enterprise risk management

enterprise risk management

The Importance of Enterprise Risk Management in Modern Organizations

1. Introduction to Enterprise Risk Management

Being the technical expert is not to be sneered at, and the authors acknowledge that the knowledge that accountants bring, buttressed by insights derived from efficient information systems, doubtless help organizations to regulate risk more methodically than they did in pre-accounting times. There are some distinct benefits to be derived from not relying on a single intuitive judgment basis for decision making. This was no less apparent after recent crashes than it was when the T-account made its first appearance and has a practical application domain as varied as financial services and the management of engineering projects. But in terms of management control and power, the gap that technical knowledge possesses represents a significant source of professional authority. With traditional accounting methods, the limitations that accountability presents can also be easily manipulated to the accountant’s advantage.

The paper argues that traditional methods of corporate risk management allow accountants to portray themselves as technical experts in a domain where others must rely on their superior understanding. This reinforces the accountant’s potent professional presence in senior management and board members’ meetings.

Integrated risk management is an essential aspect of any organization striving to protect and grow shareholder value, and public companies are required by national law to demonstrate the effectiveness of such practices. The processes of disseminating information are straightforward, but for this to happen, there needs to be buy-in from all those working in the organization. They have to be seen as active participants in the process.

2. Key Components of Enterprise Risk Management

CRMA Definition: Enterprise Risk Management (ERM) – An organization’s enterprise risk management framework consists of a strategy and a corresponding business process, methodologies, and reporting that are used to identify, assess, monitor, and manage risk in a manner that is aligned with the organization’s risk appetite, risk tolerance, and business objectives.

A good ERM process acts as the bridge between the strategic objectives set by management and the potential future events that might prevent those strategies from succeeding. The risk management process differs from insurance, business continuity planning/disaster recovery planning, or compliance in that it evaluates all of the risks and opportunities the organization faces, takes an integrated view that aligns risk response with management’s strategic goals, and ensures that company risks are discussed regularly by company leadership to ensure that the organization can proactively avoid nasty surprises, seize business opportunities, and overcome hurdles to success. While a stated intention of ERM is not to identify risks to enterprise survival (as all organizations engage in activities to achieve successes), a properly functioning ERM process should recognize that events could arise that could threaten the continued existence of the enterprise and carefully avoid that happening.

3. Benefits of Implementing Enterprise Risk Management

Therefore, a company that aligns itself with ERM will derive certain benefits that it could not otherwise obtain if it had used its time, energy, and resources to independently manage their significant risks. These benefits are numerous and diverse. For example, the Audit Committee of the Board of Directors will have an enhanced perspective of the significant business risks that the company faces and the functions that are involved in these business processes. Employees, who know their responsibilities in relation to the efficient response to such risks, will be more likely to effectively respond to significant risks that they identify as being inherent in their processes. For the risk function itself, this tool provides the opportunity to strengthen its credibility and visibility, while fulfilling its role supporting and helping to manage the business in a highly valued manner. The ERM implementation process also provides the opportunity to benefit from the review of the governance processes in place surrounding the company’s significant risk processes.

Before a company can take advantage of any opportunity that has been identified, it must have the reserves to survive any failed attempts to capitalize on that opportunity. Similarly, before a company takes any risks to further its business, it must keep in mind the reserves that this risk will use up. A company needs to know its risk exposure and then contemplate ways of either insuring, avoiding, or mitigating that risk so as to remain sustainable. Risk is what gives the company its character, but keeping that risk in check ultimately gives the company its future reality. Hence, risk management is of equal importance to that of the efficient capture of opportunity. Enterprise risk management, as a tool, both complements and supplements the company’s own risk management processes to enable each participant of the risk management process to gain an overall picture of their top risks.

4. Challenges and Best Practices in Enterprise Risk Management

The role of external auditors in validating corporate ERM practices is important, as risks are identified but not always managed and monitored. Internal auditors, as a separate function or within risk management or as a part of the financial function, play a key role ever since and their mission goes beyond validation, helping the company to identify, measure and mitigate risks. If more and more internal audit departments are involved in top-level risk management, is this frequent situation reflecting a positive reality – that risk management and audit departments mutually trust and respect each other – or a bad one, as all employees have much more important daily responsibilities to take into consideration when aiming for corporate strategic objectives?

Enterprise risk management (ERM) is evolving, as new risks are emerging. Only by understanding the challenges can ERM practitioners find the appropriate solutions. The role of professional organizations in determining the ERM best practices must not be underestimated. With the help of adequate educational programs and widely-adopted certification programs, ERM specialists must develop the specific knowledge base and skill set that can help them identify, assess and manage risk in a harmonized way. Only by attracting the best talent and by certifying the professionals that truly understand ERM concepts, can organizations build integrated, efficient and effective ERM programs.

5. Case Studies and Real-World Applications

The second case study, carried out on American Express by financial analysts, researches the interrelations between corporate governance, business performance, and stock returns.

The first case study shows how a risk-focused approach can help senior managers focus on the most critical and fundamental risks faced by a highly leveraged company.

Finance professionals often reveal obvious but important reminders about how successful investment in enterprise risk management also requires investment at a more senior level.

Ford cases are frequently studied in auditor and accountant professional training sessions. These cases portray how much damage a company can incur when enterprise risk management is not taking place. These case studies also underscore that successful ERM requires an explicit understanding of the downside risk exposure.

Eventually, the best way to understand whether enterprise risk management is useful and where it should be applied is to look at detailed case studies of real organizations. In this section, some of the most impactful applications of ERM within public companies are considered.