Advancing ERM

Bonnie Hancock
Executive Director, NC State’s ERM Initiative

As Executive Director of North Carolina State University’s ERM Initiative, Bonnie Hancock works closely with senior executives as they design and implement enterprise risk management (ERM) processes in organizations they serve. That hands-on advising leads to insights about techniques useful in addressing a number of practical challenges associated with ensuring ERM processes are value adding without over-burdening the process. In this article, Bonnie addresses techniques that might simplify the process of prioritizing risks.

In October 2015, we held our fourth annual Advanced ERM Executive Education Workshop where we walked over 50 participants through an evaluation of their ERM processes and provided techniques for making the ERM process more valuable.  Those of you who follow our ERM Initiative know that we focus on the connection between ERM and Strategy and advocate for greater linkage between these two functions.  What we found in this interactive workshop was that the strategy connection was an area where our participants saw some of the greatest opportunities for improvement.

Participants

By way of background, each year we offer an open enrollment day and a half workshop covering advanced ERM techniques.  We limit enrollment to around 50 participants in order to provide a more intimate environment for sharing best practices.  Our enrollment has been building over the years, and this year we were sold out.  This year, our participants came from a wide variety of industries including banking, healthcare, energy, consumer products, industrial products and universities.  Most organizations represented had an ERM function in place between 2 and 4 years, so they had already evolved and matured their ERM processes to some degree.  It was a great mix of participants who were all very open in sharing what had and had not worked within their organizations.  

Benefits of Polling Technologies

This workshop was the first time we used polling technology to engage our audience and to obtain a quick picture of the state of the organizations represented with respect to key elements of enterprise risk management processes.  Many organizations use polling technology to assess risks and to facilitate discussion regarding key risks and therefore we thought it made sense to use it in our workshop.  The polling process was not only valuable to the ERM Initiative faculty teaching the course; it also gave participants insights into how their organizations “stacked up” compared to the other organizations in the room.  While many of the results of the polling were not necessarily surprising, it provided a launching point for discussion, with those organizations whose processes were most advanced taking the lead in sharing best practices.  This workshop experience demonstrated to me that sharing  the viewpoints of everyone  in the room in real time through such technology facilitates a more open and engaging discussion.  I know a number of practitioners who use polling technology in their risk discussions; now I have seen the benefits first hand.  You may want to consider using this in your organization.

Areas for Improvement:  Connection to Strategy, Risk Appetite and KRIs

So what did we find out?  Those areas that are the least advanced were as follows:  integration of ERM with strategy, development of risk appetite, and the use of key risk indicators.  We found that most of the organizations present were pretty far along in their risk identification and risk assessment techniques as well as their processes for responding to risks.  Even in an area like risk assessment, where participants were further along, it was evident that the organizations represented were still engaged in improving and evolving their processes.  All of this is consistent with what we have learned through surveys we have conducted regarding the state of ERM (see Report on the Current State of Enterprise Risk Management) and in informal discussion with practitioners attending our ERM Roundtables  (Register for next Roundtable here). 

Integrating with Strategy

Just one example in the area of strategy gives you a flavor for some of the dialogue in the workshop.  This particular discussion started with a question regarding whether risks should be considered more at the beginning or the end of the strategic planning process.  The short answer is that risks should be considered throughout the strategic planning process, and we went through some key points at which risk considerations will be critical to the planning process.  The organization’s current risk inventory, particularly its top risks should be an input at the beginning of the strategic planning process.  In fact, I have seen many organizations that develop strategic initiatives in response to a potential risk event like changing technology or a competitor move.  During planning, consideration should also be given to risks that may jeopardize the success of a particular initiative as well risks that a particular initiative may create for the organization overall.  As an example of the latter type of risk, an initiative to launch a new product could have the effect of cannibalizing an existing product if successful or it could potentially confuse the brand image, whether the actual product is successful or not.  Closer to the end of a strategic planning process, it is beneficial to engage in scenario planning, stress testing, and/or other activities to assess the entity’s overall ability to manage and survive a series of risk events.  We found that only one or two organizations represented in our workshop were including any analysis of potential combinations of risk events in their planning process.

In conclusion, what we saw in this workshop is consistent with what we are seeing more broadly in the ERM field, and it is exciting to be a part of it.  There is a growing commitment to evolving and improving ERM processes which tells me that organizations are seeing sufficient initial value in ERM to continue to invest to maximize the benefits a mature ERM process can provide.  Here at the Poole College of Management at NC State University, the ERM Initiative is working on a tool to evaluate and benchmark ERM processes to help organizations pinpoint those areas where ERM can potentially add more value.  Stay connected with us for the latest updates.