Enterprise risk management

1 Introduction

Enterprise risk management (ERM) is the application of one risk-management process to the whole of an organisation, rather than the application of many separate processes to its parts. It is a development and a formalisation of everything in Chapters 1 and 2: the same identification, the same assessment, the same four responses — but run once, to one set of definitions, with the results brought together in one place so that the board can see the organisation’s whole risk position rather than a stack of unrelated departmental views.

YouTube videoLoad YouTube video

CIMA’s Official Terminology takes its definition of enterprise risk management from COSO — the Committee of Sponsoring Organizations of the Treadway Commission — whose framework is the one most often examined. COSO’s framework is set out in full in Chapter 6, Internal control and auditing, and it is not repeated here. What this chapter deals with is ERM as a process: what it adds to the risk management of Chapter 2, how risk is aggregated across a group, how risk is reported to shareholders, and the ethical dimension of managing it.

2 Risk at group level

A large organisation is not one thing. It is a listed entity that owns divisions, which contain business units, which own subsidiaries — and a risk can arise, and has to be managed, at any of those levels. A group in the motor industry might have a commercial vehicles division and a consumer vehicles division; each might have manufacturing, sales and consumer-finance business units; and each of those might operate through subsidiaries in different countries or for different marques.

Some risks will be felt at entity level – for example, the Volkswagen exhaust emission scandal. Other risks will be more limited - for example, one make and model of vehicle that has to be recalled for repair, or a subsidiary dealing with consumer finance for new vehicles not complying with lending regulations.

Two things follow, and they run in opposite directions. Risk appetite, the definitions used to score risks, and the policy about who may accept what are set at the top and applied downwards, or the group’s risk numbers are not comparable with each other. The risks themselves are found at the bottom and reported upwards — which is the harder half, because the people who see a risk first are usually the furthest from the board.

2.1 Risk consolidation

Risk consolidation is the process of aggregating divisional/subsidiary risks at the corporate level. Some risks can be handled together and be subject to a common approach, or they might even substantially cancel.

For example, many organisations will organise insurance at the group level to cover injury to employees anywhere in the group. This approach will usually be cheaper than insuring small groups of employees separately.

Similarly, if one subsidiary is exporting and receiving US$, whilst another is importing and spends US$, the net exposure to US$ currency movement might be very low and can be ignored at the group level.

The saving is real and it can be large, but consolidation is not free. It needs a single definition of each risk so that two subsidiaries’ numbers can be added together; it needs the information to arrive centrally in time to be acted on; and it takes a decision away from a local manager who may still be measured on the result of it. Where two exposures are netted, they must also be netted in the same period — an $18 million receipt in March does not offset an $18 million payment in November.

3 What enterprise risk management adds

Every organisation manages risk somehow. What distinguishes enterprise risk management is that it is done once, for the whole organisation, and that it is used when the strategy is being set rather than only when it is being carried out. The contrast is with what is sometimes called silo risk management, where each function looks after its own risks in its own way:

3.1 What it is for

The point of doing it enterprise-wide is not tidiness. Four things become possible that are not possible otherwise:

1. The board can see the whole position. Only an aggregated view can be compared with the organisation’s risk appetite and its risk capacity, and that comparison is the board’s job (Chapter 1, section 7.1).

2. Risks can be netted and pooled. Insurance bought once for the group is cheaper than insurance bought five times; offsetting exposures cancel. Section 2 above is the whole of this point.

3. Capital and attention can be allocated. If every risk is scored on one scale, the organisation can spend on the largest ones rather than on the ones with the loudest advocate.

4. Risk can inform the strategy. A strategy chosen without knowing what risk it carries has been chosen on half the information. This is what distinguishes the current generation of risk-management frameworks from the previous one, and it is why the framework in Chapter 6 puts strategy and objective-setting at the front of the process.

3.2 What it does not do

• It does not remove risk, and an organisation that removed all its risk would remove its return with it.

• It gives reasonable assurance, not certainty: the estimates are estimates, and a risk nobody has thought of is not in the register.

• It can become an exercise in filling in the register. A process that produces a document and changes no decision has cost money and bought nothing, and the test of whether it is working is whether the board has ever declined something because of it.

• It depends on the honesty of the reporting. If a manager is punished for reporting an incident, incidents stop being reported and the register becomes a work of fiction — which is a matter of culture rather than of process, and is why the current frameworks put culture first.

4 Risk reports

Listed companies in most major markets are now required to include a risk report in their annual report. It tells shareholders and others what the organisation regards as its principal risks and what it is doing about them. In the UK, for example, quoted companies must describe their principal risks and uncertainties and explain how they are being managed.

Here is an extract from Unilever’s 2015 report and financial statements. It is a decade old and the individual risks will have moved on, but the FORM of the disclosure — each risk described in one column and the response to it in the other — is exactly what a principal risk report still looks like, and it is the form to copy:

Unilever annual report and accounts 2015 (PDF)

4.1 Unilever’s principal risk factors (2015)

Our business is subject to risks and uncertainties. On the following pages we have identified the risks that we regard as the most relevant to our business. These are the risks that we see as most material to Unilever’s business and performance at this time.

There may be other risks that could emerge in the future. We have also commented below on certain mitigating actions that we believe help us to manage these risks. However, we may not be successful in deploying some or all of these mitigating actions.

If the circumstances in these risks occur or are not successfully mitigated, our cash flow, operating results, financial position, business and reputation could be materially adversely affected. In addition, risks and uncertainties could cause actual results to vary from those described, which may include forward-looking statements, or could affect our ability to meet our targets or be detrimental to our profitability or reputation.

5 Environmental, social, and ethical issues of risk management

Organisations affect their environment and the human stakeholders with whom they interact. These effects can often produce ethical dilemmas that organisations have to deal with.

Almost every item in this section works through REPUTATION: the damage is done by what customers, regulators, employees and investors do after they find out. Chapter 1 section 6 sets out the sources and impact of reputational risk, and Chapter 7 deals with the ethics that sit behind most of them; this section is about the risks themselves.

5.1 Environmental issues

• BP and the Deepwater Horizon oil spill in the Gulf of Mexico

• VW and car emission misreporting

• Release of dangerous chemicals into water supplies

Everyone is wise with hindsight, and no-one in the organisations concerned would have wanted these events to happen — although in Volkswagen’s case somebody was responsible for the incorrect reporting.

However, as always, there is a balance to be struck between risk and performance. Quite obviously there would be no oil spills if no company drilled for oil. BP had safety procedures in place but either they were inadequate or BP suffered exceptional bad luck. Not only did the company have to pay huge fines and compensation (about $60Bn) but it suffered severe reputational damage.

Unilever’s risk report also contains a section on sustainability:

5.2 Social issues

• Use of Facebook, Twitter to ‘troll’ and bully.

• Capture of ‘big data’ to analyse consumer habits

• Discrimination or lack of diversity in the workplace

Companies suffer reputation risk if their products or information gathering cause damage. The unauthorised release of data can cause financial damage to customers.

Poor recruitment policies leave companies open to accusations of discrimination and this can cause both reputational damage and can lead to legal claims.

Poor diversity policies can cause poor business results as products, services and employees no longer match up to what customers expect.

5.3 Ethical issues

For example, a pharmaceutical company is developing a new drug. Some of the ethical issues arising from this are:

Safeguarding the volunteers on whom the drug is tested

How much testing should be done before the drug is marketed? The more testing the greater the delay in releasing a drug very effective in treating a disease but, balancing that, more testing means less chance of undiscovered side effects.

What price should the drug be sold at? A high price might please shareholders and could enable more money to be spent on research and development of more drugs. However, a high price would mean that some patients and health services could not afford the drug. Should different prices be charged for the same drug in different countries depending on the country’s wealth? Poor ethical choices present risks, particularly reputational and compliance.

6 Test your knowledge

Two quick checks before you move on: work through the flashcards to fix this chapter’s key terms and definitions, then sit the objective questions for exam-style practice. Both mark themselves and explain the answers as you go.