Missed Opportunities in ERM

Should governing opportunities be part of the charter of Enterprise Risk Management? ... Is a discussion in the G31000 forum that is worth deliberating upon further. This [LINK] to the original dialogue will lead you to what has transgressed so far in the debate.

Most businesses run under two modes of operation; strategic planning and tactical delivery of what has already been strategically designed but Enterprise Risk Management usually finds itself applied to the tactical end of the game.

In this blog we'll take a look at four ways in which Enterprise Risk Management can become more involved in risk management for the strategy department.

Missed Opportunities in ERM

Enterprise Risk Management is a pervasive occupation that reviews and assesses all aspects of risk in a business, it theoretically should touch every unit in the business, every product and function. Who would expect it to be anything else? However, planning teams have a tendency to identify opportunities and assess risk under their own rule set, they carryout their own feasibility studies using techniques they create, own and control and they develop valuation models for assessing what is usually and in their eyes, the most notable business model to advance forwards with.

So then, what is the role of enterprise risk management in opportunity identification and selection?

There are four common practices where enterprise risk management can be part of strategic risk assessment but sadly only a few firms involve the ERM team in their strategic planning exercises.

[ERM Service 1 - Control Assessment]

The most obvious place where ERM teams can add value is to extend what they do elsewhere in the company into the strategic planning unit. Or to paraphrase these activities; identify specific strategic risks and then carryout reviews to ascertain how well the strategy department is assessing and controlling these potentially new and chosen threats. A control self-assessment for strategy teams would need to be developed as an outcome of this ERM work and it would need to be unique to the strategic planning unit for it to be effective.

[ERM Service 2 - Opportunity Origination]

Another benefit that may originate from the enterprise risk unit could come from directly handing over risk information to the strategy team. The strategy team could review ERM risk assessment outputs that have been derived from across the company and identify where the business isn't controlling its risk so well. This would hopefully spawn on change projects to bring about improved control oversight or conversely a loosening of risk appetite.

As one would expect, ERM units have a general aversion to threats and consequently don't do so well at loosening risk appetite but with help from the strategy unit, a balanced return from risk taking can be discovered more easily.

[ERM Service 3 - Financial Performance & Risk Pricing]

When business managers review opportunities, they are normally treated as investments by senior staff and are consequently benchmarked as successful or not by considering a set of financial indicators. These indicators are derived from calculations such as Discounted Cash Flow, Internal Rate of Return and Net Present Value, although this is just the tip of the iceberg on valuation techniques used across strategy teams. If ERM is to be compatible with strategic planning, they should review risks alongside opportunities and that will lead them down a road where risk pricing ideologies are going to need to prevail.

In the finance sector, such risk pricing techniques are starting to become more popular and include measurement methods from the Risk Adjusted Return on Capital end of the game but it would be encouraging to see more of this 'risk pricing thinking' in other industry sectors away from finance.

[ERM Service 4 - Silo Integration]

When dealing with well-established risk functions in a company, there is a tendency to migrate market, credit and operational risk out into silos. The benefits of this are not obvious at first but are definitely lost on strategic planning teams. Strategic planners often end up reviewing new opportunities without 'dimensioning' the portfolio effects their potential ventures have with existing risks, why? Well sadly, these risk registers are often hidden on some tabloid in a silo somewhere in the annex of the business and a long way from strategic planning thinking.

From an enterprise risk management perspective, I would expect the ERM team to assist with coordination between the risk silos and the strategic planning unit. This may be facilitated through easy to use of templates that allow strategy departments to give up specific information to the risk silos for additional risk assessment. Another approach would see specific limit guidelines being created in the risk silos and then passed back to strategic planning to contain their speculations within boarded guidelines. In some cases, spreadsheet like calculators are developed by the risk silos that can assist strategic planning units make the appropriate risk adjusted choices.

All this aside, the four ERM services I have briefly described above can be simplified with a diagram and I have inserted this below:

ERM Working with strategy functions | Causal Capital  [click to enlarge]

What would be most interesting to see is other stories from risk practitioners on how they are connecting Enterprise Risk Management to their strategic planning functions.