NA Chapter 7 ERM Frameworks Risk Identification and Tolerance Analysis Paper Part 1 Please make sure to answer in apa format and maker sure to use scholar
NA Chapter 7 ERM Frameworks Risk Identification and Tolerance Analysis Paper Part 1
Please make sure to answer in apa format and maker sure to use scholarly sources. The required word count is 2500 words and the required sources is 4. Please make sure the responses are original as the will be a plagiarism scan.
Risk Management Process:
ERM Frameworks, Risk Identification and Tolerance
Risk Identification:
1.Choose a service or retail business of your choice (not a current or previous employer). Perform a risk identification analysis using no fewer than two tools. Provide the rationale for your decisions in choosing those tools.
.
2.How might the identified risk exposures impact the organizational strategy and outcomes? Use the organization your chose from Question 1.
Part 2
Please respond to each student and total word count for each is 150 words. Please use scholarly sources to validate response. Total required sources 2. This is the original question:In your own words, describe the ERM framework used in your organization used to assess and evaluate risk. Does that current framework satisfy the list of ten criteria according to ISO 31000 on pp. 99-100? Why or why not?
Share with your fellow learners how KRIs and KPIs might be used in your organization. Apply concepts from the chapter to explain your understanding of their use.
Student 1 Michelle,
Enterprise Risk Management (ERM) is used in organizations for them to be successful in ensuring they are prepared for issues (Fraser & Simkins, 2010). Organizations can set up how they want it to be constructed, determine how it needs to be implemented and decide on who will be completing the review of the issues.
Apria Healthcare is the organization that I currently work for and they have continued to use and improve the ERM within the organization. After reviewing the 10 principles for risk management, it is clear that my organization has made a great choice in the person that overseas this department (Fraser & Simkins, 2010). They use all the principles to ensure that our organization is a success with customers, employees, leaders, and stakeholders.
Apria has continuous education and learning classes to ensure that we are all familiar and up to date with any issues. They have set for the objectives and provided all employees with the information. There is continuous information about the strategies and audits being performed. They send out the evaluations for these audits and change things as necessary. The human side and culture of the organization is also an important factor and they make sure that they prevent any issues that may arise.
Key risk indicators (KRI) give an organization the opportunity to audit the company to see if there are any places for fraud, mishandling, or other issues that may put it at risk (Fraser & Simkins, 2010). One article discussed issues for a food franchise where some of the franchises closed (Nigrini & Johnson, 2008). However, they could have been avoided if they would have seen the KRIs compared to other franchises. Apria has a unique team that look for KRIs and continue to look at each branch and compare issues or find ways to improve the organization altogether.
Key performance indicators (KPI) are indicators that organizations can use to assess if the employees are meeting the expectations (Haber & Schryver, 2019). They are specific tasks that are completed and can be measured by how many is being completed in certain time frames. They can also be evaluated and compared to other employees that are completing the same tasks. Apria sets goals for all employees and can easily measure if they are meeting the expectations of if there are things that need to be changed.
Apria Healthcare is a great organization that continues to move forward in all areas of the business. They are transparent when there are issues or if there are areas that need to be improved upon. Recently we have changed a major part of the organization due to ERM as it was determined that we had some major KRIs. Once that was addressed it did take many months to evaluate and find a solution. Now that it is currently in progress, we are seeing a dramatic improvement of many different areas.
Student 2 Brittney
Enterprise risk management framework can be defined as the set of components that provide the foundations and organizational arrangements for designing, implementing, monitoring, reviewing, and continually improving risk management (Fraser and Simkins, 2010). ERM framework is imbedded in the organizations strategic policy as well as the organizations operational policy. This framework is utilized in the decision making process. A comprehensive and sustainable ERM framework addresses all the major categories of risk exposure, including environmental, competitive, strategic, financial, regulatory, and operational risk (Tuten, 2018). There are seven components within the enterprise framework process. These seven are as follows: mandate and commitment to the ERM framework, risk management policy, integration of ERM in the organization, risk management process, communications and reporting, accountability, and monitoring, review, and continuous improvement (Fraser and Simkins, 2010). The ERM framework for the company that I work for satisfies the ten criterias that are required. Our company ERM framework is tailored on companys objectives and mission statement. Our company is always looking for ways to better our organization and we always adapt to change.
A Key Risk Indicator (KRI) is an operational or financial variable that provides a reliable basis for estimating the likelihood and the severity of one or more operational risk events (Scandizzo, 2005). In contrast, Key Performance Indicators (KPI) is measures that are focused on performance targets and are based on a wide range of strategic, tactical, and operational objectives (Fraser and Simkins, 2010). Both KRI and KPI can be utilized in an organization because they both can be used as tools to show whether the organization is up against a risk or whether a risk has occurred. P1: OTA/XYZ
P2: ABC
c07
JWBT177-Simkins
October 24, 2009
9:18
Printer Name: Hamilton
CHAPTER 7
ERM Frameworks
JOHN SHORTREED, PhD
Professor Emeritus, Civil Engineering, University of Waterloo
G
A
T
INTRODUCTION
E
Enterprise risk management (ERM) is equivalent to the ISO definition of risk
S of a risk management framework,
management framework. The ISO definition
and thus an ERM framework is:
,
risk management framework: set of components that provide the foundations and organizational arrangements for designing, implementing,
monitoring, reviewing and conD
tinually improving risk management throughout the organization. (ISO Guide 73 Risk
ManagementVocabulary 2009, Geneva) E
A
In the ISO definition, the foundations include the policy, objectives, mandate,
and commitment to manage risk and the N
arrangements include plans, resources,
processes, relationships, accountabilities, and
D activities.
An organizations risk management framework exists only to facilitate the
Rshould be used for any decision in
Risk Management Process (RMP), which
the organization. The RMP identifies the associated
risks, assesses the risks, treats
A
the risks within an appropriate context, and is supported by risk communication
and consultation as well as monitoring and review.
The ERM framework is integrated 1
into the organizations overall strategic and operational policies and practices. There is one ERM framework at
1
the organizational level and as many RMPs as there are decision/management
2 is specified by the ERM framework
positionshundreds or even thousands. RMP
and is the key risk management process. 3
T
S
Introduction to the ISO Risk Management Framework
The importance of risk management is recognized by the publication in 2009 of an
International Standards guide, ISO 31000 Risk ManagementPrinciples and Guidelines, developed by a work group of international experts from more than 30
countries. The same working group also revised ISO Guide 73 (2002) in 2009, and
it provides definitions for risk management.
This chapter is based on the ISO risk management framework rather than
attempting a comprehensive historical review and development of a state-ofthe-art ERM framework. The ISO framework is current best practice for risk
97
Copyright ©2010 John Wiley & Sons, Inc.
P1: OTA/XYZ
P2: ABC
c07
JWBT177-Simkins
98
October 24, 2009
9:18
Printer Name: Hamilton
ERM Management, Culture, and Control
management frameworks. It incorporates best practice from COSO, PMI (Project
Management Institute), the Australian and New Zealand Standard (AS/NZS
4360:2004) and other leading international risk management standards.
While ISO 31000 leaves some latitude to the organization for the specific
framework and associated risk management process, it is expected that the generic
ISO framework would be followed and the organizations ERM framework would
be easily recognized as an ISO 31000 framework. This is necessary in order to
realize the benefits of common understanding based on standard terminology and
processes.
The overarching concept of the ISO ERM framework is that the risk management in an organization is fully integrated
Ginto the management and direction of
the organization, risk management is just one aspect of management and is just one
A
more tool available to managers besides tools for: operations, finance, planning,
T to ISOs general definition is effects
human resources, and so forth. Risk according
of uncertainty on objectives. It is expected
Ethat any decision will involve a routine
and appropriate consideration of the associated risks and their possible treatment
S
along with consideration of impacts on objectives,
which are not uncertain. Risk
management is not an add-on step but rather
is
fully
integrated and embedded in
,
all decision processes.
Uncertainty in risk may involve uncertainty of objectives and their measures,
effectiveness of controls, the nature of events
D and their consequences, stakeholders
views, or uncertainty of any sort. Risk management seeks to enhance the likelihood
of positive consequences and reduce theE
likelihood of negative consequences as
defined by the organizations objectives. A
Any decision by any manager can have either positive or negative effects on
N consequences of a decision, positive
the organizations objectives. The uncertain
and/or negative, are inextricably bound D
to each other and cannot be separated.
Expressions such as run a risk, take a risk, faint heart neer fair maiden won,
R
take a chance, all describe the uncertainty of a decision outcome. You pay your
money and take your choice. Then you wait
A for the future to unfold and add up
the positive and negative consequences, to see if according to your objectives, it
was a good choice or not.
1 on balance of probabilities, the net exAn opportunity is a situation where,
pectation is a favorable decision outcome A threat is a situation when, on balance
1
of probabilities, the net expectation is an unfavorable outcome. Both opportunities
2
and threats have associated risks.
The organization first examines the external
and internal context in which it
3
operates. Then the organization reviews its objectives, including any risk-specific
T
objectives. Risk criteria that are used to determine
the acceptability or tolerability
of a risk, in deciding either to pursue anS
opportunity or respond to a threat, are
based on the objectives.
The ISO framework can accommodate profit-seeking organizations as well as
regulators who exist only to protect the public from harm. The later organizations
may focus primarily on negative consequences although it is recommended that
they consider also positive consequences such as trust of public, cost-effectiveness
of controls, and so on. The reason for this flexibility in application is because the
risk framework is driven by objectives and those objectives can accommodate any
goals, purposes, limitations, zero tolerance criteria, absolute priorities, and so on.
Copyright ©2010 John Wiley & Sons, Inc.
P1: OTA/XYZ
P2: ABC
c07
JWBT177-Simkins
October 24, 2009
9:18
Printer Name: Hamilton
ERM FRAMEWORKS
99
The ISO standards risk management process can be applied to the whole
organization, to part of the organization, to particular types of risk in isolation, or
to a specific asset, project, or activity. The standard recognizes that management of
risk is more effective if it is conducted in a consistent manner across an organization
as defined by the ERM framework.
Principles of Risk Management and
Excellence in Risk Management
The ISO framework is principle-based rather than prescriptive. It provides a genG
eral framework for ERM with the expectation that individual countries, industrial
sectors, and organizations will craft theirA
own detailed and specific frameworks
to their own unique situations. The principles
T have their own chapter in the ISO
standard and are expanded in an annex on excellence in risk management.
E management should have net value
The overarching ISO principle is that risk
to the organization. Risk management should
S make money, enhance reputation,
contribute to public safety, improve sustainability, generally enhance benefits, and
reduce harm. It does this by improving ,the decision makers understanding of
the effects of uncertainty on objectives, devising risk treatments that are objectiveeffective, and doing monitoring, review, and improvement of risks and controls.
D and value, consider a study of dams
To illustrate the issue of uncertainty/risk
constructed by the U.S. Bureau of Reclamation.
The study compared planning
E
estimates prior to construction with data for the projects once built and in operation.
A the Benefit to Cost ratio was 1.0 there
The study found that if in the planning period
was only a 17 percent chance the actual project
N would break even. A prior Benefit
to Cost ratio of 4.0 (benefits exceeding costs by 300 percent) was needed to achieve
D
a 95 percent probability of achieving a Benefit to Cost Ratio of 1.0 or break even.
R and the costs were systematically
The benefits were systematically overestimated
underestimated (James and Lee 1971). Effective risk management should reduce
A
these biases and improve the estimates of actual value.
Based on a comprehensive analysis of existing principles for risk management the ISO Working Group identified 10
1 principles for risk management (after
ISO 31000, clause 4):
1.
2.
3.
1
2 reputation, profits, compliance, and
Creates value for objectives of health,
so on, less the costs of risk management.
3
Is an integral part of organizational processes including project management, strategic planning, auditing,Tand all other processes.
Is part of decision making throughSanalysis and evaluation to understand
risk and determine its acceptability as treated.
4. Explicitly addresses uncertainty and how it can be modified.
5. Is systematic, structured and timely and produces repeatable and verifiable
outcomes and decisions.
6. Is based on the best available information including historical data, expert
opinion, stakeholder concerns, and so forth, tempered with the quality and
availability of the information.
7. Is tailored to the organization, its objectives, its risks, and its capabilities.
Copyright ©2010 John Wiley & Sons, Inc.
P1: OTA/XYZ
P2: ABC
c07
JWBT177-Simkins
100
October 24, 2009
9:18
Printer Name: Hamilton
ERM Management, Culture, and Control
8. Takes human and cultural factors into account in addition to technical and
other hard factors that impact the likelihood of consequences.
9. Is transparent and inclusive so that communication and consultation with
stakeholders and others keeps the risk management and risk criteria current and relevant.
10. Is dynamic, iterative and responsive within a continuous improvement
environment that responds to changes in context, trends, risk factors and
other internal and external factors.
These principles provide the basic attributes for an ERM, however, as the
G it will exhibit characteristics of risk
organization implements an ERM framework
maturity in addition to adherence to the principles.
In ISO 3100, Annex A describes
A
the excellence characteristics and evidence for their existence and change in an
T are:
organization. The excellence characteristics
r
r
r
r
E
Continuous improvement in the framework using a formal process.
S
Accountability for risks with readily available lists of risk owners.
, with documentation as appropriate.
Use of the RMP in all decision making
Constant communications about risk, risk controls, and other of possible
interest aspects of RMP.
r High profile for risk management asDa core commitment in the organization.
E
A
ELEMENTS OF AN ERM FRAMEWORK
N
The first steps to implementing ERM is D
to have a list of components that provide a comprehensive specification for the framework. Then these components
R
must be designed and the associated implementation
plan developed. Most ERM
frameworks, including ISO 31000, do not specify
these
components but rather give
A
conceptual guidance on the framework and its relational structure. In this section
a set of seven main components and their subcomponents for the ISO framework
are introduced after a short conceptual outline
1 of the ISO framework.
1
ERM Framework: Concept and Elements
2
The underlying concept in ISO 31000 for3an ERM framework is a quality management approach using the Deming paradigm of Plan-Do-Check-Act (PDCA)
T
(Deming 1986). The quality of decision making
in an organization is enhanced
through continuous improvement of the risk
management
framework. The frameS
work is designed, implemented, monitored, and continuously improved following
the PDCA approach.
The ERM framework in an organization supports the risk management process for decision making in the organization. The framework also aggregates
information on risks, risk management, and performance of risk controls in the
organization. The Risk Management Process (RMP) is the key element of the ERM
framework. The RMP ensures that risk management and the operation of risk
Copyright ©2010 John Wiley & Sons, Inc.
P1: OTA/XYZ
P2: ABC
c07
JWBT177-Simkins
October 24, 2009
9:18
Printer Name: Hamilton
ERM FRAMEWORKS
101
controls will increase good consequences and reduce bad consequences within a
continuous improvement cycle.
The framework has to be practical. Managers are usually overworked and one
extra responsibility for which they are accountable needs to be manageable if it is
to be done effectively. Overly prescriptive approaches, while comprehensive and
detailed, may be too onerous and counterproductive. Therefore a principle-based
approach is used and adopted to the circumstances. Successful frameworks are
usually simple to understand and to implement yet allow for sophistication and
subtlety in their application and continuous improvement. As a general rule efforts
in risk management should be proportional to the magnitude of the risk and/or
the benefits of the risk controls including impacts
on stakeholders.
G
The framework and RMP should use standard terminology and processes.
A
Where possible, ISO Guide 73 terminology should be used and if other terms are
T
used then a link should be made to ISO terminology.
For example, if environmental scan is used then it should be linked to
the
ISO
term
external context so the
E
relationship to the framework is clear. Many shortcomings of current risk manageS
ment are due to the use of nonstandard terminology
and the resulting ineffective
communication, lack of understanding, and
less
innovation.
,
An ERM framework has seven components:
1. Mandate and commitment to the ERM
D framework.
a. Agreement in principle to proceed with ERM.
E
b. Gap analysis.
c. Context for framework.
A
d. Design of framework.
N
e. Implementation plan.
2. Risk management policy
D
a. Policies for the ERM framework, its processes and procedures.
R
b. Policies for risk management decisions:
r Risk appetite.
A
r Risk criteria.
r Internal risk reporting.
1
3. Integration of ERM in the organization.
4. Risk Management Process (RMP).
1
a. Context.
b. Risk assessment (identification, 2
analysis, and evaluation).
c. Risk treatment.
3
d. Monitoring, review, and actions.
T
e. Communications and consultation.
5. Communications and reporting. S
6. Accountability.
a. Risk ownership and risk register.
b. Managers performance evaluation.
7. Monitoring, review, and continuous improvement.
a. Responsibility for maintaining and improving ERM framework.
b. Approach to risk maturity and continuous improvement of ERM
framework.
Copyright ©2010 John Wiley & Sons, Inc.
P1: OTA/XYZ
P2: ABC
c07
JWBT177-Simkins
102
October 24, 2009
9:18
Printer Name: Hamilton
ERM Management, Culture, and Control
Exhibit 7.1 illustrates a typical framework for an organization to implemented
ERM according to ISO 31000 (Broadleaf 2008). It shows in addition to the main
components of an ERM framework, other processes and functions necessary for
implementation and continuous improvement. It is expected that each organization
will customize the ISO framework to suit their organizations structure, roles, and
responsibilities, with a view to making integration of risk management easier and
more effective.
In Exhibit 7.1 the outer set of four boxes is a Plan-Do-Check-Act (PDCA) format modified for implementing an ERM framework in an organization, namely:
Commit & Mandate (Act); Communicate & Train (Do); Structure & Accountability (Do); and Review & Improve G
(Check and Act). The plan step is not
shown directly but it results in the framework design shown in Exhibit 7.1.
A
The inner set of five boxes in Exhibit 7.1 is the RMP from ISO 31000. It
T
is used for any decision in the organization.
RMP has tasks or activities of
Establish context, Risk assessment, E
Treat risks, Communicate and consult, and Monitor and review. Exhibit 7.1 illustrates the relationship between
S is a component of the ERM framethe ERM framework and the RMP, which
work. There is also an administrative activity
shown: Management Informa,
tion System, which provides the interface between the organizations overall
risk management framework and the hundreds or thousands of RMPs within
the organization. The risk management information
system acts to roll up all the
D
risks in the organization for purposes of risk appetite, as well as roll down the
E owners for purposes of local risk
framework to the individual risk and control
criteria.
A
N
D
RISK MANAGEMENT PROCESS
(RMP)
R
This section describes the ISO RMP as shown in the inner boxes of Exhibit 7.1.
Exhibit 7.1 illustrates the traditional set ofArisk management tasks to support and
assist decision making by any manager anywhere in the organization. Context sets
the stage for the decision or activity requiring risk management; risk assessment
1 risk treatment enhances the likelihood
identifies, analyzes, and evaluates the risks;
of positive consequences and reduces the likelihood of negative consequences to
1
acceptable or tolerable levels; monitoring and review keeps close watch over the risk
2 risk; and communication and consultaand the controls implemented to modify the
tion is continuous to ensure that the stakeholders
are engaged and contribute to
3
the management of risks.
T presented because it is used for all
The RMP is the first framework component
decisions in the organization. RMP is a method
S to modify risks to create value. The
ERM framework exists primarily to facilitate application of the RMP everywhere
in the organization.
The RMP in Exhibit 7.1 is not a flow chart but a relational diagram that
must be tailored to the individual organization before implementation as a
process flow chart. The tailored implementation ensures that risk management is both practical and aligned with the organizations structures, processes,
and objectives.
Copyright ©2010 John Wiley & Sons, Inc.
P1: OTA/XYZ
P2: ABC
c07
JWBT177-Simkins
October 24, 2009
9:18
Printer Name: Hamilton
ERM FRAMEWORKS
Commit and Mandate
Establish context
Strategic Process
Analyze risks
Evaluate risks
G
A
TProcess
Risk Management
E
Management Information System
S
Risk Registers
Treatment Plans
Assurance Plan Reporting templates
,
Stakeholder analysis
Training needs analysis
Communication strategy
Training strategy
Network
Strategic Process
Monitor and review
Identify risks
Communicate and consult
Risk assessment
Control assurance
RM Plan progress
RM maturity evaluation
RM KPIs
Benchmarking
Governance reporting
Communicate and Train
Strategic Process
Policy statement
Standards
Guidelines
RM Plan and RM Process
Assurance plan
Review and Improve
103
Treat risks
Strategic Process
Structure and Accountability
Board RM Committee
Executive RM Group
RM Working Group
Manager, Risk Management
RM Champions
Risk and Control Owners
D for Implementing ERM Including the
Exhibit 7.1 An ISO 31000 Compatible Framework
Risk Management Process
E
C Broadleaf Capital International Pty Ltd., 2008, www.Broadleaf.com.au. Used with permission
Source:
of Broadleaf Capital Internationaladapted from a presentation at IRR workshop on Implementing
Risk Management ISO 31000 style; Toronto (2008), see www.IRR-NERAM.ca.
A
N
D
There is a range of approaches to RMPRthat reflects the context of the risk. For
example, the risk context may vary at one extreme from:
A
r Routine operations where risks are well known from historical data, asso-
1
ciated processes are relatively straightforward,
mistakes are expensive and
avoidable, controls are well known and standard, and so forth. Examples
1
include consumer loans and installing electrical …
Purchase answer to see full
attachment
