CIMA P3 Syllabus A. Enterprise risk - Enterprise Risk Management - Notes 1 / 10
Enterprise Risk Management
COSO
We will be using models and definition developed by The Committee of Sponsoring Organisations of the Treadway Commission (COSO)
COSO is a key organisation in thought leadership in risk and control.
Enterprise risk management
ENTERPRISE RISK MANAGEMENT (ERM) is a process designed to identify potential events that may affect the entity and manage risks to be within its risk appetite
COSO states that enterprise risk management has the following characteristics.
Process
These should tie up with existing operations and exist for fundamental business reasons
Operated at every level
Provides a consistent mechanism for helping people to understand risk, their responsibilities and level of authority
Applied in strategy setting
Management considers the risks inherent in the strategies that they assess
Applied across the enterprise
Takes into account activities at all levels of business, from strategic planning and resource allocation, to business unit activities and business planning
Identifies key events and manage their risks
Events that affect the organisation and manage risk within risk appetite, amount of risk accepted in pursuit of value, aligned with desired return from strategy
Provides reasonable reassurance
Assurance can at best be reasonable, as risk relates to an uncertain future
Geared to achievement of objectives
Objectives including supporting organisation's mission, making effective and efficient use of organisation's resources, ensuring reporting is reliable and complying with applicable laws and regulations
Framework of enterprise risk management
The COSO framework consists of 8 interrelated components:
Internal environment or control environment
Objective setting
Event identification
Risk assessment
Risk response
Control activities
Information and communication
Monitoring
Diagrammatically all of the above may be summarised as follows.
Objective setting
ERM emphasises the importance of setting objectives at entity and activity levels and identifying critical success factors.
Objectives need to exist before management can recognise potential events affecting their achievement.
Objectives should support and align with the organisation's mission and are consistent with its risk appetite.
COSO categorises objectives into 4 categories, illustrated on another face of the cube:
Strategic
- high level goals, aligned with, and supporting, the organisation's mission
Operational
- effective and efficient use of resources
Reporting
- reliability of reporting
Compliance
- compliance with applicable laws and regulations
Components of entity
The third dimension of the cube reflects the different ways in which the entity can be analysed.
It shows that the business can focus on objectives and risk management at the:
entity level
division
subsidiary
business unit level
Benefits of enterprise risk management
Alignment of risk appetite and strategy
The framework demonstrates to managers the need to consider risk toleration.
They then set objectives aligned with business strategy and develop mechanisms to manage the accompanying risks.
This will help to ensure that risk management becomes part of the culture of the organisation, embedded into all its processes and activities.
Link growth, risk and return
Risk is part of value creation, and organisations will seek a given level of return for the level of risk tolerated.
Choose best risk response
Enterprise risk management helps the organisation select whether to reduce, eliminate or transfer risk.
Minimise surprises and losses
By identifying potential loss-inducing events, the organisation can reduce the occurrence of unexpected problems.
Identify and manage risks across the organisation
The Framework means that managers can understand and aggregate connected risks.
It also means that risk management is seen as everyone's responsibility.
Experience and practice is shared across the business and a common set of tools and techniques is used.
Provide responses to multiple risks
For example, risks associated with purchasing, over - and under-supply, prices and dubious supply sources might be reduced by an inventory control system that is integrated with suppliers.
Seize opportunities
By considering events as well as risks, managers can identify opportunities as well as losses.
Rationalise capital
Enterprise risk management allows management to allocate capital better and make a sounder assessment of capital needs.
Criticisms of enterprise risk management
Internal focus
One criticism of the ERM model has been that it starts at the wrong place.
It begins with the internal and not the external environment.
Critics claim that it does not reflect sufficiently the impact of the competitive environment, regulation and external stakeholders on risk appetite and management and culture.
Risk identification
The ERM model has been criticised for discussing risks primarily in terms of events, particularly sudden events with major consequences.
Critics claim that the guidance insufficiently emphasises slow changes that can give rise to important risks, for example, changes in internal culture or market sentiment.
Risk assessment
The ERM model has also been criticised for encouraging an over-simplified approach to risk assessment.
It has been claimed that the ERM encourages an approach which thinks in terms of a single outcome of a risk materialising.
This outcome could be an expected outcome or it could be a worst-case result.
Many risks will have a range of possible outcomes if they materialise, for example, extreme weather, and risk assessment needs to consider this range.
Stakeholders
The guidance fails to discuss the influence of stakeholders, although many risks that organisations face are due to a conflict between the organisation's objectives and those of its stakeholders.
CIMA's risk management cycle
ClMA's suggested approach to risk management is illustrated in the diagram below. It is based on the idea of continual feedback that is inherent in management control systems that we shall consider in later chapters.
Exam alert
When using CIMA's risk management cycle to evaluate a strategic decision you should focus on setting goals, identifying risk areas, assessing the scale of risks and developing a risk response.