CFO Asia Exchange Singapore 2015 Refocusing your ERM strategy and practices - Marc Ronez presentation

ARiMI – Asia Risk Management Institute
By MARC RONEZ
Chief Risk Strategist & Knowledge Leader
ARIMI-Asia Risk Management Institute
NOTES
CFO Asia Exchange Singapore
8th October 2015
ERM: Re-Focusing Your Risk
Management Strategy & Practices

2
What have the following organizations in COMMON?
 They suffered heavy losses, some even
collapsed BUT …..
Re-focusing ERM Strategy & Practices – Marc Ronez - Copyright @ ARiMI 2015

3
What have the following organizations in COMMON?
 They also had comprehensive Risk
Management Systems in Place !

Re-focusing ERM Strategy & Practices – Marc Ronez - Copyright @ ARiMI 2015 4
Is the current approach to Risk Management
adopted in organizations WORKING?

Does the Troubles of
organizations such as
AIG, BP, Toyota,
TEPCO, Wolkswagen
& many others..

..necessarily represent
a FAILURE of Risk
Management?

Well, to define a failure of risk management …
…. we must first have a clear understanding of what
should be..
the ROLE and the LIMITATIONS of risk
management.
7Re-focusing ERM Strategy & Practices – Marc Ronez - Copyright @ ARiMI 2015

8
ARiMI Survey on ERM Strategies & Practices 2012:
A mismatch due to Inadequate Focus & Low Maturity
Typical ERM program
SCOPE of coverage
Not
covered!
Not needed!
RISK Environment

ARiMI Survey on ERM Strategies & Practices 2012 –
Some of the KEY FINDINGS
  Most organizations still view risk management from a narrow Compliance
or Safety perspective
  The Risk management function has little or no real participation in the
strategic planning process
  The Risk management function is primarily focused on tangible assets &
and operational process level risk issues.
  The often-stated “focus on risk culture” is more a matter of form than
substance
  Risk Identification & Assessment tools used are overly qualitative &
subjective missing out key risk issues & connections
  And more…

Agenda for this Session
Refocusing ERM: 5 Directions
þ 1. Shifting the focus from Value PROTECTION to problem
solving & Value CREATION
þ 2. Supporting Risk Control SYSTEMS with strong Risk
Management CULTURE
þ 3. Expanding focus from Creating SHAREHOLDERS Value
to Creating STAKEHOLDERS SHARED Value
þ 4. Shifting focus from SHORT-term profit to LONG-term
sustainable performance by improving Risk Identification
& Assessment Tools
þ 5. Ensuring Crisis Management PREPAREDNESS vs
relying on fire-fighting by integrating ERM with BCM

1 – Shifting the Focus from Value
PROTECTION to Problem-Solving
& Value CREATION

Main groups of reasons given to explain ERM
initiatives
PR – Public Relations
Compliance
Protection
Operating Performance
Value Creation &
Optimization
73.33%
26.67%
Ronez, M (2012), “Risk Management Strategies & Practices in Asia”, Survey,
Asia Risk Management Institute - ARiMI

Wrong Focus of Risk Management Initiatives
 What is still driving risk management..
þ Answering regulatory changes and other external pressures
þ Monitoring & controlling the “Expected Losses”
þ Reducing the cost of Risk Financing focusing on Insurance
Leads to a narrow Box-ticking approach to Risk management
¤ What should be driving risk management..
þ Improving strategy formulation, planning & execution
þ Addressing emerging risk issues & avoiding “Black Swans”
þ Optimizing the risk/return allocation & cost of capital
þ Ensuring long-term sustainability of the organization
Leads to Risk management that drives enterprise value

14
Greater
Sophistication
Protection &
Continuity Identifying, avoiding & managing own organisation’s crises
Integrating corporate governance standards
Operating
Performance
Understanding the full range of risks facing the organization
Understanding and evaluating operational risks
Achieving global best practices
Protecting corporate reputation
Value Creation
& optimization Enhancing Reputation and building competitive
advantage
Improving returns through Value creation-based Risk /
Return management & enhancing capital allocation
Levels in ERM Maturity – ARiMI Maturity Continuum
Compliance
Complying with legal requirements
Complying with corporate governance standards
Avoiding personal liability failure
Public
Relation
Surface system & PR Risk Communication
Reassuring stakeholders
Source: “Risk Management Practices in Asia”, Marc Ronez, ARiMI, Survey 2012

ERM & Strategic Decision-Making
INTEGRATING risk management into the strategic
planning & decision-making process of an organization
should be considered to be a very essential component of any
ERM projects.
The RATIONALE is… simply that since Taking Risk is in the
nature of Business…
…. Understanding & Managing Risks proactively is
therefore INHERENT to Strategic Planning.
Furthermore most other operational, financial and even
hazards risks an organization face derive from strategic
decisions.

Nothing Ventured,
Nothing Gained !
TAKING RISK is NECESSARY ..
… to GAIN REWARDS

17
A STRATEGY is a „Road Map“ that provides a
Pathway from CURRENT REALITY to VISION
Time
VISION
Where you want
to Be? (Possible
Future)
INGREDIENTS
Resources, Capital,
People, Culture,
SystemsSTRATEGY
How to get
There?
RISKS
RECIPE
Processes, Structure,
Marketing, Products,
Pricing, Distribution.
TODAY
CURRENT
POSITION
Where are you
Now?
“Strategy is how to get from where
you are now to where you want to
be!”
A Strategy defines and articulates the value proposition that an
organization brings to its market – a description of its business model.

Changes in the Tranportation Industry:
What is NEXT to come?
YESTERDAY TODAY TOMORROW
Horse drawn
vehicle
Modern Cars
?
Where are we
coming from ?
Where are we
Now ?
Where are we
Going to be ?

Managers can optimize the tradeoffs…
between Risk and Return.
HOW? Making Informed Decisions!
… by identifying, analysing & measuring risks consistently
and systematically, and ensuring the timely
communication of risk related information across the
enterprise in a transparent manner.
How? Having the Right Solutions!
… by designing, Implementing and monitoring effective
CONTROLS supported by appropriate cultural values to
optimize the management of risks in the organization

Enterprise-Wide Risk Management (ARiMI)
Performance Management
Risk Management
Knowledge &
Information
Management
It is essential to connect Performance & Risk Management as
they are the “2 faces of the same coin!”

2 – Supporting Risk Control
SYSTEMS with a strong Risk
Management CULTURE

Root causes for many Organization's Problems?
The examinations that followed each of these cases, and
others, revealed some common themes behind the
institutions‘ troubles i.e. The People’s Factor!:
 high-profile scandals involving unethical abuse of
corporate power due to greed and conflict of Interests;
 In a number of cases, fraudulent/criminal activities by
corporate officers;
 A lack of responsibility, accountability and oversight of
corporate operations at every level of management;
 An inherent Blindness and human Complacency to Risk;
 A people issue circumventing control systems in place..

Incompetence, Lack of Ethics, Fraud & Responsibility
of Leaders – A few examples among many…
Ken Lay, Enron Chuck Prince, CEO Citi
Group
TT Durai, NKF
Bernie Ebbers
WorldCom
Dick Fuld,
Lehman Bros
Alan Greenspan,
Chairman FED
Madoff, Investment
Ramalinga Raju,
Satyam

Why Cultural Change is important?
Organizational
Changes
Which consists of
changes in structures,
processes, systems and
technologies.
ERM Success
Cultural
Changes
Which consists of changing
the mental models, attitude
and behaviour of people in
your organization
There are
fundamentally two
types of change that
your organisation will
face when embarking
on an ERM program
24

Why Cultural Change is important?
Organizational
Changes
Which consists of
changes in structures,
processes, systems and
technologies.
ERM Failure
No focus on
Cultural
Changes
Unfortunately most
organizations focus
essentially on the
organizational change
25

Corporate Culture: Tacit & Intersubjective Collective
Behavior Guide
Images & representations of how we
perceive and understand the reality
around us
Predisposition or a tendency to respond
positively or negatively towards a certain
idea, object, person, or situation
The state or process of doing something,
typically to achieve an aim.
A consequence, effect, or outcome of
something i.e. actions, circumstances, etc
MENTAL MODELS
ATTITUDE
ACTIONS
RESULTS

Values, Culture & Risk Management
Your corporate culture to support Good and Effective risk
management practices and achieve core objectives must
have integrated the following values/principles:
þ Think in terms of Shared Value and Sustainability
þ Act with Integrity and Discipline
þ Be Responsible & Accountable for what they do
þ Be Open & Transparent about how they do things
þ Share information and knowledge proactively
Ø If it has not, poor performance and ultimately failure
is inevitable

“To educate a man in knowledge but NOT in morals
is to create a menace to society. “
Theodore Roosevelt, USA president

3 – Expanding focus from Creating
SHAREHOLDERS Value to
Creating STAKEHOLDERS
SHARED Value

Clarifying your Value Chain & Competitive Context
Key Partners:
(Supply
Chain)
Raw Materials,
Goods &
Services
Competitors
& New Entrants
YOUR
ORGANIZATION
Key Partners:
(Routes to
Markets, Channels)
Distributors,
Complementors,
Vendors, etc.
Customers
(Segments &
Profiles)
Prospectivecustomers
Substitutes
Source: Marc Ronez – Asia Risk Management Institute
Who are your competitors and what is the intensity of the competition in your marketplace.
How easy is it to enter your industry? Are there substitutes products /services that can
answer the needs of your customer just as effectively?

Corporate Governance & Social Responsibility:
Aligning Stakeholders’ Rising & Diverging Interests
Government
& Regulators
ORGANIZATION
External Auditors
Rating Agencies
Customers
Shareholders
/ Investors
coverage and pressure
groups scrutiny
Decisions to
invest or to
hold its shares
Regulatory
Framework
& control
Competitors’
behaviors
Lending funds
& at what rate
Partners
/Suppliers
Competitors
Media / Public
/ Pressure Groups
Lenders
Management/
Employees
Audit
requirements
Ratings
requirements
Needs met or
not
supply at
what price
productive
or not

Importance of considering ALL Relevant Stakeholders
Stakeholders
Shareholders
Customers
Debt holders
Employees
Rating Agencies
Governments
Others
Stakeholders
Expectations
Financial related
Objectives
Revenue growth
Profit
Shareholder Value
Targeted Rating
…
Non-Financial
Social Responsibility
Regulatory Compliance
Knowledge Management
Community involvement
…

The Objective of Risk Management is that …
.. an organisation takes risk KNOWINGLY and
manage risk exposure INTELLIGENTLY
.. in a controlled (or balanced) manner so that the
business is viable for a longer term (SUSTAINABILITY)
while meeting the expectation of all the relevant
stakeholders by CREATING SHARED VALUE
(i.e., shareholders, customers/policyholders, employees,
regulators, rating agencies, suppliers, etc).

4 – Shifting Focus from SHORT-
term profit to LONG-term
sustainable performance by
improving Risk Identification &
Assessment Tools

The job of risk management is to ensure that
…
 …. top management are aware of and understands the
possible positive & negative outcomes and associated
probabilities of their organization’s strategy..
 .. BEFORE they make decisions to commit their
organization’s resources on various projects & initiatives.
 .. And that the organization has (or will develop) the
Capabilities to deal with any “Surprises” that may
come its way now and into the future!

Risk Management Process - ARiMI Example
4 – SOLUTION / TREATMENT

1 - DIAGNOSTIC
Establish the Context
Identify Risks
Analyze Risks
3 – Evaluation &
Decisions
about Risk
5 -
MONITOR
&
AUDIT
2 –
SHARE
&
CONSULT
First of all, assess (identify and evaluate) the risks faced by
the firm within the strategic & operational context
Secondly,
communicate the
assessment of these
risks to senior
management & BOD
to decide which risks
to take and not to
take.
Fourthly, implement
mitigations and control
strategies to reduce risk
level and/or transfer the
cost of it.
Finally, monitor &
manage those risks to
ensure the firm bears
only the risks its
management and board
want to be exposed to.
Thirdly, evaluate risk & make the
decisions about the risks you want to
take and the ones you don’t.
Develop & Implement
Exercise & Embed

Risk Management Process - A lot of Things can go
WRONG!
4 – SOLUTION / TREATMENT

1 - DIAGNOSTIC
Establish the Context
Identify Risks
Analyze Risks
3 – Evaluation &
Decisions
about Risk
5 -
MONITOR
&
AUDIT
2 –
SHARE
&
CONSULT
Develop & Implement
Exercise & Embed
2 - Mismeasurement of known risks
3- Failure in
communicating
risks to top
management
4 - Failure in setting the right Risk
Appetite
6 - Failure in
monitoring and
managing risks
7 - Failure to use
appropriate risk
metrics
1 - Failure to identify or to take
known risks into account
5 - Failure in implementing Risk
Management Solutions

Nassim Taleb, Author of the “Black Swan Theory”
“Many highly popular MODELS used to identify and
assess Risk are … deeply FLAWED”

What is the time horizon covered by typical risk
assessments?
KPMG Risk Management Survey 2011

Too Short-term Focus of Assessment dilute & hide
the REAL Exposure to RISK
40
?
Can I go on a
5-day hiking
trip in the
mountains?
Day 1
Sun
Day 2 Day 3
Weather Forecast
Day 1
Cloudy
Rain
Sun
Day 2 Day 3
Day 1
CloudySun
Day 2 Day 3
? ?
?
Day 4 Day 5
Rain
Day 2 Day 3
Day 2 Day 3
? ?
??
Rain

41
COSO
"Simplistic” Assessment Methodology
9
6
3
6
4
2
3
2
1
V Low (1) Low (2) Med (3)
Impact
Med(3)
Low (2)
V Low (1)
Likelihood
1284
12
8
4
High (4)
16High (4)
$ 0
Operational
Failures
Likelihood
Magnitude of Loss
RCSA Risk Map
Terrorist Attack
L=1 & I=4
Risk Score = 4 (Yellow)
LOW Priority
Actual Risk Distribution
Terrorist
Attack
Operational Failure
L=4 & I=2
Risk Score = 8 (Orange)
SIGNIFICANT Priority

BLIND SPOTS on Black Swans in existing Models
42
- +
You should also
be concerned
with the TAIL
risks leading to
Insolvency
Shareholders and
Management are typically
concerned with variability
below the target
Target
Performance
Expected
Potential
Losses
Expected
Opportunities
Unexpected
Catastrophic
Losses
Black swans
You should also
be looking out
for critical NEW
Changes in the
Biz environment
Unexpected
Opportunities
Black swans
LOSS GAIN

Abusing the Use of the Bell Curve
43
- +
Expected
Target
Performance
Worst Expected Best
Different Risks have a
wide range and shapes of
probability distributions

44
Risk IGNORANCE
Risk AWARENESS

Adopting a Methodology & Tools that allow you to
more objectively look at Risk in longer-term
perspective

5 – Ensure Risk Management
PREPAREDNESS vs FIRE-
FIGTHING by intergrating ERM
with BCM & Crisis Management

Pressure
Time
Potential Emerging Current Recovering
Life-cycle from a Risk issue to a Crisis – 4 phases
Media Coverage
& amplification
Signal
CRISIS
Incident
OR Signal
Issues
Signal

Example: BP oil spill, Gulf of Mexico 2010
The catastrophe resulted in a
loss of:
 Direct Cost to BP: Over
$20 billion
 Market capitalization loss.
i.e. cost to shareholders:
$87 billion
 11 workers dead
BP platform explosion and oil spill could have been
prevented with additional spending of $7 - $12 million on
safety Controls. BUT the Investigation report noted that
focus was on cost and time savings

Pressure
Time
From Risk issue to Crisis: BP Gulf of Mexico 2010
Media Coverage
& amplification
Signal
CRISIS
Issues
Signal
Opportunity to influence Difficult to influence
Maintenance
equipments
Reports
Problems
Drop from
news
Enormous
cost &
damage to
reputation
Incident
OR Signal
Explosion
Stop the
leak &
cleaning
Emergency
evacuation &
protection
Media
onslaught

Crisis Management without Proper Preparation is
like… trying to put ‘Lipstick’ …
..on a Wild and Angry Gorilla!

Impact on BP share price / market capitalization
Gulf of
Mexico
Disaster
MTBE
Contamination
lawsuits
$243 Billions
$90 Billions
Enormous Shareholder Value Loss

Pressure
Time
Life-cycle of from a Risk Issue to a Crisis
Signal
CRISIS
Incident
OR Signal
Issues
Signal
Time for
ACTION
REACTION
Too Late!

PREPAREDNESS is ESSENTIAL
For Effective Crisis Management

54
Pressure
Time
The impact of Risk & Crisis Management
Signal
CRISIS
Incident
OR Signal
Issues
Signal
Media Coverage
& amplification

Time
Road Map to Managing Risk & Crisis
Risk Diagnostic Risk
Treatment
Monitoring &
Detection
Recognition &
intervention
Emergency
crisis response
Recovery , analysis &
Learning
Business Continuity (business processes, Supply Chain)
Emergency Response
Crisis Communications Risk Communications
Disaster Recovery (IT services)
Emergency preparedness
Risk Financing
Risk Optimization
Contingency Financing
BC Preparedness
1 – Corporate
Objectives

2 – Key Processes
& Resources

3- BIA

4- Threats &
Opportunities
Analysis

5- Risk appetite
& Tolerance
DR Preparedness
Before After
Strategic change
Incident

56
If a company manage the crisis properly there actually may
be beneficial outcomes beyond survival and preservation of
corporate value:
1.  Increased visibility and name recognition.
2.  An opportunity to show competency and leadership.
3.  Improved relations with important stakeholders’
groups, such as employees and customers.
4.  Lessons can be learned and changes made to prepare
for future crises.
5.  Increased competitive advantage against less well
prepared competitors
Managing a Crisis well - Benefits

ERM, Strategic Planning & BCM Overlaps &
Gaps
57
- +
Target
Performance
Expected
Potential
Losses
Expected
Potential
Opportunities
Unexpected
Catastrophic
Losses
Transformational
Blue swans
Catastrophic
Losses
Black swans
Unexpected
Opportunities
BCM
LOSS GAIN
SP - Strategic
Planning
ERM

SP – Strategic Planning
Develop opportunities
& create value
BCM – Ensure Business
Continuity & Societal
Security
INTELLIGENT ERM with Strategic Planning,
Operational Management & BCM
58
- +
Target
Performance
Expected
Potential
Losses
Expected
Potential
Opportunities
Unexpected
Catastrophic
Losses
Transformational
Blue swans
Catastrophic
Losses
Black swans
Unexpected
Opportunities
ERM – Create Shared Sustainable Value
LOSS
Operational
Management
GAIN

Building Intelligent ERM systems & culture
þ Think Strategically & Longer-term if you want to be
sustainable (business model & adequate risk financing)
þ Use the appropriate methodologies and tools to
understand your risk profile as you take risk to get
returns to avoid unmanaged exposure to large losses
þ Nurture an Ethical and Risk-Aware Culture to support
resilience & the capacity to Learn and Change.
þ Recruit & promote people with the right values & culture
þ Develop a real Risk-adjusted Performance Management
system to motive people to take risk effectively
þ Integrate with ERM & Strengthen your crisis & business
continuity programs. Stress-test your systems regularly.

Marc Ronez - Chief Risk Strategist &
Knowledge Content Leader at ARiMI - Asia
Risk Management Institute
An ERM & Governance expert with over 20 years of experience both as a
practitioner & trainer for large MNCs, Governments & Charities. Marc has an MBA
from the University of Chicago GSB, an MSc in Insurance & a LLM from the University
of La Sorbonne
What do I do? Help managers & leaders to use Risk Management to:
þ  Resolve difficult operational and business challenges
þ  Take & manage risks effectively to build sustainable & profitable growth models
Marc’s specific areas of expertise include ERM, risk decision-making processes,
data analytics, corporate governance, business ethics, social responsibility, risk-
aware culture, risk communication and crisis management, business model/strategy
risk management, corporate learning systems development.
60

Risk Management is a continuous journey, not a
destination!
Marc Ronez is on Linked in & WordPress
You can find his profile & read his blogs at:
P: www.linkedin.com/in/marc-ronez
B: theriskmanagementparadox.com
B: riskmanagementdemystified.com
61

ARiMI – Asia Risk Management Institute

ARiMI is an applied research and business studies institute that
was set up in 2003 (in partnership with NUS) and has established
itself as the Institute of Reference for Enterprise Risk Management
studies in Singapore and in the Asia region.

We FOCUS on programs:

1.  For Decision-Makers (Middle to Top Management):
Developing PRACTICAL Knowledge & Skills in Risk & Crisis
Management

2.  For Organizations: Building CAPABILITIES for Sustainable
and Profitable Growth by EMBEDDING Control Systems
with a Risk Aware & Crisis Readiness Culture
ARiMI, Asia Risk Management Institute

ARiMI - Focus and Expertise
● Crisis management &
Business Continuity
● Leadership risk decision-
making and Social Capital
● Reputational Risk &
stakeholders management
● Corporate governance &
business ethics
● Business Innovation &
Corporate Transformation
Research
● Professional Designation
Programs
CERM (Certified
Enterprise Risk Manager),
CPRM (Certified
Professional Risk
Manager), ARM
(Associate in Risk
Management), FSRM
(Fellow in Strategic Risk
Management)
● Public Seminars and
Workshops
● Corporate Training &
learning Programs
Education Expertise
● Risks Analytics & Decision-
making
● Crisis & Business
Continuity Mgt
● Reputation Risk Mgt & CSR
● Business Ethics, Fraud
Risk & Compliance Mgt
● Risk Appetite & Risk Aware
Culture Readiness
● Project risk management
● ERM Design &
Implementation
● Innovation & Change Mgt
● Information & Cyber Risk
Mgt

65
For more information on ARiMI,
check our website at:
www.arimi.org
Developing Effective Leaders & Decision-
makers for complex & volatile times

Important Note: Please note that that this presentation and its
contents, is the intellectual property of the Asia Risk Management
Institute Pte Ltd. It has been prepared for this CFO Exchange 2015
session and it cannot be used for any other purposes without the
specific written consent of the Asia Risk Management Institute.

CFO Asia Exchange Singapore 2015 Refocusing your ERM strategy and practices - Marc Ronez presentation

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

Similaire à CFO Asia Exchange Singapore 2015 Refocusing your ERM strategy and practices - Marc Ronez presentation

Similaire à CFO Asia Exchange Singapore 2015 Refocusing your ERM strategy and practices - Marc Ronez presentation (20)

Dernier

Dernier (20)

CFO Asia Exchange Singapore 2015 Refocusing your ERM strategy and practices - Marc Ronez presentation