Managing Risk for Opportunity

1. Managing Risk for Opportunity

2. Managing Risk for Opportunity • In the absence of certainty, the only way to maintain potentiality is to focus on excellent execution and demonstrable resilience at the same time whilst taking as much acceptable risk as is reasonably possible • (Peter Bernstein, Against the Gods, The Remarkable Story of Risk)

3. Managing Risk for Opportunity • Enterprise risk management (ERM) deals with the management of uncertainty, risk and opportunity towards the achievement of company goals and objectives. ERM overarches risk management specialisms. • Risk Management specialisms and associated systems deal with technically specific methods of actually treating risks. For example: credit risk, business continuity, IT etc • Policy without practice has no teeth. • Process drives practice.

4. Strategic Elephants • Enterprise Risk Management: • Objectives and Obstacles, • Views upside as well as downside risks, • Is where strategic and operational risks, as well as financial and hazard risks are collectively viewed, • Sets policy with regard to: • Risk Appetite, • Risk management criteria, • Resources to be applied to the treatment of risks, • Overarches all risk management specialisms,

5. Strategic Elephants • Risk strategy is owned by the Board, not by management. Management owns execution. • Both directors and management require knowledge of obstacles, understanding of variables, certainty of compliance and clarity are mission critical to good management where uncertainty prevails, • Financial and hazard risks are now mastered. Danger remains within however they are now part of the mainstream professional management organisation. We need to apply the same rigor to the management of strategic and operational risks.

6. Strategic Elephants • In the presence of growing uncertainty, strategic and operational risks as well as residual financial and hazard risks require a clearly defined, well understood, people engaging and rigorously applied process management approach characterised by: • Standard language, terms and definitions, • Standard ERM framework, principals and risk management process, • Standard methodology for estimating probabilities and impacts which releases us from the limitations, and excesses, of perception, • Standard convention for assessing return on risk management effort, • Clarity.

7. Standard ERM Framework, Principals and Risk Management Process(Source ISO 31000 (Risk Management Draft also note ANZ 4360)

8. ClarityInitial Risk Map

9. ClarityResidual Risk Map

10. The Business Case for ERM • The question arises: ‘how credibleis the measurement of initial and residual risks and also the associated projected improvement in risk management performance’. • If the initial and residual risk maps are believed then it is clear that the case for the projected return on risk management effort will have been made.

11. Measurement : General • Measurement requires a: • Start point, • Finish Point, • Units of measures in between. • Process driven ERM methodology • International Standard and common language • Project management approach:

12. Project Management Approach • Scoping risk treatments…improvements in planning, controls, infrastructure, supply chain, communications, training, preparedness, resilience etc. • Identification of required actions and expected outcomes, • Project planning and costing, • Performance of people who are assigned measurable tasks, • Project performance monitoring (deliverables, milestones, gateways), • Project communications, • Measurement based return on effort …achievement of desired improvement in risk performance as illustrated in the projected variances between the initial and residual risk maps.

13. Measurement:Estimating Probability and Impact • Probability requires: • Identified events, which occur • In large numbers are • Spread, are • Independent in their occurrences, and are • Directly comparable • Hazard risks are insurable, • Financial risks are treated through the use of financial instruments which over time are becoming more sophisticated and reliable. • Strategic and operational risks, by and large, fit neither because: • Insufficient frequency data, • Events which have multiple variables and interconnections not treatable using conventional instruments,

14. Magnificent 7for ERM Without measurement you are a candidate for CFIT (controlled flight into terrain). • Risk Committee: Board owns risk strategy, management owns execution, • Align with international best practice (ISO and ANZ 4360) and international professional body guidance's: use one universal language, and process, • Remove the fudge and adopt project management methods for monitoring, reporting and communicating key information to the risk committee. • Consider stakeholders, establish risk appetite and risk management criteria, • Synthesise obstacles to objectives , • Decide on risk treatments and repeat the synthesis to get new probability and impact estimates for residual risk, • Compare the two risk maps for return on effort to reducing obstacles to objectives

15. Managing Risk for Opportunity • The return on Risk is Profit! • Risk is OK….once we know about it, have measured it and are treating it. • ERM successfully embedded gives comfort to all Stakeholders • ERM is a journey…you can set out tomorrow

16. Managing Risk for Opportunity • A final line from Mark Twain • “ It ain’t what you don’t know that gets you into trouble; its what you know for sure that just ain’t so!” • Thank You.