Risk Management Flashcards
(41 cards)
the Capability to effectively answer the following questions
ERM
Is the human activity which integrates recognition of risk, assessment, developing strategies to manage it.
RM - Risk Management
Ranges from 0-70MPH - the amount of risk an organization is willing to accept to achieve objectives.
Risk appetite
Ranges from 70-80 MPH:
the acceptable deviation from the organization’s risk appetite.
Risk Tolerance
80 MPH and Above
Unacceptable risk
organization risk exposure types
- Reputational Exposure
-Compliance Exposure
-Operational Exposure
-Strategic Exposure
Financial vs.
Non financial industries
-Insurable
-One-dimensional assessment (severity)
- Manages risks one-by-one
- Occurs within one business department (“siloed”)
-Reactive & sporadic
- Disjointed activities
- Standardized
- Risk Averse
Traditional Risk Management
-Non-Insurable
-multi-dimensional assessment
- Analyzes material risks and how they relate
- Spans the entire organization (holistic)
-Proactive & Continuous
- Embedded in Culture & mindset
- More nuanced; requires soft skills
- Risk taking
Enterprise Risk Management
five step risk management process
- Identify the risks
- Analyze the likelihood and impact of each
- Prioritize risk based on enterprise objectives.
- Treat or respond to the risk conditions
- Monitor results and adjust as necessary.
Processes can be applied to managing positive risks:
- Top-down, bottom-up
- Risk By Category
Risk by categories.
strategic risk (e.g., reputation, customer relations, technical innovations);
financial and reporting risk (e.g., market, tax, credit);
compliance and governance risk (e.g., ethics, regulatory, international trade, privacy); and
operational risk (e.g., IT security and privacy, supply chain, labor issues, natural disasters).
Four basic risk types for businesses: people risks, facility risks, process risks and technology risks.
The final task in the risk identification step is for organizations to record their findings in a risk register. It helps track the risks through the subsequent four steps of the risk management process.
the importance of embedding risk into business strategies and linking risk and operational performance.
governance and culture
*
strategy and objective-setting
*
performance
*
review and revision
*
information, communication and reporting
COSO ERM Framework
a framework to help organizations apply risk management mechanisms to operations, and a process for identifying, evaluating, prioritizing and mitigating risk.
ISO 31000.
including functions like identify, assess, respond, report and review.
British Standard (BS) 31100.
framework helps risk professionals assess their programs in five categories: strategy alignment; culture and accountability; risk management capabilities; risk governance; and analytics
The Risk and Insurance Management Society’s Risk Maturity Model (RMM).
implements policies, technology, employee training and other steps designed to eliminate risk.
a risk avoidance strategy
strategy implements policies, technology, employee, employee training and other steps to reduce risk to an acceptable level
Risk Reduction strategy
contracts with a third party to bear some or all costs of a risk that may or may not occur.
a risk transfer strategy
accepts the risk because its potential to harm the organization is very limited or the cost of mitigating it exceeds the damage it would inflict.
A risk acceptance
Benefits of risk management include the following:
increased awareness of risk across the organization;
*
more confidence in organizational objectives and goals because risk is factored into strategy;
*
better and more efficient compliance with regulatory and internal compliance mandates because compliance is coordinated;
*
improved operational efficiency through more consistent application of risk processes and control;
*
improved workplace safety and security for employees and customers; and
*
a competitive differentiator in the marketplace.
The following are some of the challenges risk management teams should expect to encounter:
*
Expenditures go up initially, as risk management programs can require expensive software and services.
*
The increased emphasis on governance also requires business units to invest time and money to comply.
*
Reaching consensus on the severity of risk and how to treat it can be a difficult and contentious exercise and sometimes lead to risk analysis paralysis.
*
Demonstrating the value of risk management to executives without being able to give them hard numbers is difficult.
ISO 31000’s seven-step process is a useful guide to follow:
- Communication and consultation
- Establishing the context
- Risk identification.
- Risk analysis
- Risk evaluation.
- Risk treatment.
- Monitoring and review
risk leaders must also develop -communication plan to convey the organization’s risk policies
- Communication and consultation.
