Enterprise Risk Management 1 / 10

Enterprise Risk Management

COSO

We will be using models and definition developed by The Committee of Sponsoring Organisations of the Treadway Commission (COSO) 

COSO is a key organisation in thought leadership in risk and control.

Enterprise risk management

ENTERPRISE RISK MANAGEMENT (ERM) is a process designed to identify potential events that may affect the entity and manage risks to be within its risk appetite

COSO states that enterprise risk management has the following characteristics.

  • Process

    These should tie up with existing operations and exist for fundamental business reasons

  • Operated at every level

    Provides a consistent mechanism for helping people to understand risk, their responsibilities and level of authority

  • Applied in strategy setting

    Management considers the risks inherent in the strategies that they assess

  • Applied across the enterprise

    Takes into account activities at all levels of business, from strategic planning and resource allocation, to business unit activities and business planning

  • Identifies key events and manage their risks

    Events that affect the organisation and manage risk within risk appetite, amount of risk accepted in pursuit of value, aligned with desired return from strategy

  • Provides reasonable reassurance

    Assurance can at best be reasonable, as risk relates to an uncertain future

  • Geared to achievement of objectives
    Objectives including supporting organisation's mission, making effective and efficient use of organisation's resources, ensuring reporting is reliable and complying with applicable laws and regulations

Framework of enterprise risk management

The COSO framework consists of 8 interrelated components:

  1. Internal environment or control environment

  2. Objective setting

  3. Event identification

  4. Risk assessment

  5. Risk response

  6. Control activities

  7. Information and communication

  8. Monitoring

Diagrammatically all of the above may be summarised as follows.

Objective setting

ERM emphasises the importance of setting objectives at entity and activity levels and identifying critical success factors.

Objectives need to exist before management can recognise potential events affecting their achievement. 

Objectives should support and align with the organisation's mission and are consistent with its risk appetite.

COSO categorises objectives into 4 categories, illustrated on another face of the cube:

  • Strategic 

    - high level goals, aligned with, and supporting, the organisation's mission

  • Operational 

    - effective and efficient use of resources

  • Reporting 

    - reliability of reporting

  • Compliance 

    - compliance with applicable laws and regulations

Components of entity

The third dimension of the cube reflects the different ways in which the entity can be analysed. 

It shows that the business can focus on objectives and risk management at the:

  • entity level

  • division

  • subsidiary

  • business unit level

Benefits of enterprise risk management

  • Alignment of risk appetite and strategy

    The framework demonstrates to managers the need to consider risk toleration. 

    They then set objectives aligned with business strategy and develop mechanisms to manage the accompanying risks. 

    This will help to ensure that risk management becomes part of the culture of the organisation, embedded into all its processes and activities.

  • Link growth, risk and return

    Risk is part of value creation, and organisations will seek a given level of return for the level of risk tolerated.

  • Choose best risk response

    Enterprise risk management helps the organisation select whether to reduce, eliminate or transfer risk.

  • Minimise surprises and losses

    By identifying potential loss-inducing events, the organisation can reduce the occurrence of unexpected problems.

  • Identify and manage risks across the organisation

    The Framework means that managers can understand and aggregate connected risks. 

    It also means that risk management is seen as everyone's responsibility. 

    Experience and practice is shared across the business and a common set of tools and techniques is used.

  • Provide responses to multiple risks

    For example, risks associated with purchasing, over - and under-supply, prices and dubious supply sources might be reduced by an inventory control system that is integrated with suppliers.

  • Seize opportunities

    By considering events as well as risks, managers can identify opportunities as well as losses.

  • Rationalise capital

    Enterprise risk management allows management to allocate capital better and make a sounder assessment of capital needs.

Criticisms of enterprise risk management

  • Internal focus

    One criticism of the ERM model has been that it starts at the wrong place. 

    It begins with the internal and not the external environment. 

    Critics claim that it does not reflect sufficiently the impact of the competitive environment, regulation and external stakeholders on risk appetite and management and culture.

  • Risk identification

    The ERM model has been criticised for discussing risks primarily in terms of events, particularly sudden events with major consequences. 

    Critics claim that the guidance insufficiently emphasises slow changes that can give rise to important risks, for example, changes in internal culture or market sentiment.

  • Risk assessment

    The ERM model has also been criticised for encouraging an over-simplified approach to risk assessment.

    It has been claimed that the ERM encourages an approach which thinks in terms of a single outcome of a risk materialising. 

    This outcome could be an expected outcome or it could be a worst-case result. 

    Many risks will have a range of possible outcomes if they materialise, for example, extreme weather, and risk assessment needs to consider this range.

  • Stakeholders

    The guidance fails to discuss the influence of stakeholders, although many risks that organisations face are due to a conflict between the organisation's objectives and those of its stakeholders.

CIMA's risk management cycle

ClMA's suggested approach to risk management is illustrated in the diagram below. It is based on the idea of continual feedback that is inherent in management control systems that we shall consider in later chapters.

Exam alert

When using CIMA's risk management cycle to evaluate a strategic decision you should focus on setting goals, identifying risk areas, assessing the scale of risks and developing a risk response.

We use cookies to help make our website better. We'll assume you're OK with this if you continue. You can change your Cookie Settings any time.

Cookie SettingsAccept