Business risk management

Business risk management (also: enterprise r.m., corporate r.m.) is a set of activities related to planning, organizing, leading and controlling the organization's processes in order to minimize the effects of risks and utilize potential opportunities. It is not limited to finance, but includes also other areas as environment, information security and quality management. The modern approach uses the same methodology to treat risks and opportunities.

Risk management frameworks

Casualty Actuarial Society (CAS) framework

The Casualty Actuarial Society defined the RM framework in 2003. It defines risk types:

• Hazard risk - property damage, natural disasters
• Financial risk - related to currency, assets, pricing, liquidity
• Operational risk - related to customer, product, reputation
• Strategic risk - competition, social trends, shareholders

The risk management process includes:

• Establishing context
• Identifying risks
• Analysing risks
• Assessing risks
• Treating risks
• Monitoring and reviewing

COSO ERM framework

The COSO Enterprise Risk Management - Integrated Framework was published in 2004. It defined enterprise risk management as a process, effected by an entity's board of directors, management, and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives [COSO 2004]. The risk management falls into four categories:

• strategy
• operations
• financial reporting
• compliance

The COSO identifies 8 risk management components, which include:

• Internal Environment
• Objective Setting
• Event Identification
• Risk Assessment
• Risk Response
• Control Activities
• Information and Communication
• Monitoring

RIMS Risk Maturity Model

RIMS Risk Maturity Model was published in 2006. It isn't a methodology or framework, but works rather as an umbrella for different approaches. The model describes competency drivers that are important for company risk management. They were grouped into 7 categories:

• ERM-based approach
• ERM process management
• Risk appetite management
• Root cause discipline
• Uncovering risks
• Performance management
• Business resiliency and sustainability

The idea of maturity models became popular in last years. After Capability Maturity Model many scientist and organizations creates own maturity models. They help to compare systems of different organizations.

Risk management standard

The issue of risk in management systems appeared in the ISO standards in 1996, with the publication of ISO 13335-1. It was developed by ISO 13335-3 in 1998. Those standards were developed in context of information security. Their approach was adopted by standard for information security management systems (ISO 27001). Those standards were withdrawn.

The current international standard for risk management is ISO 31000. It was published in 2009. Detailed description of the standard was presented in article ISO 31000.

Problems of business risk management

• Lack of executive support. Often top managers don't see value of risk management. They prefer rather to react on problems than think ahead of many possible risk factors. Implementation of business risk management without executive support is difficult and never gives the full value in return.
• Changes of responsibilities. The risk management system shouldn't rely on persons, but on structure and processes. People change their jobs sometimes. Therefore, the RM system should be prepared for such a change.
• Organizational culture. Risk management system requires some centralization, which is not welcome in decentralized organizations. However the structure of the system can be adapted to every enterprise. Just don't copy the system from another company.
• Organizational structure. Risk management, in order to work properly, has to be high in organizational structure. Otherwise risk management department won't be listened by top managers. It will be only blamed for all failures.
• Communication. The expectations, responsibilities, plans and activities should be communicated across the board in order to have everyone on the same page.
• Lack of discipline. The risk management doesn't end with initial risk evaluation. It requires systematic work. Otherwise it won't deliver.
• Lack of competences. The risk management methodology looks simple: likelihood and consequences. But the problems begin as soon as you try to implement results of the risk assessment. This requires not only technical skills but also political ones.
• Lack of budget. Every activity in the enterprise requires money. The aim of business risk management is to save money, but you have to invest some first.
• Lack of value. The risk management team has to articulate the values for the company from RM system. The goals should be reviewed and updated systematically. Success factors should be analysed.

Examples of Business risk management

• Risk Identification and Assessment: This involves identifying the potential risks associated with a business or organization, analyzing their impacts and the likelihood of their occurrence, and assigning a risk rating. This helps to prioritize the risks, allowing the organization to prioritize resources and address the most serious risks first.
• Risk Mitigation: Once the risks are identified and assessed, the organization can develop and implement strategies to mitigate the risks. This may involve implementing policies and procedures, improving safety measures, and introducing additional controls and processes.
• Risk Monitoring: Once the risk mitigation strategies are in place, the organization needs to monitor their effectiveness and identify any new risks that may arise. This helps the organization to stay ahead of any potential risks and address them quickly.
• Risk Management Plan: A risk management plan documents the organization’s risk management strategy, outlining its risk identification, assessment, and mitigation activities. It also outlines the organization’s risk management policies and procedures, and provides guidance for dealing with risks.
• Insurance: Insurance is often used as a way to manage and transfer risk. Organizations can purchase insurance policies to protect against losses from potential risks, such as property damage, business interruption, and liability claims.

Advantages of Business risk management

Business risk management brings many advantages to an organization, such as:

• Improved business performance: Companies can use risk management to identify and prioritize risks, assess the potential impacts of those risks, and develop strategies to address them. This can lead to improved operational efficiency and cost savings.
• Increased profitability: By properly managing risks, companies can reduce their exposure to losses, resulting in increased profitability.
• Improved decision making: Risk management helps to identify and analyze potential risks, enabling companies to make better decisions.
• Improved customer satisfaction: Companies can use risk management to identify and address customer-related risks, resulting in improved customer satisfaction.
• Increased stakeholder confidence: By managing risks, companies can demonstrate to stakeholders their commitment to good governance, which increases confidence in the business.
• Improved reputation: Companies that effectively manage risks can improve their reputation in the marketplace, leading to increased business opportunities.

Limitations of Business risk management

• Business risk management is limited by the scope of the organization, as decisions are often made on a higher level, and may not reflect the risks associated with certain activities.
• As organizations become larger and more complex, it can be difficult to identify and assess all the risks associated with a particular action or decision, making it difficult to properly manage the associated risks.
• Business risk management is limited by the resources available to the organization. It can be difficult to allocate appropriate resources to address risk management needs, or to monitor and evaluate the effectiveness of risk management efforts.
• Business risk management is also limited by the knowledge and experience of the individuals responsible for managing risks. Without the right skills, knowledge and experience, risk management efforts may be ineffective or even counterproductive.
• Finally, business risk management is limited by the willingness of employees and other stakeholders to take risks. In some cases, employees may be reluctant to take risks or may be unaware of the potential risks associated with a particular action or decision.

Other approaches related to Business risk management

Aside from the modern approach to business risk management, there are other approaches that use different methodologies to address risks and opportunities.

• Risk Analysis: This approach involves the evaluation of potential risks that a business may encounter and how to best prevent or mitigate them. It includes identifying potential threats, evaluating their probability of occurrence, and determining the best ways to respond if they occur.
• Risk Management Planning: This includes developing strategies to limit the impact of risks on the business. It includes setting objectives, defining risk tolerances, and creating a risk management framework.
• Risk Monitoring: This approach involves regularly monitoring the environment for changes that could affect the business and its risks. It also includes reviewing existing risk management plans and identifying any gaps that need to be addressed.
• Risk Mitigation: This involves taking steps to reduce the impact of risks. This can include implementing controls, creating backup plans, and developing alternative strategies.

In summary, business risk management involves a number of approaches to identify, assess, manage, and mitigate risks and opportunities in order to maximize the potential for success. These approaches include risk analysis, risk management planning, risk monitoring, and risk mitigation.

Business risk management — recommended articles

Risk management process — Strategic risk management — Strategy deployment — Risk management strategy — Implementation of information security management system — Risk category — Risk treatment plan — Benefits of risk management — Risk evaluation

References

• COSO (2004), Enterprise Risk Management - Integrated Framework
• RIMS (2016), What is ERM? Guide
• PwC, How ERM programs evovle?

Author: Slawomir Wawak