Learn to manage your uncertainties properly
Every unit exists to provide value for its stakeholders, says Mohammed Salem, as he sheds light on enterprise risk management

Enterprise Risk Management (ERM) has been around for more than a decade. The committee of Sponsoring Organisations of the Treadway Commission states the enterprise risk management deals with risks and opportunities affecting value creation or preservation.
ERM is defined as a process, affected by an entity’s board of directors, management and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives.

In the age of globalisation, given new and emerging regulations and following the great corporate fiascos of the recent years, today’s organisations require to be equipped to counter risks that lead to failure amounting to liabilities and fines at company and even personal levels. Faced with such challenges, directors and executives may find in ERM a methodology that will provide them with confidence that the company’s risks are known and well-managed, and allow them more time to focus on their companies’ growth, strategy and value creation.

Risk & Opportunity
The underlying premise of enterprise risk management is that every entity exists to provide value for its stakeholders. All entities face uncertainty and the challenge for management is to determine how much uncertainty to accept as it strives to grow stakeholder value. Uncertainty presents both risk and opportunity, with the potential to erode or enhance value. ERM enables management to effectively deal with uncertainty and associated risk and opportunity, enhancing the capacity to build value.

Efficient ERM Framework
Implementing an efficient ERM framework within an organization requires a major initiative, investment, change and time — all of which are rare commodities in today’s complex and regulatory environment. Fortunately, most companies have already made and continue to make very large investments in risk management across the enterprise. The key is to determine the right approach to assessing and enhancing the risk management infrastructure and proce sses that already exist within the company, and determining the best way to make them more effective and efficient.

We, at Ernst & Young, encourage a practical approach to ERM that focuses more on leveraging a company’s existing infrastructure over creating a new one. There are seven key challenge areas that need to be addressed:

1-Establish a simple, relevant framework
Understandably, no one framework can respond to all risk management challenges faced by companies. As a result, numerous frameworks for internal control, compliance, and ERM, have been released in recent years. In some cases, companies have adopted these frameworks in order to comply with regulations. Fortunately, companies now have the opportunity to leverage and refine that foundation, employing aspects of other frameworks and customized approaches to help address their full spectrum of risk in way that is relevant, practical, and that provides value.

2-Demand a clear, concise view of risk
Executives, directors, and audit committee members in particular are pushing hard, and often unsuccessfully, to receive a concise, palatable view of the company’s key risks, including related management and monitoring activities. Fortunately, an initial solution may be just a simple spreadsheet away.

3-Protect one that matters most
Value is of utmost concern to stakeholders and shareholders. Unfortunately, key drivers of value and associated risks are rarely identified and explicitly considered within risk assessment activities. In response, boards, executives and others are now making explicit efforts to better understand key drivers of value and the risks that may affect them.

4-Avoid enterprise list management
Some companies are suffering through enterprise list management rather than implementing enterprise risk management. This problem is exacerbated by the use of risk assessment criteria and related processes that focus on ranking exhaustive lists of risks, rather than driving action. Leading companies are making subtle changes to their risk assessment, issues tracking, and reporting approaches.

5-Seek to know what you do not know
No one likes surprises, especially unwelcome ones. In fact, many executives have shared that the risks that “keep them up at night” are the risks that they don’t yet know. Unfortunately, traditional risk assessment approaches may not reveal new and emerging risks. By employing anonymous feedback mechanisms, conducting facilitated workshops, and/or accessing risk knowledge from outside the company, risks can be revealed earlier—and surprises minimized.

6-Conduct risk assessment as an embedded activity
In order to maintain ERM momentum and relevance, consistent risk assessment approaches should be embedded in the company’s strategic, business, and audit planning processes, among others. Fortunately, once embedded, risk awareness, assessment, and monitoring become part of the company’s culture and fabric.

7-Enable internal audit coverage across key risk areas
Many internal audit functions are increasingly focused on financial reporting risk. Although important, this may reduce or eliminate coverage in other key risk areas. In response, audit committees and executives are re-examining the focus, staffing, and charter of internal audit, and investigating options to identify and address the areas where risk coverage may be unacceptably low.

This approach is more likely to produce early success and value, and help increase the chances for broad acceptance and support for risk-focused initiatives and/or ERM into the future.

The above challenges can be customized. As explained above, ERM framework can  be as simple as spreadsheet that is created  by management through various workshops. On comparison of such framework, the companies should assign the responsibility of monitoring those risks to one department/individual depending on the size of the company. The framework should be reviewed at least annually to confirm the risks identified. The process of setting up ERM framework requires the audit committees to make decisions with respect to the quantification of risks and identifying risk appetite in the whole company.

The writer is Partner, Business Advisory Solutions, Business Risk Services, Ernst & Young, Muscat.

- Nurture to motivate