Managing Enterprise Risk

How do you get a handle on risk? Enterprises are getting better at controlling risk, but methods are often inconsistent across an organization. The perceived “risky” areas receive attention, but what about other business functions that could suffer loss?

Decision-makers need an integrated view of risk across the enterprise—not multiple, independent risk assessments that ignore correlations between risks.

Decision-makers need quantifiable able measures of business risk—not just simplistic “red light, yellow light, green light” indicators.

How can we achieve an enterprise view of risk? First, by adopting a structured process for uncovering and managing risk. Second, by creating a one-page risk dashboard to bring all the analysis together in one place for review and prioritization.

A risk dashboard can communicate the highest risk areas concisely and help develop an integrated approach to reducing risk exposure.

Let’s look at a process for managing risk, at seven types of business risk, and how a one-page risk dashboard can help.

Overview of Risk Management Process

1. Identify the risk
Use a structured approach to explore and pinpoint sources of risk—in every business area, and by every risk type. See “7 Types of Business Risk,” at right. How a risk dashboard can help: reveals holes in your enterprise risk profile; shows gaps you need to fill for a complete risk assessment
2. Assess the risk
a. Estimate the probability and severity (expected loss) for each type of risk
b. Create a risk matrix for specific risks by plotting them along the axes of probability and severity. Also gauge risk levels for each combination of risk type and functional business area. How a risk dashboard can help: offers a compact, focused view of all the risk data
3. Mitigate the risk
a. Develop controls by drilling down to find root causes and specific business areas that need attention first. Set acceptable levels of risk and establish methods to monitor ongoing exposure and improvement.
b. Validate results by benchmarking risk measures against target levels, industry norms, or history. How a risk dashboard can help: prioritizes and focuses risk mitigation action; uncovers relationships between risks

7 Types of Business Risk

Operational Risk
source of loss processes and procedures do not work to achieve mission
what to assess vulnerability of critical processes, physical security, loss events, processing errors, training and certification participation, production rates and throughput, fraud incidents.

Human Resource Risk
source of loss employees are unable, unwilling, or unavailable to perform duties
what to assess staff turnover, attrition in key positions, incentive compensation effectiveness, employee satisfaction, salary competiveness, sick days, lost time accidents.

Technology Risk
source of loss malfunction in systems infrastructure impedes business
what to assess system downtime, data security breaches, business continuity readiness, mean time between failures, disaster recovery readiness, business continuity preparedness.

Financial Risk
source of loss assets are impaired or capital is constrained
what to assess default rates, days sales outstanding, days payables outstanding, liquidity measures, debt- to-equity ratios, cash coverage of debt service, credit and counterparty risk, contract risk, price risk, cost and supplier risk.

Strategic Risk
source of loss mission and plans are not compatible with profitability
what to assess progress and performance of key initiatives, strength of competitive position and key differentiators, new market entrants, time-to-market for new products, R&D pipeline.

Environmental Risk
source of loss surrounding environment is damaged
what to assess audit results, regulatory compliance, safety record, releases or spills, HAZOP analysis.

Reputation Risk
source of loss organization suffers negative public opinion and damage to its credibility or brand
what to assess product and service quality, customer complaints, unfavorable media coverage, negative Internet postings, investor relations climate, customer service responsiveness, customer satisfaction.