s h i f t i n g - rma u · to enterprise risk management (erm) as a way to address the risks they...

8
October 2012 The RMA Journal BY ABRAHIM ALTHONAYAN, JOANNA KEITH, AND HENRY KILLACKEY 12 into an ERM Culture How to Sustain an Enterprise Risk Management Program and Maintain Competitive Advantage STOCKBYTE/THINKSTOCK ENTERPRISE RISK ER SHIFTING ECONOMIC CONDITIONS, technological advances, emerging markets, geopolitical threats, and changing regu- latory environments have compelled organizations to turn to enterprise risk management (ERM) as a way to address the risks they continually face. As they implement ERM pro- grams, organizations are realizing that long-term value comes out of ERM through its sustainability, which is fostered by an ERM culture embraced by the organization’s stakeholders. Defining ERM Culture The need for organizations to have a strong ERM culture emerged from a new role for enterprise risk management— which shifted from being a specific type of risk management handled by a small department or a specialized group of pro- fessionals to a process for guiding the achievement of strategic objectives. ERM requires the collaboration of depart- ments, teams, and func- tions, and the results have included new perspectives into the ERM process. With this integration of human capital, new organizational cultures have emerged, in which stake- holders take the sustainability of ERM into consideration when making decisions. Business decisions and actions regarding risk are shaped by a system of values and behaviors present throughout an organization that are demonstrated by the individuals or groups within it. 1 In the context of ERM, culture is a value that impacts business decisions 2 and determines the way the organization identifies, understands, discusses, and acts on the risks it faces and the risks it takes. ERM culture affects the decisions of management and employees, regardless of whether they consciously weigh benefits and costs. 3 The concept of risk culture has been in the spotlight in recent years with the realization that the financial collapses of organizations originated in having a flawed risk culture or no risk culture at all. A lack of a solid risk culture can also diminish an organization’s ability to achieve strate- gic objectives, which hinders business performance and weakens market competitiveness. 4 Culture, as argued by Douglas Brooks, is not an intangible concept, but one that can be measured. And the strength of risk culture can be determined by tracking the level of consistency that risk decisions have with organizational policies and the desired risk profile. In decision making, there is an active consider- ation of potential rewards and losses in taking and avoiding ERM requires the collaboration of departments, teams, and functions, and the results have included new perspectives into the ERM process. S h i f t i n g

Upload: others

Post on 13-Aug-2020

0 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: S h i f t i n g - RMA U · to enterprise risk management (ERM) as a way to address the risks they continually face. As they implement ERM pro - grams, organizations are realizing

October 2012 The RMA Journal

by AbrAhim AlthonAyAn, JoAnnA Keith, And henry KillAcKey

12

into an ERM Culture

How to Sustain an Enterprise Risk Management Program and Maintain Competitive Advantage

Stoc

kbyt

e/th

inkS

tock

EntErprisE risk ER

Shifting economic conditionS, technological advances, emerging markets, geopolitical threats, and changing regu-latory environments have compelled organizations to turn to enterprise risk management (ERM) as a way to address the risks they continually face. As they implement ERM pro-grams, organizations are realizing that long-term value comes out of ERM through its sustainability, which is fostered by an ERM culture embraced by the organization’s stakeholders.

Defining ERM Culture The need for organizations to have a strong ERM culture emerged from a new role for enterprise risk management—

which shifted from being a specific type of risk management handled by a small department or a specialized group of pro-fessionals to a process for guiding the achievement of strategic objectives.

ERM requires the collaboration of depart-ments, teams, and func-

tions, and the results have included new perspectives into the ERM process. With this integration of human capital,

new organizational cultures have emerged, in which stake-holders take the sustainability of ERM into consideration when making decisions.

Business decisions and actions regarding risk are shaped by a system of values and behaviors present throughout an organization that are demonstrated by the individuals or groups within it.1 In the context of ERM, culture is a value that impacts business decisions2 and determines the way the organization identifies, understands, discusses, and acts on the risks it faces and the risks it takes. ERM culture affects the decisions of management and employees, regardless of whether they consciously weigh benefits and costs.3

The concept of risk culture has been in the spotlight in recent years with the realization that the financial collapses of organizations originated in having a flawed risk culture or no risk culture at all. A lack of a solid risk culture can also diminish an organization’s ability to achieve strate-gic objectives, which hinders business performance and weakens market competitiveness.4 Culture, as argued by Douglas Brooks, is not an intangible concept, but one that can be measured. And the strength of risk culture can be determined by tracking the level of consistency that risk decisions have with organizational policies and the desired risk profile. In decision making, there is an active consider-ation of potential rewards and losses in taking and avoiding

ERM requires the collaboration of departments, teams, and functions, and the results have included new perspectives into the ERM process.

S h i f t i n g

Page 2: S h i f t i n g - RMA U · to enterprise risk management (ERM) as a way to address the risks they continually face. As they implement ERM pro - grams, organizations are realizing

October 2012 The RMA Journal 13

the ERM culture they wish to see in the organization. • Incentivesthatrewardriskawarenessamongdepart-

ments, teams, and employees to establish enterprise-wide thinking.5

• Informationsharingandcommunicationamongdepart-ments and teams.

• Learningopportunitiesforemployees.Just as strength within an ERM culture can be measured,

so, too, can weaknesses. According to Brooks, a weak ERM culture becomes evident when stakeholder decisions run counter to organizational policies and the desired risk profile. The consistency necessary for an ERM culture can be undermined by competing interests. Brooks gives the following example of how considerations of risk can be undermined by other interests of stakeholders:

risks. This consideration enables decision makers to make choices that will align best with the organization’s policies and desired risk profile, which ultimately, based on the assessment by Brooks, contributes to a strong risk culture.

However, organizations that do not have an ERM cul-ture fail to reap the benefits of a functional ERM program. Because ERM culture is a product of shared values and behaviors, it is based on establishing predictability and high reliability in executing processes for managing risks. When there is no ERM culture, business units work in silos and do not align themselves to manage risks and achieve strategic objectives. The result is low reliability and lack of consistency in executing risk management processes.

Practicing ERM in silos also results in repeating processes for managing risks, which translates into additional costs in staff time and dedicated resources. When reliability and consistency are low, a mixed message is communicated to staff about how the organization values ERM—and this can negatively impact employees’ perceptions and diminish the support needed for a global execution of ERM throughout the organization.

There are elements, consistent with organizational poli-cies and desired risk profile, that signify a strong risk culture within an organization:• Committedexecutivesandseniormanagerswhomodel

Because ERM culture is a product of shared values and behaviors, it is based on establishing predictability and high reliability in executing processes for managing risks.

Page 3: S h i f t i n g - RMA U · to enterprise risk management (ERM) as a way to address the risks they continually face. As they implement ERM pro - grams, organizations are realizing

October 2012 The RMA Journal14

ERM Culture Case Studies

Organization Challenges What Was Done? Results Further Improvements and Recommendations

AZ Electronic Materials

» Reporting and process requirements ignited skepticism.» A focus on data collection instead of action scattered management’s attention.» Challenging to introduce risk culture to globally diverse business units and achieve integration.» Difficulties with cultural change and transitioning into the new risk approach. Potential long-term benefits difficult to recognize and comprehend by employees.

» ERM and risk culture were reprioritized to protect the organization’s mission and achieve better customer satisfaction.» Efforts were made to embed ERM culture throughout the enterprise.» Initial risk assessment sessions received management support and adequate action responses.

Results» Better understanding of corporate objectives and busi-ness continuity, customer needs, and potential threats and opportunities to the business.» Improved quality controls.» Perception of strong competitive market image; stronger customer loyalty.» Better internal and external communication over poten-tial business interruptions.

» Focus on practical translation of risk analysis into risk action items (key threats and opportunities for the business).» Continue integration of risk culture amid global environment and achieve enterprise-wide cultural uniformity.» Ensure logical understanding of both ERM and risk culture as extension of planning strategies. » Define explicit alignment of risk culture, competitive advantage, and long-term suitability.

Global Investment Bank

» New unit had a good ability to challenge each other’s actions and ideas, but a lack of cooperation and cohesion became the main concern of management.» Working toward reducing the visible disconnect in com-munication and daily operations between risk and business groups. » Minimizing the demographic divide between senior and junior employees that was hindering complete group integration of people’s behaviors and risk decisions.

» Risk culture was reassessed within sales and trading units recently integrated as a new unit.» Management aims to ensure a comprehensive integra-tion of newly formed group through creating a strong and consistent risk culture.

Results» The existing risk culture needs to be rethought given the gaps identified as a result of the internal survey.» Employees were unclear what the bank’s risk tolerance meant.» The change in the group’s structure triggered unexpected behaviors and risk decisions.

» Senior management should realign the leadership team and encourage appropriate risk behaviors as part of a robust risk culture.» Communicating risk tolerance enterprise-wide should be changed; everyone in an organization should be able to understand and express clearly what risk tolerance is.» Increased transparency in making risk decisions and business involvement in setting risk appetite.» Rethink internal controls and processes to ensure effective approval mechanisms.» Reassess what value can be generated through risk culture.

Global Professional Services

» Potential over-extension of junior staff was identified as an emerging concern.» Junior employees felt that senior colleagues did not appreciate or welcome upward challenges, such as their active participation in various decision-making processes led by the seniors, which in effect inflicted inhibition and lack of confidence to undertake challenges by juniors. Employees cited a lack of clear guidelines and communica-tion in terms of risk tolerance vs. appetite.

» Current risk culture was assessed.» Management raised no specific cultural concerns to inves-tigate, but was keen on learning what can be improved.» Risk culture was considered healthy.

Results» The study revealed that the risk culture can be consid-ered robust, especially regarding employees’ responses to change and their caring about the quality of their work and the impact on the organization.

» Senior and junior employees should work together to overcome disconnect and lack of integration.» Senior and more experienced staff should provide guidance to junior personnel to reinforce trust across the organization.» Comprehensive risk training provided for all employ-ees (knowledge sharing, cross training) to clear away risk inconsistencies. » A restructured (more effective) annual planning process that incorporates key risks the organization may face.» Realign risk appetite and strategic business objectives.

Financial Services

» Communication is not yet consistent and effective enterprise-wide. » Level of risk ownership and commitment is lacking and appears to be disintegrated; employees feel like the risk ownership is primarily an element of risk management, not the business.» Lack of alignment between risk and business manage-ment magnifies the view of risk as an inconvenience rather that a value-adding opportunity.» Lack of focus on adequate risk-adjusted incentives and compensation schemes discourages effective managing of risks. This diminishes risk morale among employees.

» The state of existing risk culture was examined as a critical element of effective risk management.» Internal risk survey was designed to gauge employees’ attitudes toward the current risk management approach.» A baseline for development of risk culture was estab-lished based on the survey analysis.» Custom workshops and discussions were organized within various stakeholder groups.

» Results » Employees value integrity and appreciate that the organization appears to have a competitive advantage in the market driven by cultural change.» Risk change management has been perceived as well-designed and implemented; communication was found effective bottom-up and top-down.

» Effective change management to engage with the new culture.» Robust information flow leading to informed busi-ness decisions. » Align compensation and risk-based performance to encourage effective risk management.

Source: Originated by the authors.

Page 4: S h i f t i n g - RMA U · to enterprise risk management (ERM) as a way to address the risks they continually face. As they implement ERM pro - grams, organizations are realizing

October 2012 The RMA Journal

“It may occur at the top of an organization if an acquisition is being considered, and considerations of risk fall victim to the ego of the participants. They may be put aside because the participants in the transaction have ‘fallen in love with the deal,’ and cannot bear the thought of backing out of the transaction given the work that has been put into it and the poten-tial benefits of the transaction.... Rewards may also incent this type of behavior. These may be tangible rewards—bonuses and salary increases—or they may be intangible because the participants in successful transactions are those recognized in the organization, given higher profiles and promotions.” This example demonstrates how competing interests

can ruin the consistency needed for developing a strong risk culture. Participants in the transaction focused on the benefits and the overall attractiveness of the deal instead of considering how the transaction would enhance or erode the risk profile that the organization wishes to have.

When employees share the same values and display the same behaviors in managing risk, consistency in the execu-tion of ERM and business results is ensured, reassuring stakeholders and generating value.

Introducing the ERM Culture AlignmentCreating a strong ERM culture is a prerequisite for a sus-tainable and value-adding ERM. Organizations should see the importance and value of culture and take steps to ad-dress it in their mission statement. In recent years, industry practitioners have extensively analyzed the flaws of existing risk management practices, corporate governance, manage-ment leadership, and risk culture. Risk management culture was also the top priority at the Deloitte’s Directors Forum in 2011,6 when it was identified as critical for building risk-intelligent organizations where everyone can take re-sponsibility for risk management and “mind the business” to protect and create value.

The Enterprise Risk Management Survey, administered by The Risk Management Association (RMA) in 2006, indicated that most organizations measured the effectiveness of ERM in the context of regulatory compliance, the Sarbanes-Oxley Act, and audit requirements rather than with the expectation of enhancing shareholder value; 48.4% of respondents saw the ability to set a common risk culture, establish a common risk language, and understand risk appetite as potential ERM implementation benefits.7 When asked if the culture “openly encourages the reporting of risks and losses,” 32% agreed, while only 16% strongly agreed. In many cases, ERM was still a new concept in the early stages of implementation. Since then, significant progress has been made toward sup-porting ERM implementation with management buy-in and moving away from silo risk management

In a recent 2010 KPMG International survey, nearly

50% of respondents identified a lack of and the potential weaknesses of risk culture as a primary contributor to the financial crisis. Even though risk culture is a fundamental component of ERM, many organizations still show signifi-cant shortcomings in this area. Over 58% of surveyed cor-porate board members and internal auditors admitted that most personnel had little or no understanding of how risk exposures should be assessed for likelihood and impact. This indicates that the leadership may not ad-equately foster a culture of continuous ERM de-velopment for employ-ees who should fully comprehend how well-informed risk decisions are made. Without a strong ERM approach, establishing an enterprise risk culture becomes unachievable, and this may adversely affect decision-making.

In organizations where the cultural aspect is still not considered a corporate priority, management needs to revisit the potential consequences of an underappreciated culture and how its value becomes diluted across the organization. According to Aon (2007), one in 10 enterprises confirmed that ERM is embedded in the business process, and only one in four admitted the impact of ERM on the enterprise strategic planning process.8Lookingattheneweconomicreality, financial organizations in particular were forced to rigorously revise their current risk management. In effect, core ERM elements such as strategy, resources, and culture had to be reviewed and recalibrated.

The increasingly uncertain economy and the consequenc-es of continuous crises are another indication that both ERM and its culture need to be developed further. ERM culture is a critical risk dimension expressed in employees’ attitudes and in the way they feel about the organization. Taken as an example, the 2009 PricewaterhouseCoopers’ integrated risk management approach summarizes keys aspects and shortcomings of risk management and the culture.9

At one time, the keys to effective risk management were 1) leadership and strategy, 2) accountability and reinforce-ment, 3) people and communication, and 4) risk manage-ment and infrastructure (Figure 1). Leadership integrates high ethical standards and ensures clear enterprise-wide communication of business objectives. Meanwhile, the accountability component should, by definition, assume individual risk responsibility. The people quadrant reflects the organization’s ability to share knowledge and promote continuous development and growth of all employees. Lastly,theroleofriskmanagement should not be limited to

15

The increasingly uncertain economy and the consequences of continuous crises are another indication that both ERM and its culture need to be developed further.

Page 5: S h i f t i n g - RMA U · to enterprise risk management (ERM) as a way to address the risks they continually face. As they implement ERM pro - grams, organizations are realizing

October 2012 The RMA Journal

reviewedsofar(Figure2).Lackofalogicallycoherentanddynamic alignment between key variables of a specific risk approach limits the ability to generate sustainable organi-zational value that doesn’t erode when exposed to market dynamics or a change in competitors’ strategic direction.

The ERM culture alignment approach assumes that the following ERM elements interact dynamically with one an-other; it focuses on achieving organizational consistency and uniform ERM mechanisms that link key organizational units responsible for active value generation. The alignment consists of four core components:• ERMcultureinputs.• ERMculture.• ERMcultureoutputs.• Culturalfoundation.

ERM culture inputs are designed to exert significant in-fluence over business results and are critical to forming an effective ERM culture alignment. But while ERM culture inputs are based on organizational philosophy and shape ERM culture attributes, ERM culture is at the core of risk management structure.

In all aspects, for business and corporate strategies to fold into alignment with ERM strategy, enterprise risk awareness becomes essential. The main challenges for corporate leader-ship remain the same: to gain tacit understanding of what enterprise-wide risk awareness means in business reality and to align the business and corporate risk objectives.

16

depicting organizational capability in assessing, measuring, and mitigating the concentration of major risk exposures.

Can these core attributes—supported by set behaviors, specific knowledge, established skills, and appropriate infrastructure—build on an integrated risk management framework and become a foundation for a corporate cul-ture? If any of these components are not interconnected with the others, it is rather unlikely—if not impossible—that a strong ERM culture can be created.

Because every organization has a unique risk equation, ERM requires a distinctive interpretation from management. By demystifying ERM’s unique nature, management can focus on aligning strategy, culture, and risk mind-set, all leading toward establishing a competitive advantage.

However, by misinterpreting ERM, organizations expose themselvestounexpectedmarketdynamics.Lackofstrongrisk awareness affects the way organizations and employ-ees react to new information or potential changes that can significantly distort corporate dynamics and compromise maximum business effectiveness.

Analyses of competing views of ERM culture and available industry data show what organizations did to achieve end results, where they fell short, and which future develop-mental points might be recommended (see box on p. 14).

The observations shown establish a baseline for a new approach to culture, called ERM culture alignment, that ad-dresses the shortcomings identified in the cultural practices

Effective Risk Culture and Potential Shortcomings

Figure 1

Leadership & Strategy

Accountability & Reinforcement

People & Communication

Risk Management & Infrastructure

• Lack of consistent direction from management• Unawareness of corporate and business objectives and strategies• Lack of comprehensive alignment of objectives on corporate and business level

• Lack of clarity of individual accountability objectives• Lack of understanding of policies• Lack of focus on long-term objectives• Lack of consistent reinforcement of disciplinary actions

• Poor management approach toward receiving ’bad news’• Insufficient risk management training and development• Inadequate risk resources and high turnover of employees• Inconsistent enterprise-wide communication

• Imperfect understanding of risk• Weak management emphasis on the importance of risk management• Lack of robust risk change management process• Unidentified or poorly managed control gaps• No performance metrics

Source: Originated by the authors

Integrated Risk Management

Leadership & Strategy

• Integrity and Ethical Values• Communication Mission & Objectives

Accountability & Reinforcement

• Assignment of Responsibility• HR Practices & Performance Measurement

People & Communication

• Commitment to Compliance• Information & Communication

Risk Management & Infrastructure

• Establish Processes & Controls• Identify & Assess Risk

Page 6: S h i f t i n g - RMA U · to enterprise risk management (ERM) as a way to address the risks they continually face. As they implement ERM pro - grams, organizations are realizing

October 2012 The RMA Journal

Corporate leaders often fail to establish a consistent and inclusive behavioral model that can reinforce intangible risk and business rules. Management attitudes should exemplify ERM standards across the organization and ensure that such behaviors are accomplished.

Cultural awareness needs to be initiated from the top. ERM culture developed on the basis of cultural inputs should be well defined and transparent and maintain a level of consistency across the enterprise. Its dynamic and proactive nature would then trigger a uniform risk response to unexpected changes and minimize negative business impacts.

The factors defined as ERM outputs present an organi-zational state where the dynamic ERM culture alignment becomes a motivating driver for achievement in a prede-termined manner. Along with aligned ERM and strategic risk management pushing enhanced shareholder value as a key priority, gaining competitive advantage in the market becomes a primary indicator of future success.

Where to Start?“The Where”: Determine Strategic DirectionWhen business, strategy, and ERM units work together, they communicate what the organizational objectives are and how risk and strategies can be aligned to achieve them. Potential issues are analyzed and openly discussed to estab-lish an enterprise-wide level of collaboration, awareness, and understanding.

“The What”: Define Unique Organizational Structure What does the organization want to achieve? What are the corporate and business priorities and how do they fit into

ERM strategy? Regardless of whether the enterprise aims at 1) enhancing shareholder value, 2) meeting corporate objectives, 3) creating ERM culture, 4) reducing the element of risk surprise, 5) maintaining reputation, or 6) minimiz-ing the cost of risk, management needs to communicate it clearly from the top down. All employees should understand where the organization is going, its mission statement, and what the goals are.

“The How”: Define the Best Implementation Tools for the OrganizationManagement decides which tools will be used across the or-ganization to achieve the objectives and establishes a rapport with the relevant stakeholders. Some financial enterprises, depending on where they are with ERM implementation, favor adopting strong risk policies; others choose risk moni-toring to develop a solid risk management culture. Staff in organizations where ERM is well established appears to place more trust in management’s efforts to embed ERM culture into the corporate structure.

“The Who”: Focus on Achieving Key Results and Get It Done Together Organizations need to focus closely on getting it done together rather than being overwhelmed by an excessive number of action points. When risk ownership is well-defined as a collective effort, everyone understands their roles in the ERM implementation process and feels involved in creating a common ERM culture. An ERM mind-set and common risk language create a natural risk habitat and together dictate everyone’s enterprise-wide involvement.

As ERM culture alignment enforces the integration of pro-

17

ERM Culture Alignment

Figure 2

ERM Culture Inputs

ERM Culture

ERM Culture Outputs

ERM: Understanding Key Risks Enterprise-wide

Enterprise Risk Mind-set: Value-adding Decision Making

Business Strategy: Developing Business Objectives

Aligned with Risk Strategy

Management & Board: Achieve Buy-in &

Commitment at the Top

Corporate Strategy: Aligning Risk Appetite

and Tolerance

Transparent

Consistent

Enterprise-wide

Inclusive & Dynamic

Proactive

Well-defined

Aligned ERM and Strategy Development and Execution

Competitive Advantage Strategic Risk Management

Enhanced Shareholder Value Dynamic ERM Culture Alignment

ERM Communication & Dialogue

Common ERM Language

ERM Understanding & Acknowledgment

ERM Respect & Ethics

ERM Ownership & Collaboration ERM Mind-set ERM

Responsiveness

ERM Leadership Aligned with

Business

Source: Originated by the authors

Ò Ò

Page 7: S h i f t i n g - RMA U · to enterprise risk management (ERM) as a way to address the risks they continually face. As they implement ERM pro - grams, organizations are realizing

October 2012 The RMA Journal

risk culture. Effective resource allocation with the appropriate level of authority can significantly impact ERM culture. Finally, a cross-communication between lines of businesses, awareness of business objec-tives, use of risk-performance indicators, and the alignment of ERM with business planning were highly recommended.

Another significant factor contributing to the process of shaping ERM culture is ERM mind-set and enterprise-wide com-munication. Results-driven organizations view information flow and communica-tion as key principles for creating strong governance and culture. Enterprise-wide risk communication and a dialogue among management, employees, groups, and departments can help in understand-ing key risk concentrations (in terms of

risk appetite and tolerance). Employees should recognize risk management as strategic partners in the business and feel motivated to be proactively involved.

For example, within the ERM cultural alignment, an effective method for responding to risk issues is to identify stakeholders, gain their commitment and awareness, de-velop a robust communication strategy within safe channels, and ensure continuous feedback. Common risk language creates an ERM mind-set and generates an intimidation-free atmosphere for discussions with management about business and risk.

Developing success metrics to measure process effec-tiveness plays a crucial role in the process. Management’s commitment to creating a sustainable organizational culture should support developing unique cultural characteristics that can significantly impact business value and reputation. A robust ERM culture promotes leadership strategies for downward-upward communication.

The Way ForwardTransitioning risk culture into ERM culture and embedding it across the financial organization has became an area of increased focus, especially since lack of risk culture was a primary contributor to the recent financial crisis. Nev-ertheless, embedding a risk culture remains a significant challenge, especially for enterprises where risk management is developed in isolation. If key risks are being miscalcu-lated, then negative impacts on business performance will inevitably result.

ERM culture should be well defined, transparent, and consistent in the mission statement. It should be dynamic and allow proactive feedback and generate a uniform risk response. Significantly, ERM culture affects the decisions of all employees. And when those decisions run counter

18

cesses for formulating and executing core strategies with the planning for ERM implementation, management continues to work on understanding which factors determine effective ERM culture and what makes it truly unique.

What Drives an Effective ERM Culture? One of the most important factors influencing ERM culture is the involvement of leadership and employees at all levels in adopting, accepting, and promoting ERM and ERM culture.

A good example of an effective ERM approach and its focus on risk culture is Caterpillar, Inc. The firm adopted a unique ERM approach to the organizational structure—calling it business risk management, or BRM—by setting a key objective: to identify, track, and mitigate anything that would prevent the enterprise from achieving its long-term strategic objectives.10 To promote the BRM culture, Caterpillar developed a code of conduct statement, Our Values in Action. The code states that the firm sees risk as “something to be managed and as a potential opportunity.”

Other factors critical to developing ERM cultures are aligning ERM with corporate and business strategies and securing management buy-in. As senior management de-velops a strategic vision for the organization, the road map for corporate and business objectives is being established in tandem. Subsequently, ERM and strategy development should be aligned, becoming two sides of the same coin. ERM needs to be embedded in enterprise-wide activities, processes, policies, and procedures and implemented across all of the organization’s divisions.

In order to accomplish an alignment of ERM and risk culture, a well-defined vision and ERM planning become essential. Senior management’s commitment to creating a fitting internal environment and allocating sufficient resources has also been identified as critical in building

Transitioning risk culture into ERM culture and embedding it across the financial organization has became an area of increased focus, especially since lack of risk culture was a primary contributor to the recent financial crisis.

Page 8: S h i f t i n g - RMA U · to enterprise risk management (ERM) as a way to address the risks they continually face. As they implement ERM pro - grams, organizations are realizing

October 2012 The RMA Journal

to organizational policies and the established risk profile, it reflects a lack of risk culture, a weak organizational identity, and, in effect, little competitive strength.

Undeniably, a strong risk culture is a prerequisite for a sustainable ERM program. The ERM cultural alignment establishes a new focus for risk-based decisions that is sustainable over time and influences management and all employees. It also allows effective ERM implementation and becomes a source of sustainable competitive advantage. Finally, it inspires staff to promote integrity, enhance share-holder value, meet regulatory compliance, and generate long-term sustainability. v

••Abrahim Althonayan, Ph.D., is director of International Business Development and lecturer in strategic management at Brunel Business School, Uxbridge, England. He also has extensive experience in industry-based management and research. Joanna Keith is a risk management professional at J.P. Morgan Europe and a researcher at Brunel Business School. Henry Killackey is a strategic change facilitator and an organizational development specialist.

Notes1. Institute of International Finance, “Reform in the Financial Ser-vices Industry: Strengthening Practices for a More Stable System,” December 2009.

2. Douglas Brooks, “Creating a Risk-Aware Culture,” in Enterprise Risk Management: Today’s Leading Research and Best Practices for Tomorrow’s Executives (Hoboken: John Wiley & Sons, 2010).

3. J.M. Farrell and A. Hoon, What’s Your Company’s Risk Culture? 2010; available at www.directorship.com (viewed November 20, 2011).

4. C. Rossiter, “Risk Culture – Up Close and Personal,” CA Magazine 3, no. 134 (2001): 45.

5. Kevin Buehler, Andrew Freeman, and Ron Hulme, “Owning the Right Risks,” Harvard Business Review, September 2008.

6. Deloitte, Hot Topics: The Top 11 for Directors in 2011, Deloitte De-velopmentLLC,2011.

7. The Risk Management Association, Enterprise Risk Management Sur-vey, 2006; available at www.rmahq.org (viewed November 21, 2011)

8. AON, Enterprise Risk Management: The Full Picture, 2007; available at www.AON.com (viewed November 20, 2011).

9. PricewaterhouseCoopers, The Risk Culture Survey, 2009; available at www.pwc.com/riskculturesurvey (viewed November 20, 2011).

10. M. Driscoll, P. Walker, and R. Torok, “The Strategic Advantage of ERM,” Risk Management Magazine, March 2011.

The executive summary of the RMA McKinsey Global Risk Management Study will be available on www.rmahq.org later this fall.

19

Manage Your CRE Risk, Don’t Just Report It.FIMAC Solutions’ CRE Stress Analytics© & Construction Stress Analytics©, pinpoint risk in three ways; globally, by sector, and at the instrument level.

CRE Stress Analytics© and Construction Stress Analytics© provide unlimited filtering, concentration analysis, multi-level stress LTVs, Monte Carlo simulation, and all with full reporting flexibility.

Get them both from FIMAC Solutions.

FIMAC Solutions • www.fimacsolutions.comToll Free 877.322.1880