Green Enterprise Risk Management

A Common Framework for the Entire Organization
1. Auflage 2015
ISBN: 978-0-12-800676-4
Verlag: Elsevier Science & Techn.
Format: EPUB
Kopierschutz: 6 - ePub Watermark

E-Book, Englisch, 260 Seiten

Enterprise Risk Management: A Common Framework for the Entire Organization discusses the many types of risks all businesses face. It reviews various categories of risk, including financial, cyber, health, safety and environmental, brand, supply chain, political, and strategic risks and many others. It provides a common framework and terminology for managing these risks to build an effective enterprise risk management system. This enables companies to prevent major risk events, detect them when they happen, and to respond quickly, appropriately, and resiliently. The book solves the problem of differing strategies, techniques, and terminology within an organization and between different risk specialties by presenting the core principles common to managing all types of risks, while also showing how these principles apply to physical, financial, brand, and global strategy risks. Enterprise Risk Management is ideal for executives and managers across the entire organization, providing the comprehensive understanding they need, in everyday language, to successfully navigate, manage, and mitigate the complex risks they face in today's global market. - Provides a framework on which to build an enterprise-wide system to manage risk and potential losses in business settings - Solves the problem of differing strategies, techniques, and terminology within an organization by presenting the core principles common to managing all types of risks - Offers principles which apply to physical, financial, brand, and global strategy risks - Presents useful, building block information in everyday language for both managers and risk practitioners across the entire organization

Philip Green is CEO of First Resource Management Group Inc., which manages forests in Canada. Before this he was president of Greenbridge Management Inc., which provided risk management, process management, continuous improvement and statistical consulting services to industries in North and South America, Europe and Asia. He is co-author of misLeading Indicators: How to Reliably Measure your Business (with Prof George Gabor of Dalhousie University) published by Praeger. He has an M.Sc. in Statistics from McMaster University (1984).

Autoren/Hrsg.

Green, Philip E. J.

Inhaltsverzeichnis

1;Front Cover;1
2;Enterprise Risk Management;4
3;Copyright Page;5
4;Dedication;6
5;Contents;8
6;Author Biographies;14
7;1 Introduction to Risk Management Principles;20
7.1;What is Risk?;21
7.2;Risk Context;23
7.3;Risk Assessment;23
7.3.1;Risk Identification;24
7.3.2;Risk Analysis;24
7.3.3;Risk Prioritization;26
7.4;Risk Treatment;26
7.5;Risk Monitoring and Review;28
7.6;Reasoning about Probability, Uncertainty, and Likelihood;28
7.7;Structure of this Book;31
7.8;Notes;31
8;I. Physical Risk Management;34
8.1;2 Environmental Risk;36
8.1.1;Environmental Risks—the Social Dimension;36
8.1.2;Environmental Risk—the Legal Dimension;38
8.1.3;Types of Environmental Risks;39
8.1.4;Identifying Environmental Risks;41
8.1.4.1;Document Review;41
8.1.4.2;Site Review;42
8.1.4.3;Formal Environmental Risk Assessments in Operations;43
8.1.5;Environmental Risk Management: The Noranda Model—and Beyond;44
8.1.6;Approvals for Large Industrial Projects: The Environmental Risks;46
8.1.7;Who Does What?;47
8.1.7.1;Line versus Staff Roles;47
8.1.7.2;The Role of the Board of Directors and Senior Managers—Governance;48
8.1.7.3;Management Incentives;48
8.1.7.4;The Importance of Corporate Culture—from the Board Room to the Shop Floor;49
8.1.8;Notes;49
8.2;3 Health and Safety Risk Management: Perspective of a Petroleum Refinery Manager;52
8.2.1;Effects of Health and Safety on Organizations;52
8.2.1.1;Human Effects;53
8.2.1.2;Material Effects;53
8.2.1.3;Intangible Effects;53
8.2.1.4;Legal Effects;53
8.2.1.5;Personal Effects;54
8.2.1.6;Financial Effects;55
8.2.2;Safety Culture;55
8.2.3;Risk Assessment—Cornerstone of the Program;58
8.2.3.1;Risk Identification;59
8.2.3.2;Risk Analysis;60
8.2.3.3;Risk Prioritization;61
8.2.4;Risk Treatment;62
8.2.5;Risk Monitoring and Review;63
8.2.6;Current Trends in Health and Safety Risk Management;64
8.2.7;Notes;65
8.3;4 Project Risk Management;66
8.3.1;Background;67
8.3.2;Types of Risks in Projects;68
8.3.2.1;Sources of Project Risks;68
8.3.2.2;Sources of Technical Risks;70
8.3.3;Managing Risks during the Project Life Cycle;71
8.3.3.1;Conceptual Study;71
8.3.3.2;Prefeasibility Study;72
8.3.3.3;Feasibility Study;73
8.3.3.4;Project Execution;74
8.3.4;Managing the Risk of Being Late and Exceeding Budget;75
8.4;5 Operational Risk: Building a Resilient Organization;78
8.4.1;Operational Risk—Context;79
8.4.1.1;Why Things Go Wrong;80
8.4.2;Alignment Around Risk Communication;82
8.4.3;The Elements of Operational Risk Resilience;85
8.4.3.1;Awareness and Risk Assessment;86
8.4.3.2;Treatment through Prevention and Detection (“Preparation”);87
8.4.3.3;Response and Recovery;89
8.4.3.4;Adapt and Operate in the Face of Change;90
8.4.4;Operational Risk Resilience Model;91
8.4.5;Note;92
8.5;6 Supply Chain Risk Management;94
8.5.1;Supply Chain Risk Management for the Business Line Manager;94
8.5.1.1;Main Causes of Supply Chain Disruption;95
8.5.2;Risk Assessment;97
8.5.2.1;Risk Assessment Challenges;99
8.5.2.2;Risk Analysis and Prioritization;100
8.5.2.2.1;Basic Supply Chain Health Check Questions;100
8.5.2.3;Risk Treatment;100
8.5.3;Risk Monitoring and Review;102
8.5.4;Emerging Risks in Supply Chains;102
8.5.4.1;Climate Change;102
8.5.4.2;Global, JIT, Lean Supply Chains;103
8.5.4.3;Increasing Social Inequity and Potential Supply Chain Risks;103
8.5.4.4;Increased Population and Migration;104
8.5.4.5;Dependence on Information Technology;105
8.5.5;The Benefits of Improving Supply Chain Risk Management;105
8.5.6;Notes;106
9;II. Intangible Risk;108
9.1;7 Cybersecurity;110
9.1.1;Cyber Risk Management Overview;110
9.1.1.1;Leadership and Governance;110
9.1.1.1.1;Leadership;111
9.1.1.1.2;Governance;111
9.1.1.2;Legal and Compliance;112
9.1.2;Risk Assessment;113
9.1.2.1;Sources of Risk;113
9.1.2.1.1;Cybercriminals;113
9.1.2.1.2;Petty Criminals;113
9.1.2.1.3;Organized Criminals;114
9.1.2.1.4;Hacktivists;114
9.1.2.1.5;Nation-state–sponsored Criminals;115
9.1.2.1.6;The Underground Economy;116
9.1.2.1.7;Noncompliance with Cybersecurity Requirements;116
9.1.2.1.8;Errors and Omissions;117
9.1.2.1.9;Events;118
9.1.2.2;Risk Analysis and Prioritization;118
9.1.2.2.1;Identifying Asset Value;118
9.1.2.2.2;Risk Criteria;119
9.1.2.2.2.1;Likelihood;119
9.1.2.2.2.2;Consequence;120
9.1.3;Risk Treatment;121
9.1.3.1;Business Continuity;121
9.1.3.2;Securing the Human Element;122
9.1.3.2.1;Security Awareness Training;123
9.1.3.2.2;Background and Personnel Checks;123
9.1.3.3;Operations and Technology;124
9.1.3.3.1;Technology;124
9.1.3.3.2;Operations;124
9.1.3.4;Transferring Risk;125
9.1.4;Risk Monitoring and Review;125
9.1.4.1;External Threat Monitoring;125
9.1.4.2;Visible Web;125
9.1.4.3;Invisible Web;126
9.1.4.4;Security Metrics;126
9.1.4.5;Postmortem Cybersecurity Event Reviews;127
9.1.5;Notes;127
9.2;8 Brand Risk;128
9.2.1;Why Brands Matter;129
9.2.2;The Importance of Trust;129
9.2.3;Who Owns Brand Risk Management?;130
9.2.4;The High-Speed Landscape of Brand Risk;131
9.2.5;How Counterinsurgency Theory May Help Us Manage Brand Risk;132
9.2.6;Key Takeaways;141
9.2.7;Notes;141
9.3;9 Human Capital Risk: The Threat from Inside;144
9.3.1;Nasty Events Can Happen: Source of Human Capital Risk;145
9.3.1.1;Fraud: Deliberate Misuse or Misappropriation of a Company’s Resources, Often for Personal Gain;145
9.3.1.2;Infiltration: An Insider Threat Having Both Internal and External Consequences;146
9.3.1.3;Espionage: A Clandestine Process for Acquiring Secrets;146
9.3.1.4;Sabotage: A Deliberate Act Causing Destruction, Disruption, or Physical Harm;147
9.3.1.5;Infiltration through the Contracted Workforce;147
9.3.1.6;Employees as Targets;148
9.3.1.7;Hostile and Aggressive Workplace Events;148
9.3.2;Managing Human Capital Risk;149
9.3.2.1;Changing Culture;149
9.3.2.2;Employee and Contractor Screening;150
9.3.2.3;Security Policies, Procedures, and Systems;153
9.3.2.4;Awareness and Training;153
9.3.2.5;Employee and Contractor Life Cycle Management;154
9.3.2.6;Terminations;154
9.3.3;Conclusion: An Integrated Approach to Managing Malicious Human Capital Risks;155
9.3.4;Notes;155
9.3.5;Further Reading;156
10;III. Financial Risk Management;158
10.1;10 An Aggregated Approach to Risk Analysis: Risk Portfolios;160
10.1.1;The Challenges of the Traditional “Siloed” Approach to Risk Analysis;160
10.1.2;The Benefits of an Aggregated (Risk Portfolio) Approach to Risk Analysis;162
10.1.3;Operationalizing a Risk Portfolio;164
10.1.4;Risks Associated with Implementing a Risk Portfolio;166
10.1.5;Making a Decision to Implement a Risk Portfolio;166
10.1.6;Notes;167
10.2;11 Managing Common Financial Risks;170
10.2.1;Types of Financial Risk;170
10.2.1.1;Currency Risk;170
10.2.1.2;Commodity Risk;171
10.2.1.3;Credit Risk;172
10.2.1.4;Liquidity Risk;172
10.2.1.5;Market Risk;173
10.2.2;Financial Risk Mitigation Strategies;173
10.2.2.1;Behavioral Biases that Create Financial Risk;173
10.2.2.1.1;Cognitive Errors;174
10.2.2.1.2;Emotional Biases;175
10.2.2.2;Unhedged Strategies;176
10.2.2.3;Hedging;176
10.2.3;Notes;178
10.3;12 The Role of Insurance in Enterprise Risk Management;180
10.3.1;Risk and Value;181
10.3.1.1;Determinants of Value;181
10.3.1.2;How Risk Affects Value;183
10.3.2;The Supply of Insurance;184
10.3.2.1;Insurance Pricing in a Competitive Market4;184
10.3.2.2;Factors Limiting the Availability of Insurance;185
10.3.3;Demand for Insurance by Public Companies;186
10.3.3.1;Shareholder Diversification of Risk;186
10.3.3.2;Commercial Insurance Reduces Firm-Specific Risk;186
10.3.3.3;Impact of Systematic and Firm-Specific Risk on Value;187
10.3.3.4;Effect of Insurance on Expected Cash Flows7;187
10.3.3.5;Demand for Insurance by Closely Held Companies;189
10.3.3.6;Other Management Objectives and Risk Management;189
10.3.4;Interaction between Mitigation and Insurance;190
10.3.5;Summary Questions to Ask;191
10.3.6;Notes;191
11;IV. Global and Strategic Risk;194
11.1;13 Risk Culture;196
11.1.1;Risk Culture and Organizational Culture;197
11.1.2;Risk Culture in Financial Services;198
11.1.3;Safety Culture;201
11.1.4;Measuring Risk Culture;202
11.1.5;Managing Risk Culture;205
11.1.6;Rewards and Performance Management;205
11.1.7;Incentives Create Rather than Control Risk;207
11.1.8;Risk Identification;207
11.1.9;Risk Analysis;208
11.1.10;Risk Prioritization;208
11.1.11;Actions to Treat Incentive Risk;209
11.1.11.1;Incentive Governance;210
11.1.11.2;Performance Management;210
11.1.12;Conclusions;211
11.1.13;Notes;212
11.2;14 The Role of the Board of Directors in Risk Management;214
11.2.1;Directors Govern, Managers Manage;214
11.2.2;Providing Leadership and Affecting Risk Culture;216
11.2.3;Structuring Boards to Govern Risk Management;218
11.2.4;The Information on Which Boards Rely;221
11.2.5;Demands on Directors from Stakeholders and Litigation;222
11.2.6;Conclusion;223
11.2.7;Notes;224
11.3;15 Political Risk;226
11.3.1;The Arab Spring;227
11.3.2;Identifying Sources of Political Risk;228
11.3.2.1;Crisis Contagion;228
11.3.2.2;How Likely Are the Risks You Face?;229
11.3.2.3;Responding to the Unexpected;229
11.3.2.4;Political Risk May Be Counterintuitive;229
11.3.2.5;Reputational Risk;230
11.3.3;Political Risk Assessment;231
11.3.4;Mitigating Political Risk;233
11.3.5;Notes;236
11.4;16 Strategic Risk: The Risks “of” and “to” a Strategy: The Case of Blockbuster and the Need for Strategic Flexibility;238
11.4.1;Tradeoffs and the Risks of a Strategy;240
11.4.2;Innovation and the Risks to a Strategy;242
11.4.3;Assessing Strategic Risks;244
11.4.4;Strategy, Innovation, and Flexibility;248
11.4.5;Notes;249
12;Index;250

Leseproben

1

Introduction to Risk Management Principles

Philip E.J. Green*

This chapter defines a common process and vocabulary for managing and implementing enterprise risk management in an organization. The process is common to all types of risks and is applied in the remaining chapters of the book. This eliminates semantic differences between chapters and topics so that the reader can focus on the substantive aspects of each type of risk and how it relates to other types of risk and enterprise risk management as a whole. The main elements of the process are establishing the context for risk management, risk assessment, risk treatment, risk monitoring, and risk review. Reasoning about probability, probabilistic reasoning, uncertainty, and likelihood, as well as the challenges of “measuring” risk, are also covered.

Keywords

risk management; risk assessment; risk mitigation; enterprise risk management; ISO 31000; probability; uncertainty; key risk indicators

Ultimately it is the business manager, not the risk specialist, who is responsible when things go wrong. The challenge the manager faces is that the many fields of risk management are dominated by specialists and jargon. The insurance broker, the safety manager, the cybersecurity specialist, the financial risk manager, and the engineer all use different language to describe risk. Even within each specialty there are variations in the way language is used, making it hard for a generalist to distinguish between what is particular about risk management in one field versus another—say, cybersecurity versus safety—and what is common, and thus what should be done by the specialist and by the generalist.

Another challenge is the seemingly infinite variety of risk management . If you search the Internet for “risk management process,” you will quickly see the wide variety of approaches favored by different consultants and experts. There are four-, five-, six-, and nine-step risk management processes. There are risk management cycles, flowcharts, pyramids, and decision trees. There is obviously value in the creativity of the human mind applied to risk. But there is also value in simplification and standardization.

This book aims to equip the reader to effectively manage an organization’s risks, to provide the reader with a common vocabulary and process for managing all types of risk and to provide insights into each of the particularities of several critical types of risk. The idea is to help readers focus on the substantive aspects of several risk specialties, rather than on the semantic and procedural.

This chapter sets out a vocabulary and risk management process common to the remaining chapters of the book (terms commonly used throughout the book are underlined in this chapter). All the authors have contributed to this chapter. In their own chapters, they have applied its concepts to their specific field of risk management. The terminology and the risk management process we have adopted for the book are inspired from an international risk management standard.1 This book is respectful toward, but does not take a position on, that standard; nor does it blindly adhere to it. We do not claim that the words and the risk management process are novel. But what is novel is our use of them as a common approach applicable to the entire enterprise as well as to multiple types of risk—hence the title. This book cannot cover all types of risk that an enterprise faces. By showing that different experts use a similar thought process and language, but employed from different viewpoints, I hope that the common approach will be clear to readers, allowing them to extend principles covered in this and the other chapters to specialties not covered herein.

The idea of a risk specialty is somewhat fluid. A single event may have multiple consequences; sometimes they can escalate or cascade in a ripple effect. These consequences may even affect areas of the business considered to be under the domain of different risk specialties. For example, a pipeline spill may injure employees or the public (health and safety risk), kill fish and pollute a river (environment and sustainability risk), shut down operations (operational risk), harm a pipeline company’s brand or reputation (brand risk), disrupt supply chains (supply chain risk), increase insurance premiums and cost billions to clean up, causing share prices to drop (financial risk), change the political context in which the pipeline company is hoping to gain approval for a new pipeline (political risk), and disrupt the company’s growth strategy (strategic risk). Complicating matters, specialists often view risks through their own lenses: The safety manager might classify a pipeline spill as a safety risk, the marketing executive as a brand risk, and the loss control manager as a financial risk, and so on, all dealing with the risk with their own specialty’s tools and jargon. It is much better to have a common approach and an enterprise-wide risk management system.

What is Risk?

What is risk? The word contains two key ideas: uncertainty and outcomes. In common usage, people associate risk with negative outcomes more than with positive ones, but usually both are present. The idea of outcomes can be broadened to think of goals or objectives. A jaywalker may have two objectives: to save time instead of waiting for a green traffic light, and to cross the street without being hit by a car. There is uncertainty about whether he can jaywalk and meet those objectives. The first objective relates to a positive outcome (saved time), the second to a negative outcome (injury).

Risk can thus be thought of as the . This book expresses risk as , such as being hit by a car while jaywalking, .

There are several ways that people commonly use the word risk. Some use it to refer to the likelihood of an event’s happening, others to the consequences if it does happen. For example, when someone states that California has greater earthquake risk than New York, he or she could be saying that earthquakes are more likely in California. Or when someone states that XYZ Corp has greater risk, should a cyberattack occur, than another company does, he or she could mean that XYZ Corp would have a greater loss if a cyberattack were to occur. In fact, risk deals with both likelihood and consequences. People also commonly use the term to refer to unpredictability or variability in outcomes. For example, financial analysts will say that a high-tech stock has greater risk than a utility stock because the returns on the high-tech stock have greater variability or are thus more difficult to predict. In other words, there is greater uncertainty over the desired outcome of a return on the investment.

What is enterprise risk management? Enterprise risk management is a system in which managers are concerned with managing the risks of the entire enterprise. In a more traditional approach various specialists focus on specific or “pure” risks, which are not aggregated to provide a view of the risk the enterprise faces.

What is risk management? Risk management is the coordinated set of principles, processes, activities, roles and responsibilities, and infrastructure, combined into a system and used to control the actions of an organization in light of the risks it faces.

Enterprise risk management applies many of the fundamental principles of management; indeed, it is an integral part of management. The contributors to this book have emphasized these principles from different viewpoints, but two receive special attention: communication and accountability (or responsibility). The authors look at these issues through the perspective of their own risk specialty, but taken together, they provide useful insights that are applicable to other types of risk. For example, Chapter 5 discusses operational risk and describes a top-to-bottom communication process (illustrated by Figure 5–2 of that chapter) that melds nicely with the process described in Chapter 9 regarding the portfolio method of aggregating risks. A challenge with the portfolio risk approach is communication of the risks that should be included in the portfolio. It also melds nicely with the approach in Chapter 2 regarding internal communication processes of environmental risks. The principles outlined in these chapters apply to many other areas.

To manage the risks of the entire enterprise suggests that some individual, perhaps a chief risk officer or a group reporting to him or her, knows the risks of the entire enterprise. But this is impractical and bureaucratic. Or perhaps people on the top of the organization should manage the small number of large risks and the people on the bottom the large number of small risks. This has appeal, but because a small mishap, indiscretion, or malevolent act by a single employee can in some cases cause disaster for the entire enterprise, the top cannot just leave it up the bottom to deal with risk unsupervised.

The solution that emerges from the contributors is that communications is a mix. Top management must use its communications to set tone, direction, and policy for the enterprise in relation to risk. It should provide training about the risks the enterprise faces and how to manage them. It must seek out information to determine whether risks, big or small, are being managed systematically throughout the...