Regardless of the state of the business environment or their surrounding conditions, all businesses will do better if they adopt appropriate management tools. Their main challenge then may be determining which to pursue, that will be of most benefit to the organisation. It is worth noting that what ERM promotes is fundamentally sound governance and good strategic processes that support decision-making and the achievement of the organisation’s objectives. ERM may look like it is premised on good, old-fashioned common sense but it has consistently proved to be a powerful – and timeless – corporate management tool.
The focus of ERM is always on supporting the organisation’s efforts to achieve its objectives, thereby creating value. It does this by setting in place a process of risk management which hinges on identifying risks, assessing them for severity and then determining the best possible mitigative measures. To do this, firms need several elements to come together to enable them to make good decisions which fulfil their objectives. Every company, even those not-for-profits, exist to generate value, and their value is determined by the way they are managed. Thus, decisions made by management, involving measuring and managing risk, are critical.
These need to be informed decisions, based on reliable data, and guided by the appropriate frameworks, processes and procedures. Some organisations regard ERM, erroneously, as a checklist or tick-the-box exercise. Properly applied, ERM is the integration of culture, resources and strategies that is implemented organisation-wide to manage risks in order to create, preserve or maintain the organisation’s value. To do this, it goes beyond internal controls and addresses the issues of the firm’s strategy and governance through ongoing monitoring, learning and improving performance.
Organisations looking to sustain and improve their competitiveness in today’s volatile, dynamic environments will want to explore how ERM can support strategy and performance. Properly implemented, ERM practices are capable of instilling confidence in the board and management – and by extension, stakeholders – that the organisation will achieve its objectives. ERM thus does not just create corporate strategy; what it does is provide vital information for the organisation to identify and mitigate, in a timely manner, the risks which come with the corporate decisions that have to be made.
With due diligence done and reliable data available, the board and management can decide what strategy to adopt that will best suit their requirements, given the constraints and resources they are operating under. It may not be necessary to create a whole new structure when implementing an ERM programme, or invest in sophisticated systems. What is necessary, however, is implementing a gradual change process. There also needs to be buy-in from the board and senior management, and a proper understanding of ERM throughout the organisation.
Another benefit of a well-designed and implemented ERM programme – that further supports corporate strategising – is that with the amount of information derived through its application, the firm’s processes may be improved and optimised. While traditional risk management approaches have tended to focus on the negative aspects of risk, ERM is capable of identifying opportunities through which companies may gain competitive advantage.Organisations need to recognise ERM as a journey, not a one-off exercise, and like all journeys, it does take some effort to stay on track and moving in the right direction.
Some organisations which are new to ERM may find it challenging to embed risk management principles in their various units, departments or subsidiaries. Others may find it difficult to build a culture of awareness across the organisation, or realise that the tone from the top is not supportive enough of ERM efforts, perhaps because ERM is not completely understood. These challenges may be compounded by an unsettled business environment or external forces beyond the firm’s control, which demand the attention and resources which would otherwise have gone towards ERM.
An ERM programme focuses on identifying and escalating risks to the proper quarters in a timely and efficient manner. Not only does this manage the firm’s core risks better, it can increase the efficient use of resources over the long term and reduce the negative impact of crisis events. It is also capable of identifying emerging risks that may influence decision-making and, by extension, corporate strategy. Board and management need to also consider strategic risk management; this may be further facilitated with an ERM programme in place, as strong ERM enhances the possibility of achieving the firm’s strategy and objectives.
The versatility of ERM allows it to be applied for both identifying risks and opportunities, simultaneously helping organisations to protect and create value. Ideally, risk professionals should facilitate ongoing risk discussions to help integrate ERM processes and procedures further into strategic decision-making. More discussion and analysis contribute towards the ability of board and management to identify and think strategically about pursuing opportunities available to the firm, while supporting oversight capabilities on an ongoing basis.
The board and management are always concerned about the risks that abound in the business environment. Stakeholders, too, are becoming increasingly involved. Everyone wants to ‘keep their bases covered’ and be confident that they have made the right decisions. No one wants to miss anything significant. When analysing strategies and identifying the related risks, it is most effective to integrate risk management into the process. Organisations will by now be aware that risks can show up anywhere – even in the most carefully thought-out strategies which they formulate. Risk exists even in the most meticulously crafted corporate strategy!
There are strategic risks to be aware of, every time a new strategy is implemented. But if these are recognised beforehand, there is a better chance of effective mitigation, allowing the preservation of value while enabling the organisation to capitalise on opportunities – provided it is flexible enough.
