead to everyday operational enhancements within the business itself and also with its business partners.

A risk management framework aims to assist an organisation to manage its risks effectively through the application of the risk management process at varying levels and within specific contexts of the organisation. Such a framework should ensure that risk information derived from these processes is adequately reported and used as a basis for decision-making at all levels.

This section provides an overview of how a risk management process consistent with that outlined in the guide might be implemented across an organisation. It also provides guidance on the process and content of risk and risk management reporting and outlines a practical approach to developing a proactive risk management culture.

Reviewing a risk management framework is different to reviewing risks and their associated controls for effectiveness. The latter is a subset of the former as, by obtaining assurance on the effectiveness of the practices in place to manage specific risks, an organisation can be satisfied that at least part of its risk management framework is operating effectively. This review activity would then be coupled with a review of additional components of the risk management framework to ensure its overall effectiveness.