KEY LEARNINGS IN ERM CURIE 13 SEPTEMBER 2014 Mark Aiello Senior Vice President Practice Leader – Organizational Risk and Resilience
Session Objectives • Discuss key lessons learned • Discuss / share common problems • Marsh / CURIE Partnership 1 MARSH RISK CONSULTING 20 October 2014
Section #1 WHAT I HAVE LEARNED 2 20 October 2014
3 MARSH RISK CONSULTING 20 October 2014
QUESTIONS 4 20 October 2014
(The real) Section #1 WHAT I HAVE LEARNED 5 20 October 2014
Key Lessons 1. Building the Proper Foundation 2. Risk Measurement & Prioritization 3. Risk Appetite 4. Risk Management Communication and adoption Integration of Risk Management – The Quest for Resiliency 5. 6 MARSH RISK CONSULTING 20 October 2014
Building the Proper Foundation Many programs are developed without the thoughtful foundations The appropriate Risk Management Process starting point Common starting point 7 MARSH RISK CONSULTING 20 October 2014
Building the Proper Foundation Lack of foundation creates instability in a risk management program Challenges • Program inefficiencies • Conflicts • Lack of direction • Unsustainable process • Ineffective risk management program 8 MARSH RISK CONSULTING 20 October 2014
Building the Proper Foundation Some very basic planning can help strengthen program foundations Strategies • Preliminary planning session • Alignment of senior administration • Development of governance structure • Accountability and delegation of authority 9 MARSH RISK CONSULTING 20 October 2014
Risk Measurement & Prioritization Programs often evaluate macro risk on qualitative scales • Qualitative snapshot of the perceived likelihood and impact • Often based on 3, 5, 10 point scales • Risks evaluated at macro level • Assessment values are often consensus driven • Prioritization often based on a number of key assessment criteria 10 MARSH RISK CONSULTING 20 October 2014
Risk Measurement & Prioritization Key Challenges • Evaluate macro risks, ignore risk drivers – Risk Management strategies based at top level • Consensus evaluation – Subject matter experts (SME) vs. non-experts • Focus on the ‘vote’ – Lack of focus on the issues 11 MARSH RISK CONSULTING 20 October 2014
Risk Measurement & Prioritization Strategies to deal with challenges • Evaluate macro risks, ignore risk drivers – Identify risk drivers – Evaluate material risk drivers / causal factors – Focus risk management activities at the driver level • Consensus evaluation – Conduct evaluation at SME level – Small group exercises • Focus on the ‘vote’ – Focus on the conversation – Validate the evaluation 12 MARSH RISK CONSULTING 20 October 2014
Risk Measurement & Prioritization Risk must be measured against success / plans to be most impactful Many institutions fail to effectively link risk Challenge measurement to success measurement Role Board / Senior Admin • What are the KPIs / success metrics that resonate with different stakeholders in the institution? Functional Deans Leaders • How does risk impact their ability to achieve objectives? Department Mid-level Heads managers • What types of risk are material to different levels of stakeholders? Operational Faculty staff 13 MARSH RISK CONSULTING 20 October 2014
Measuring Risk Creating effective metrics • Risks metrics should align with deviations in desired performance metrics • Risk measurements should be different at each level of the institution • Materiality should relate to the ability and willingness to accept risk at each level of the institution How this can help • Helps to create a clear understanding of the actual relevance of risk at different levels • Fosters better engagement / buy-in at different levels • Creates the foundations to make more effective / objective / consistent risk management decisions and allocate resources (people, time, $) in the most appropriate manner 14 MARSH RISK CONSULTING 20 October 2014
Risk Appetite An effective Risk Appetite framework is a critical part of risk management planning An organization’s framework of tolerances towards risk taking and decision making What is risk/ opportunity – Includes financial metrics critical to support business strategy and appetite? planning – Also includes non- financial criteria for establishing agreed ‘risk capacity’ Align management risk-taking activities with risk perception and tolerances of stakeholders Why define a risk/ opportunity Clarify risk-return views of key stakeholders appetite? Facilitate / create freedom for “ on-strategy ” decision making and risk taking Derive maximum tolerable risk levels, both quantitative and qualitative, based on stakeholder expectations/constraints and strategic objectives How is it linked to the strategy? Define a set of limits for strategic key performance indicators and compare them with the group risk exposure 15 MARSH RISK CONSULTING 20 October 2014
Risk Appetite Asking the right questions • How well do we identify, document and evaluate the risks we face as a business? • From your perspective, does our risk framework effectively relate to our performance metrics allowing us to objectively incorporate risk into key decisions? • Are there certain types of risk or specific risk for which we have zero tolerance (e.g. Health & Safety, Environmental, Reputation impact)? • How do we understand the risk expectations of our stakeholders? • How could our ability to evaluate key decision improve with a better understanding of risk and the organization’s ability and willingness to accept risk ? • What is the current risk appetite of the institution? • What are the key areas that we should consider in our risk appetite framework (Enrolment, Reputation, Employee Health & Safety, Environment, Regulatory, etc.) Risk Appetite is not a single statement, but rather a framework to align better decision making 16 MARSH RISK CONSULTING 20 October 2014
Risk Management Communication Ineffective communication is the largest hurdle facing effective ERM programs Key Challenges • Stakeholder engagement • Alignment of Enterprise / Operational risk management • Reaching the target audience • Perspectives - upside vs. downside “ THE SINGLE BIGGEST PROBLEM ABOUT COMMUNICATION IS THE ILLUSION THAT IT HAS TAKEN PLACE.” – GEORGE BERNARD SHAW 17 MARSH RISK CONSULTING 20 October 2014
Risk Management Communication Ineffective communication is the largest hurdle facing effective ERM programs Institutional Focus Holistic institution wide Board / Senior Admin How does language / review of risks communication need to (macro) change as you move down this path? Functional / Departmental Intra- Departmental Focused Task review of processes and tasks (micro) 18 MARSH RISK CONSULTING 20 October 2014
Risk Management Communication - Speaking the Right Language Risk needs to be defined against relevant objectives to properly resonate Role Objectives Strategic Plan Board / Senior Admin Faculty Strategic Plan Functional Deans Functional Strategic Plans Leaders Department Mid-level Departmental Tactical Heads managers Plans Operational Performance evaluations, Faculty staff scorecards, etc. • Objectives at each level should be accretive and aligned with institutional strategy • Risk does not fundamentally change, however the context must change 19 MARSH RISK CONSULTING 20 October 2014
Creating a Common Language? Programs should focus less on a single set of terms and more on a single, consistent message • Common universal themes • Fundamental definitions • Tailored language for relevant stakeholders How this can help • Fosters better engagement / buy-in at different levels • Creates a consistent baseline to identify (and eventually evaluate) risk • Fosters integration of the various layers of the risk management program • Creates the foundations to make more effective / objective / consistent risk management decisions and allocate resources (people, time, $) in the most appropriate manner 20 MARSH RISK CONSULTING 20 October 2014
Using Effective Communication to Enable Risk Management • Make risk management part of the conversation about institutional management (it’s all one song) – Stakeholders inherently manage risk on a daily basis – why strip it out and make it more confusing? • Change the conversation from the ‘negative’ (adverse events, losses, costs, etc.) to the ‘positive’ – Effective risk management will increase the likelihood of achieving strategic and operational objectives 21 MARSH RISK CONSULTING 20 October 2014
Recommend
More recommend
