Upload File

the final frontier. enterprise risk management is the discipline by which an organization in any...

  • Home
  • Documents
  • The Final Frontier. Enterprise Risk Management is the discipline by which an organization in any industry assesses, controls, exploits, finances, and
29
The Final Frontier

Upload: giles-tate

Post on 23-Dec-2015

218 views

Category:

Documents


0 download

Report

Tags:

TRANSCRIPT

Page 1: The Final Frontier. Enterprise Risk Management is the discipline by which an organization in any industry assesses, controls, exploits, finances, and

The Final Frontier

Susan Ponce
Suggest that we remove ERM from here and just start with 'The Final Frontier'. Then, moving to the next slide, title it Enterprise Risk Management and delete the word definition and take the quotes off the definition itself.
Page 2: The Final Frontier. Enterprise Risk Management is the discipline by which an organization in any industry assesses, controls, exploits, finances, and

Enterprise Risk Management is the discipline by which an organization in any industry assesses, controls, exploits, finances, and monitors risks from all sources for the purpose of increasing the organization’s short and long-term value to its stakeholders.

Page 3: The Final Frontier. Enterprise Risk Management is the discipline by which an organization in any industry assesses, controls, exploits, finances, and

Conceptual FrameworkERM Framework

  Types of Risk

Process Steps Hazard Financial Operational Strategic

Establish Context  

Identify Risks        

Analyze/Quantify Risks        

Assess/Prioritize Risks        

Treat/Exploit Risks        

Monitor & Review  

Page 4: The Final Frontier. Enterprise Risk Management is the discipline by which an organization in any industry assesses, controls, exploits, finances, and

Typical Risk Matrix

Page 5: The Final Frontier. Enterprise Risk Management is the discipline by which an organization in any industry assesses, controls, exploits, finances, and

Risk Model Maturity Spectrum

ProfileComply withRegulatoryObligations

ProtectShareholder

Value

EnhanceShareholder

Value

EARTH FINAL FRONTIER

Characteristics

Basic Moderate Advanced

• Manages risk of infractions

• Provides limited protection

• Uses risk management tools

• Protects assets and shareholder value

• Integrates risk measures across enterprise

• Enhances shareholder value

More Shareholder Value

Page 6: The Final Frontier. Enterprise Risk Management is the discipline by which an organization in any industry assesses, controls, exploits, finances, and

Overview of Enterprise Risks

Hazard Risks include risks from: Fire and other property damage; Windstorm and other natural perils; Theft and other crime, personal injury; Business interruption; Disease and disability (including work-related

injuries and diseases); Liability claims; War, and Terrorism.

Page 7: The Final Frontier. Enterprise Risk Management is the discipline by which an organization in any industry assesses, controls, exploits, finances, and

Overview of Enterprise Risks

Financial Risks include risks from: Price (e.g. asset value, interest rate,

commodity); Liquidity (e.g. cash flow, call risk, opportunity

cost); Credit (e.g. default, downgrade); Inflation/purchasing power; Hedging/basis risk, Taxes; and Currency fluctuations.

Page 8: The Final Frontier. Enterprise Risk Management is the discipline by which an organization in any industry assesses, controls, exploits, finances, and

Overview of Enterprise Risks Operational Risks include risks from:

Business operations (e.g., human resources, product development, capacity, efficiency, product/service failure, channel management, supply chain management, business cyclicality, demand for services);

Empowerment (e.g., leadership, change readiness); Information technology (e.g., relevance, availability); Information/business reporting (e.g., budgeting and

planning, accounting information, pension fund, investment evaluation, taxation);

National disaster; Failure to identify market trends; and Failure to properly document deals and transactions.

Susan Ponce
what is 'channel management'?
Page 9: The Final Frontier. Enterprise Risk Management is the discipline by which an organization in any industry assesses, controls, exploits, finances, and

Overview of Enterprise Risks

Strategic Risks include risks from: Reputational damage (e.g., trademark/brand

erosion, fraud, unfavorable publicity); Competition; Customer wants; Demographic and social/cultural trends; Technological innovation; Capital availability; and Regulatory and political trends.

Page 10: The Final Frontier. Enterprise Risk Management is the discipline by which an organization in any industry assesses, controls, exploits, finances, and

Overview of Enterprise Risk Management

Treat/ Exploit Risks

Assess/ Prioritize Risks

Analyze/ Quantify Risks

Identify

RisksEstablishContext

Monitor & Review

Mitigate

Page 11: The Final Frontier. Enterprise Risk Management is the discipline by which an organization in any industry assesses, controls, exploits, finances, and

Practical Considerations in Implementing ERM Designating an ERM “Champion” Making ERM part of the enterprise culture

(“tearing down the silos”) Determining all possible risks of the organization Quantifying operational and strategic risks Lack of appropriate risk transfer mechanisms Monitoring the Process Start Slowly – Build Upon Successes

Page 12: The Final Frontier. Enterprise Risk Management is the discipline by which an organization in any industry assesses, controls, exploits, finances, and

Critical Success Factors in Implementing ERMManagement Buy-InLeadershipFollow up

Page 13: The Final Frontier. Enterprise Risk Management is the discipline by which an organization in any industry assesses, controls, exploits, finances, and

Opportunity for Legal Officers

Take leadership role in risk identification and mitigation

Move beyond compliance to other risks facing the company and how they may have legal consequences

Preventive/proactive lawyeringConsider attorney client privilege

implicationsSpringboard for ethics and compliance

initiatives

Susan Ponce
some suggested language/wording changes
Page 14: The Final Frontier. Enterprise Risk Management is the discipline by which an organization in any industry assesses, controls, exploits, finances, and

Compliance Program inContext of ERM Universe

ERM

COMPLIANCEPROGRAM

Page 15: The Final Frontier. Enterprise Risk Management is the discipline by which an organization in any industry assesses, controls, exploits, finances, and

What is a Compliance Program

A program to ensure that a Company has an ethical/compliant culture, minimizing risk to the Company, its Directors and Officers of criminal/financial liability, while maximizing the credit available under the United States Federal Sentencing Guidelines in the event of a violation of law.

Page 16: The Final Frontier. Enterprise Risk Management is the discipline by which an organization in any industry assesses, controls, exploits, finances, and

USSG Seven Criteria1. Written policies and procedures (code of

conduct)2. Specific high level personnel assigned to

oversee compliance program3. Communicate standards to all

employees/agents; required participation in training-publications explaining program

4. Auditing and monitoring5. Method for reporting non-compliance

without fear of retaliation (anonymous or confidential reporting)

6. Consistent discipline for non-compliance7. Reasonable steps to respond and prevent

Page 17: The Final Frontier. Enterprise Risk Management is the discipline by which an organization in any industry assesses, controls, exploits, finances, and

Why Have a Compliance ProgramCaremark case: Directors must ensure that a company

has a system designed to detect, monitor, prevent and report any significant lack of compliance with applicable law.

Holder/Thompson Memos/SEC Position: Decisions whether to prosecute companies involve the questions of 1) whether upper level management was involved in the misconduct, 2) whether there was an effective compliance program, 3) the company’s criminal history, and the industry self-policing/reporting standards.

Federal Sentencing Guidelines: Company may significantly reduce sanctions, fines and penalties if it has an effective program to prevent and detect violations of law, the hallmark of which is due diligence.

A $6M fraud matter will produce a fine of $8.4 to $16.8 M for a corporation without a compliance program, which may be reduced to as little as $300K for a corporation with an effective compliance program.

Susan Ponce
Suggest this be split into two slides; a little busy and crowded for one.
Page 18: The Final Frontier. Enterprise Risk Management is the discipline by which an organization in any industry assesses, controls, exploits, finances, and

1. Establish standards & procedures reasonably “capable of reducing… prospect for criminal conduct”

Are the Code of Conduct and other policies simple, internally consistent and easily followed?

Is there a process for identifying, capturing and addressing material risks?

Is there a process to identify compliance issues early in the development of new or changing business models and laws?

Is there a process to update policies and procedures?

Do they cover all employees and other agents?

Susan Ponce
suggest adding a title - considerations for any compliance program (and how they may overlap with ERM)
Page 19: The Final Frontier. Enterprise Risk Management is the discipline by which an organization in any industry assesses, controls, exploits, finances, and

2. Assign oversight to specific high-level personnelWho serves as Compliance Officer?

Does the Compliance Officer have all appropriate access and all necessary resources?

Does the Compliance Officer have the right level of independence?

Does the Compliance Officer report directly to the CEO/GC/Audit Committee?

Does Compliance Officer review exception to Code of Ethics?

Is there Board oversight? Audit Committee or not Employee Certifications Conflicts of Interest

Page 20: The Final Frontier. Enterprise Risk Management is the discipline by which an organization in any industry assesses, controls, exploits, finances, and

2. Assign oversight to specific high-level personnel [continued]

Corporate commitment Is there strong executive leadership

commitment as demonstrated by communications, actions, budget (especially during tough economic times)?

Do regular business reports include compliance matters?

Are senior executives involved in the development of company policies?

Page 21: The Final Frontier. Enterprise Risk Management is the discipline by which an organization in any industry assesses, controls, exploits, finances, and

3. Use due care to avoid individuals with bad propensities

Are there employee screening/background checks?

Do performance reviews include ethics/ compliance?

Page 22: The Final Frontier. Enterprise Risk Management is the discipline by which an organization in any industry assesses, controls, exploits, finances, and

4. Effectively communicate standards to employees

Is there a vigorous process for the development and implementation of compliance training?

Is there a comprehensive communication plan addressing: turnover language barriers level of communication (6th grade v. college), channels of communication timing for each type of communication (new

policy, reminder, change in business or business practice, training, etc.)

brochures, webinars, etc.

Page 23: The Final Frontier. Enterprise Risk Management is the discipline by which an organization in any industry assesses, controls, exploits, finances, and

Training Issues

How often is training offered/repeated/updated?

Who is trained?Does everyone receive the same training?How is the training accomplished: in

person, Web based?BrochuresHow is the format determined?Is appropriate training mandatory?

Page 24: The Final Frontier. Enterprise Risk Management is the discipline by which an organization in any industry assesses, controls, exploits, finances, and

5. Monitoring, auditing, and using reporting system (without fear of retribution)

Is there a vigorous program of internal audits and on-site, in-house or outside legal audits?

Is there a reporting system that allows anonymous reporting, protecting identities to the extent permitted by law and consistent with the policies of the Company’s Code of Conduct?

Are there incentives for compliance as a job performance element/penalties for failure to perform?

Page 25: The Final Frontier. Enterprise Risk Management is the discipline by which an organization in any industry assesses, controls, exploits, finances, and

6. Consistent & Appropriate Discipline

Is there a well-articulated, even-handed, evenly enforced disciplinary policy?

Does the company dismiss/discipline high level managers for violations?

Are there robust mechanisms to discover and take appropriate disciplinary action in response to violations of law and policy?

Page 26: The Final Frontier. Enterprise Risk Management is the discipline by which an organization in any industry assesses, controls, exploits, finances, and

7. Take “All Reasonable Steps”

Does the company develop proportional and timely responses to mistakes?

Is there an honest evaluation on an ongoing basis to anticipate new issues and improve the program?

ERM is Next Step

Page 27: The Final Frontier. Enterprise Risk Management is the discipline by which an organization in any industry assesses, controls, exploits, finances, and

Compliance Pitfalls

Boilerplate programsStandards without established proceduresDouble standards regarding disciplinePoor communicationLack of enforcementConstrained resourcesDisconnect on risk/benefit analysis

Page 28: The Final Frontier. Enterprise Risk Management is the discipline by which an organization in any industry assesses, controls, exploits, finances, and

“LIVE LONG AND PROSPER”Mr. Spock

Page 29: The Final Frontier. Enterprise Risk Management is the discipline by which an organization in any industry assesses, controls, exploits, finances, and

~ Thank You ~Mark L. JonesJackson Walker L.L.P.

Corporate Partner1401 McKinney Street

Houston, TX [email protected]

Susan M. PonceHalliburton

Senior V.P. & Chief Ethics and Compliance Officer2107 CityWest Blvd., Bldg 4 - 13th Floor

Houston, TX 77042713-839-4509

[email protected]


m86 Web Exploits Report

March Intensive: XSS Exploits

Software Exploits for ILP

Common Exploits

Risk Evaluation in Enterprise Risk Management Enterprise Risk Management—The discipline by which an organization in any industry assesses, controls, exploits, finances and monitors

Healing Exploits in Evangelism

EXPLOITS MAGAZINE February 2014

Anointed to do exploits

The Ether Wars: Exploits, counter-exploits and honeypots ... CON 27/DEF CON 27... · ConsenSys Diligence | The Ether Wars: Exploits, counter-exploits and honeypots on Ethereum 2 About

Writing exploits

Discover Local Suid Exploits

Invasaocom exploits

Nethemba - Writing exploits

1.03 Healthcare Finances. 1.03 Understand healthcare agencies, finances, and trends Healthcare Finances Government Finances Private Finances 2

Finances publiques, finances privées

EXPLOITS Magazine August 2014

Enterprise Risk Management Defined...Apr 18, 2018  · –COSO ERM Framework, September 2017 The discipline by which an organization in any industry assesses, controls, exploits, finances,

Client side exploits

Exploits in Management*

Better Delivery. Better Exploits

Part What We Do - International Monetary Fund · The Fiscal Monitor updates medium-term fiscal projections and assesses developments in public finances. The IMF also publishes Regional

Mullah Nasrudin Exploits

TCP Exploits

Buffer Overflow Exploits

EXPLOITS MAGAZINE August 2013

Les exploits

Customizing Public Exploits

Enterprise Risk Management Seminar - NPFMEnterprise Risk Management (ERM) is the discipline by which an organization in any industry assesses, controls, exploits, finances, and monitors

EXPLOITS MAGAZINE April 2014

Lec03: Writing Exploits

Lec04: Writing Exploits

How Hamas Exploits Children

China StRategiC PeRSPeCtiveS 8 · study exploits primary source documents to reconstruct the ERW program’s history, assesses drivers behind decisions throughout the program, and

Anoiting for Exploits

Software Exploits