Module 10 - Establishing Risk Governance and Culture Flashcards
Explain why culture is an integral component of an enterprise risk management framework.
Risk governance and culture together form the basis for all other components of enterprise risk management. Culture has a critical influence on enterprise risk management. It reflects the entity’s ethics: its values, beliefs, attitudes, desired behaviours and understanding of risk. Whether the entity is a small family-owned private company; a large, complex multinational; a government agency; or a not-for-profit organization, culture supports the achievement of mission and vision.
Enterprise risk management affects people’s actions; it helps people understand risk in the context of the entity’s strategy and business objectives and consider that in how they respond. An entity with a risk-aware culture stresses the importance of managing risk and encourages transparent and timely flow of risk information. It does this with an attitude of understanding, accountability and continual improvement.
Explain the significance of the board’s role and member independence for enterprise risk management.
An entity’s board of directors significantly influences enterprise risk management. The board of directors has the primary responsibility for risk oversight in an entity and in many countries, it has a fiduciary responsibility to its stakeholders, including conducting reviews of enterprise risk management practices.
Where the board is generally comprised of members who are experienced, skilled, highly talented and independent from management, it can offer an appropriate degree of industry, business and technical input while performing its oversight responsibilities. Independence allows directors to be objective and to evaluate the performance and well-being of the entity without any conflict of interest or undue influence of interested parties. An independent board serves as a check and balance, ensuring that the entity is being run in the best interests of its stakeholders rather than select board members or management.
It is important for a board to understand the complexity of the entity and engage with management to determine the benefits derived from enterprise risk management. Desired benefits inform the suitability of enterprise risk management for the entity’s needs (i.e., its ability to manage risk to an acceptable amount). The board also works with management to define the operating model, reporting lines and capabilities to achieve these benefits.
Provide examples of factors that impede board independence.
The board demonstrates its independence by each board member displaying his or her individual objectivity. A board member’s independence may be impeded if he or she:
(a) Holds a substantial financial interest in the entity
(b) Is currently or has recently been employed in an executive role by the entity
(c) Has recently advised the board of directors of the entity in a material way
(d) Has a material business relationship with the entity, such as being a supplier or customer or having an existing contractual relationship (other than a directorship relationship)
(e) Has donated a significant financial amount to the entity
(f) Has business or personal relationships with key stakeholders within the entity
(g) Sits as a board member of other entities that represent potential conflicts of interest.
Explain how the concept of suitability of enterprise risk management influences an entity’s decision about its risk management approach.
“Suitability of enterprise risk management” refers to an entity’s ability to manage risk to an acceptable amount. The enterprise risk management capability needed for a given entity is influenced by the complexity of the entity, which in turn influences its needs and the benefits it wants or expects from enterprise risk management.
Explain how an entity’s choice of governance and operating model influences its risk management practices.
The entity establishes governance and operating structures to achieve its strategy and business objectives. Risk governance sets the entity’s tone, reinforcing the importance of enterprise risk management and establishing oversight responsibilities for it. Different operating models may result in different perspectives of a risk profile, which may affect enterprise risk management practices. For example, assessing risk within a decentralized operating model may indicate few risks, while a centralized model may indicate a concentration of risk—perhaps relating to certain customer types, foreign exchange or tax exposure.
Outline factors that influence an entity’s choice of operating model.
Factors that influence choice of operating models may include:
(a) The entity’s strategy and business objectives
(b) Nature, size and geographic distribution of the entity’s business
(c) Risks related to the entity’s strategy and business objectives
(d) Assignment of authority, accountability and responsibility in all levels of the entity
(e) Type of reporting lines (e.g., direct reporting/solid line vs. secondary reporting) and communication channels
(f) Financial, tax, regulatory and other reporting requirements.
Outline the role and characteristics of risk management oversight structures, and explain how these structures differ by the type of entity.
Management plans, organizes and executes strategy and business objectives in accordance with the entity’s mission, vision and core values. Consequently, it needs information on how risk associated with the strategy occurs across the entity. One method of gathering this information is to delegate the responsibility to a committee. Each committee member contributes relevant individual skills, knowledge and experience, and they collectively provide risk oversight.
Entities with complex legal structures may have several committees, each with different but overlapping management membership. This multicommittee structure is then aligned with the operating model and reporting lines, which allows management to make business decisions as needed, with a full understanding of the risks inherent in those decisions.
Regardless of the particular management committee structure established, it is common to clearly state the authority of the committee, the management members who are a part of the committee, the frequency of meetings and the specific responsibilities and operating principles the committee focuses on. In small entities, enterprise risk management oversight may be less formal, with management being much more involved in day-to-day execution.
Explain the role of culture in risk-aware decision making.
An entity’s culture is reflected in its core values and approach to enterprise risk management. Culture influences how the entity applies the risk management framework it has in place: how it identifies risk, what types of risk it accepts and how it manages risk. A culture in which people do the right thing at the right time is critical to an entity being able to pursue opportunities and minimize risk in achieving the strategy and business objectives.
Explain the concept of “culture spectrum,” and provide an example of how it relates to enterprise risk management.
The culture spectrum ranges from risk averse to risk neutral to risk aggressive and can be depicted as:
The closer an entity is to the risk-aggressive end of the spectrum, the greater its propensity for and acceptance of the types and amount of risk necessary to achieve strategy and business objectives.
For example, a hedge fund is likely a risk-aggressive entity. Management and external investors will have high expectations of performance that require taking on potentially severe risks, while still falling within the defined risk appetite of an entity.
Outline factors that influence where an entity falls on the culture spectrum.
Many factors influence where the entity falls on the culture spectrum. Internal factors include, among others, how entity employees interact with each other and with their managers, the standards and rules of conduct, the physical layout of the workplace and the reward system. External factors include regulatory requirements and expectations of customers, investors and others.
Describe strategies for fostering a risk-aware culture.
(a) Maintaining strong leadership
(b) Employing a participative management style
(c) Enforcing accountability for all actions
(d) Embedding risk in decision making
(e) Having open and honest discussions about risks facing the entity
(f) Encouraging risk awareness across the entity
(g) Communicating openly and reporting about risk
In a risk-aware culture, employees know what the entity stands for and the boundaries within which they can operate. They can openly discuss and debate which risks should be taken to achieve the entity’s strategy and business objectives, with the result being employee and management behaviours that are aligned with the entity’s risk appetite.
Define organizational “tone” and “tone in the middle.” Explain their significance to effective enterprise risk management.
The tone of an entity is fundamental to enterprise risk management. Without a strong and supportive tone communicated from the top of an entity in support of an ethical culture, risk awareness can be undermined, responses to risk may be inappropriate, information and communication channels may falter and feedback from monitoring entity performance may not be heard or acted upon.
Tone is defined by the operating style and personal conduct of both management and the board. When management and the board of directors behave ethically and responsibly and demonstrate a commitment to addressing misconduct, they communicate to everyone that the entity strongly supports integrity. Where there are personal indiscretions, lack of receptiveness to bad news or unfairly balanced compensation programs, the message sent may be one of indifference, which could negatively affect the culture and provoke inappropriate conduct. Employees are likely to develop the same attitudes about what is acceptable and unacceptable—and about risks and risk responses—as those held by management.
Having a consistent tone helps an entity establish a common understanding of the core values, business drivers and desired behaviour of employees and business partners. It is not always easy to maintain a consistent tone. For instance, different markets and challenges may call for different approaches to motivation, evaluation and customer service. From time to time, these factors may put pressure on different levels of the entity, resulting in a change in tone. (In larger entities, this view of tone is sometimes referred to as “tone in the middle.”)
The more the tone can remain consistent throughout an entity, the more consistent will be the performance of enterprise risk management responsibilities.
Explain the role of standards of conduct in enterprise risk management.
Standards of conduct guide the entity in pursuing its strategy and business objectives by:
(a) Establishing what is acceptable and unacceptable
(b) Providing guidance for navigating what lies between acceptable and unacceptable
(c) Reflecting laws, regulations, standards and other expectations that the entity’s stakeholders may have, such as corporate social responsibility.
Ethical expectations and norms vary across geographical locations and entities. Management and the board of directors establish the appropriate standards and mechanisms for adhering to them, which includes addressing the potential for noncompliance. These expectations are then transcribed onto an organizational statement—a code of conduct. The purpose of a code of conduct is to communicate the entity’s expectations of ethics and desired behaviours, including behaviours relating to enterprise risk management and decision making.
Explain why responding to deviations in standards of conduct is critical to enterprise risk management.
When standards of conduct are not adhered to, it is generally for one of these reasons:
(a) Tone at the top does not effectively convey expectations.
(b) Board does not provide oversight of management’s adherence to standards.
(c) Middle management and functional managers are not aligned with the entity’s mission, vision, core values, strategy and risk responses.
(d) Risk is an afterthought to strategy setting and business planning.
(e) Performance targets create incentives or pressures to compromise ethical behaviour.
(f) No clear escalation policy exists on important risk and compliance matters.
(g) Process for investigating and resolving excessive risk taking is inadequate.
(h) Intentional or deliberate noncompliance exists.
An entity sends a clear message of what is acceptable and unacceptable behaviour when deviations become known. Deviations from standards of conduct must be addressed in a timely and consistent manner.
Appropriate responses to deviations and maintenance of consistency in standards of conduct ensure that the entity’s culture is not undermined. The response to a deviation depends on its magnitude, which is determined by management considering any relevant laws and standards of conduct. The responses may range from an employee being issued a warning and provided with coaching to being put on probation or terminated.
Explain the role of individual accountability in enterprise risk management.
Culture and ethics are integral to the entity’s ability to achieve its mission and vision, but while culture is a powerful force, it is not a determining one; individual decision making, and thus individual accountability, is fundamental to ethics and enterprise risk management.
Wrongdoing occurs for three reasons: good people make mistakes (out of confusion or ignorance), good people have a moment of weakness of will and bad people choose to do harm. Knowing that any one of these three things can take place, an entity must align ethics and culture to help people avoid mistakes and maintain strong will and to identify potential wrongdoers, individuals or groups. This requires appropriately assessing and prioritizing risks and developing detailed risk responses.
Aligning individual behaviour with culture is critical. The most powerful influence comes from management that creates and sustains the organizational agenda. Explicitly, the entity develops policies, rules and standards of conduct. Implicitly, the entity “walks the talk” of core values and standards of conduct. The key is management enforcing that what it says is of value and recognizing that it is the implicit and subtle processes that most effectively establish culture. People respond better to behavioural reinforcement than to written rules and policies.
