How can you adapt your ERM framework to changing business environments?

Enterprise Risk Management plays a vital role in identifying, evaluating, and managing risks within organizations. In a fast-evolving business environment driven by technology, competition, regulations, and shifting customer expectations, ERM frameworks must be adaptable and responsive. Key tools like digital ERM repositories, balanced scorecards, and effective intercompany communication are essential. Learning from past issues and applying best practices and industry expertise significantly contributes to effectively navigating these shifts and aligning with regulatory standards.

Adapting an Enterprise Risk Management (ERM) framework to changing business environments requires a proactive and dynamic approach. Here are several strategies to consider: Regular Risk Assessments: Conduct frequent risk assessments to identify emerging risks and changes in the business environment. This may involve scenario planning, environmental scanning, and engaging with internal stakeholders to stay informed about evolving risks Flexibility in Risk Identification: Ensure that the ERM framework is flexible enough to capture new and emerging risks that may not have been previously considered. Encourage open communication channels for employees to report potential risks as they arise.

Incorporating behavioural economics into the assessment of your current ERM framework can offer valuable insights. Traditional evaluations often hinge on rational decision-making models, neglecting the influence of cognitive biases and emotional factors. Behavioural economics can shed light on how these biases — such as overconfidence, risk aversion, or groupthink — may skew risk identification and mitigation strategies within your organisation. By understanding the behavioural elements at play, you can refine your ERM framework to account for these human variables, thereby improving the efficacy of your risk management practices. This adds a layer of sophistication, making your ERM framework not just robust but also psychologically nuanced

In a fast-paced environment -- particularly where regulatory change or obsolescence is a threat -- risk owners must pre-plan additional/future risk treatments to apply and the trigger and capacity to deploy them.

To adapt an ERM framework effectively, it’s essential not just to evaluate and revise, but to instill a culture of continuous improvement and adaptability within the organization. While tools and audits are beneficial, cultivating a mindset where change is expected and planned for, can make the adaptation process seamless. Consider the incorporation of agility in the framework. Agility allows for real-time risk assessment and management, facilitating quick responses to the changing business environment. For example, a more agile ERM framework can swiftly recalibrate risk priorities in response to a sudden market disruption, ensuring resilience amidst uncertainties.

Starting with impact and likelihood (qualitative and quantitative) your ERM should incorporate all types of risk, change and macro/micro indicators. However also is the firm track record of response to change in the past. a balanced picture of decreasing risk (they can't always be high right?) and also the exposure and appetite to risk are crucial in managing residual risk. One view of this is a science but don't forget the commentary and storytelling on the changing drivers of change. Additionally strategic changes are just as crucial to understanding current and future risk.

It is important to study all processes and steps, then pay attention to key triggers of exceptions in the business processes such as regulatory changes, social trends, market disruption, customer demands, environmental issues, technological innovation or disruption, etc. Assessing the likelihood and impacts of these factors identified must be carried out as well, to help with prioritizing the risks on how severe they are.

With the key triggers identified, then, we can make adjustments to our risk strategy and appetite. Decide whether to take more risks or reduce how many risks we take. While making these adjustments, the whole organization must be informed.

In my experience, engagement might seem tough at first, but once stakeholders trust that the risk managers are there to help and not be a hinderance, barriers tend to fall. Building a community around risk is extremely important and having sustained engagement with all your stakeholders is the key to anchoring a good culture. A good risk culture (and to a larger extent, risk management on a whole) is not only based on a common set of beliefs and values, but on trust and honesty. This can be achieved be developing Communities of Practice, Roundatables, or even Brownbag sessions. One-to-one engagements are also a must!

The operating environment is constantly changing with the velocity of risk always shifting. Key challenges facing enterprise risk management are underestimating issues and incomplete communication of concerns to executive leaders. There are many threats in the risk landscape. If you overcompensate for a risk you may miss the interdependencies and have a bigger risk fire to extinguish with higher risk mitigation costs. Risk understanding explains the connection between risk concerns and meeting company goals.

To answer the question, I propose creating a “modular” ERM framework. Define overarching elements (e.g, manufacturing, staffing, supply chain, finance, etc. Select which elements apply to your business). Next create a list of subrisks within each element. Update the elements and subrisks periodically. Rate and rank the elements, and the subrisks within each element so you can focus your resources on the critical risks. This should also allow you to create a flexible framework and tailor an ERM plan for discrete sectors and/or geographic locations rather than trying to apply a “one-size-fits-all” plan that can divert attention (and valuable resources) from enterprise-level risks that are unique to a particular business unit.