ENTERPRISE WIDE RISK MANAGEMENT

Helping to Reduce Risk Across Your Company

The majority of companies have developed approaches to manage risk types in isolation - in many cases using unsophisticated analysis techniques leaving unidentified risk exposures that can lead to a divergence and a fragmented approach for understanding underlying risk in your business.

Enterprise Wide Risk Management (ERM) remains a relatively new concept in many sectors and aims to help align and improve understanding risk by expanding the coverage of risk management activities to encompass all risk types and all parts of your company.

To provide an approach that is built on the identification, analysis, integration, evaluation, monitoring, and communication of risks across a company in a way that is aligned with the company’s objectives and risk appetite. This is followed by the aggregation of these exposures to provide the enterprise perspective from a portfolio approach. This is critical for informed “top down” management of enterprise risks.
Adopting a portfolio view of risk allows companies to take advantage of naturally offsetting risk exposures to optimise treatment strategies.
Incorporating Risk Into Strategy
Once it is understood how individual exposures contribute to aggregate risk, mitigation activities can be oriented in a more strategic way. Risk practices can be embedded into business processes across the board in areas such as strategic planning, capital investment/allocation, and performance measurement. Risk reporting on this basis provides management with the confidence to deploy capital with the clear overarching objective of creating value rather than simply preserving value.

Features

Building an ERM intelligent operation is daunting, even for companies with the most sophisticated risk capabilities. Bureau Veritas recommend a flexible approach, as it will incorporate a company’s culture into the process. Bureau Veritas’ preferred approach to assist in developing a mature ERM capability is as follows:

Establish a simple framework: Companies now have the opportunity to refine the elements of an array of different techniques to address the full spectrum of risk in a way that is relevant, practical and simple to use.
A clear, concise view of risk: Push hard for a concise but digestible view of key enterprise risks, including mitigation and monitoring activities.
Prioritise the outcomes: Better understand and quantify the factors that create and destroy value.

Uncover hidden exposure: New approaches covering facilitated workshops, anonymous feedback mechanisms, and accessing independent external advice all help to ensure these risks are minimised.

Embed risk assessment activity: Awareness, assessment and monitoring can become part of a company’s enhanced culture towards ERM. This must also include the development and implementation of key performance indicators for measurement of EWR processes and improvements.

Full internal audit coverage: Internal audits often have too narrow a focus on financial reporting of supposedly risk issues (invariably consequence focused), which reduces coverage of other key areas. The coverage should be expanded to ensure ERM is included in business processes and audit functions are used to ensure compliance.

ERM implementation/improvement: Decisions made at all levels need to be consistent with the company’s appetite for risk, and do not expose the business to unacceptable levels of new risk.

Bureau Veritas’s approach is based upon consistent application of a risk based framework throughout a company. This is through evaluations and audits of risk and safety management systems:

1. Against better practice Standards including the new International Risk Management Standard ISO 31000-2009 and the Australian Standard for Occupational Health and Safety Management Systems AS/NZS 4804-2001
2. Bench marking the EWR maturity within the company
3. Against enterprise wide management deficiencies and to satisfy due diligence and governance requirements
4. To assure managers of compliance with their regulatory and contractual requirements for risk and safety management
5.. To recommend appropriate corrective and preventive actions when required