Menu

risk identification

Risk Tip: 2 important tenets of risk management

Don’t risk more than you can afford to lose…& don’t risk a lot for a little.

Comment: These two are both basics – the first refers to the idea that if you don’t have enough money to pay for the exposure to loss (risk) out of your pocket/balance sheet, then insure for the risk, transfer the risk or avoid the risk. This becomes the client’s comfort level with the risk at hand. Some companies are very comfortable with risk – they plan for it and manage it. Some companies are very uncomfortable with risk and want to chance nothing.

The second has to do with the fact that a business organization can protect vast fortunes and assets for a relatively small amount of money, comparatively speaking. That would be the prudent move for any business owner.

Bottom line: Everyday and in just about everything we do we are faced with risk. Sometimes we choose to take the risk – sometimes we are a little more conservative. No matter how big or how small the business, we all must make choices relative to appropriate risk tolerance for that business. Therefore we must know what those risks are and what the choices and alternatives are to better protect the business organization.

Approaches to Risk Management: Part 3 Enterprise Risk Management (ERM)

In parts 1 (The Basic Concepts) & 2 (Digging Deeper) we gave you the “traditional silo” approach to risk management. Another school of thought we would like to share is ERM – Enterprise Risk Management.

ERM is a framework to identify risk that typically involves identifying particular events or circumstances relevant to the organizations objectives (risk and opportunities) …assessing them in terms of likelihood and magnitude of impact …determining a response strategy …and monitoring progress.

Some of the primary risk functions (departments and committees) in larger organizations that may participate in an ERM program typically include:

  • Strategic Planning – it identifies both external threats and competitive opportunities, along with strategic initiatives to address them.
  • Compliance & Ethics – monitors compliance with code of conduct and directs fraud investigations.
  • Operations Management – ensures the business runs day-to day and that related barriers are surfaced for resolution.
  • Accounting /Finance Compliance – directs the Sarbanes-Oxley Section 302 and 404 assessments, which identifies financial reporting risks.
  • Insurance – ensures the proper insurance coverage for the organization
  • Marketing – understands the target customer to ensure product/service alignment with customer requirements
  • Treasury – ensures cash is sufficient to meet business needs, while management risk related to commodity pricing or foreign exchange.
  • Law Department – manages litigation and analyzes emerging legal trends that may impact the organization.
  • Operational Quality Assurance – verifies operational output is within tolerances.
  • Credit – ensures any credit provided to customers is appropriate to their ability to pay.
  • Customer Service – ensures customer complaints are handled promptly and root causes are reported to operations for resolution.
  • Internal Audit – evaluates the effectiveness of each of the above risk functions and recommends improvement.

Each department of the management team then selects a risk-response strategy for specific risks identified and analyzed, these may include:

  1. Avoidance: Exiting the activities giving rise to risk
  2. Reduction: Taking action to reduce the likelihood or impact related to the risk
  3. Share or insure: Transferring or sharing a portion of the risk, to reduce it
  4. Accept: No action is taken, due to a cost/benefit decision

Each approach described in this blog post series – “Traditional Silo” and the ERM Model – has its advantages and disadvantages. Each approach, utilized separately, is not fully valid as a comprehensive stand-alone approach.

Every business large or small faces many of the same issues just in different ways and varying degrees. A melded strategy will position company principals to investigate both internal and external risks that can and will affect their business at some point in time. The bottom line is that a well thought out strategy needs to be developed touching upon a wide variety of an organizations business operational issues. Another point to keep in mind is that risk management is an ongoing process…the risks we face today may not necessarily be the ones we face in the future.