How can you scale your ERM program for different business units and geographies?

ERM is a very critical in success of any organization. You should have a very clear and specific ERM strategy to be implemented across the organization. ERM is a continuous process and should not be seen as a onetime compliance at the year-end activity. One very interesting quote I remember about ERM is, 'to think, we know & understand all risk around us is misleading, to think we can manage all of them, is an Illusion, and to turn blind eye to them is sheer foolishness. Identifying right ERM framework suitable and applicable considering complexity involved is very crucial. COSO ERM framework is widely accepted across the global organizations. One need to identify suitable quantitative as well as qualitative tools to be applied in ERM.

As name suggests Enterprise Risk Management is responsible for managing Risks OF and IN organisation. It should start from the Strategy formulation. Because it addresses the first and basic question in ERM what are our Objectives. Then the Tactics formulation to implement the strategy and then operational risks and Customer Experience and incorporate learning back in system. So understand this ERM umbrella we should practically include all dimensions of Business. It’s more of making Management, that is all employees, to aware that at the back of their activity, they are either enhancing positive side of risk or reducing negative side of it. It’s a culture.

ERM means a lot for most companies as it is used as a strategic tool, but it is better applied when it operates within a clear framework which conforms to best practices and standards. This framework must have room for adaptability to changing conditions and circumstances, along with defined roles, communication mechanisms fitting to the company risk tolerance, as measured by the proper tools and provide action options when needed.

It's important to make ERM simple. If you start with regulations and policies, it becomes more challenging. Get the conversation going, let your global team own it, encourage your regional teams to talk to each other and it will work itself out. Once you have this culture, you then share the regulations and policies and start moving into that effectiveness journey.

In addition, the key staff should have well defined role profiles to enhance deliverables and responsibilities. The ERM framework should clearly define what tool is selected. The team responsible should share all relevant information across the organizational structures, so that everyone is well informed. They also ensure routine review and monitoring for the purposes of being relevant.

Tailoring risk assessments to fit diverse business units and geographies is pivotal for scaling an ERM program. Customization involves considering local risk factors, regulations, and operational contexts, enabling prioritization of relevant risks and targeted mitigation strategies. While customization is key, comparing assessments across areas allows for identifying common patterns and synergies. This approach ensures alignment with local risk landscapes while maintaining consistency with overarching risk management objectives, crucial for managing risks effectively.

For the reasons of customisation I prefer to build the risk map. It will define the risks and compliance per every region. This way you won't lose anything. Your general framework then will consider all the pecularities.

Using template to provide a detailed log of risk ownership, the level of impact and probability, planned actions, and response status can be of great help in ERM Implementation. An organization's risk management approach should be customized to their own needs, including the organization's objectives and the external and internal context in which the organization operates.

Customizing ERM implementation involves tailoring the framework and practices to an organization's specific needs. It aligns the program with industry, size, risk profile, and objectives. This includes adapting established frameworks like ISO 31000 or COSO ERM by integrating industry best practices, considering internal processes, and adjusting risk identification, mitigation, and reporting methods. Customization enhances effectiveness by aligning with organizational culture and communication preferences. It ensures that risk management efforts are relevant and tailored to the organization's unique context.

To customise an ERM implementation can offer several pros but comes with its own set of challenges. Pros: a) Tailored to specific needs b) increase relevance c) offer flexibility and adaptability d) Improve engagement and risk ownership Challenges: i) Cost and resource intensive ii) Complexity iii) dependencies on expertise iv) potential for over-customisation v) compatibility and integration issues When deciding whether to customise the ERM implementation, it is essential to weigh the pros and challenges carefully against the organisation's specific needs, resource availability and its capability.

Standardize Framework Customize for Needs Establish Governance Align Risk Appetite Foster Culture Integrate Technology Encourage Collaboration Local Champions Continuous Monitoring Ensure Compliance Benchmark Performance

Technology adoption for greater efficiency and effectiveness in managing risk across jurisdictions is a good strategy to pursue, particularly wgere one might have the same functions being executed across subsidiary companies per jurisdiction. The appropriate technology would allow for a clearer view of risk across the broad, allow for the identification of areas of convergence which can be tackled as a whole, as oppose to per jurisdiction, alow fpr caapcity building among team members amd exposure to the various markets, potential cost savings, among other tangible benefits.

To know the geography of any place or to measure anything, data is essential. Data tells about the history of the place until you have historical data. Can't identify or follow a trend because the geographical data of any place shows the behavior of the people and the mental level of the people there and without data you can't calculate your risk.

In today's digital world, the idea of leveraging technology and use of data to scale the ERM program is important. There are several methods to consider: 1) Implement specialised ERM software to collect and analysis risk-related data. 2) Utilise data analytics and AI 3) Integrate risk data across the organisation for holistic assessment 4) Use predictive analytics for risk forecasting 5) Real-time monitoring and early warning signals 6) Cybersecurity measures 7) for continuous improvement through feedback loop The use of technology and data-driven decision making could aid organisations to streamline risk management process and improve decision making.

Considerar un software es vital de cara a la mejora continua y mejora de la productividad, se ahorra tiempo administrativo y se obtienen reportes automáticos.

Drawing reference to the Institute of Risk Management’s (IRM) Risk Culture model, it is essential to understand the current attitudes and behaviours of people across the organisation. This would help gauge the level of risk maturity and risk thinking across the enterprise post which the risk team or the CRO should chalk out a roadmap for risk culture enhancement through awareness sessions, trainings and continuous risk communications.

Building risk culture is key for efficient risk management. The best risk framework and processes are only effective with a strong risk culture in place!

Fostering a risk culture in ERM involves embedding risk awareness and accountability within an organization. This is achieved by promoting a mindset where employees understand and embrace their roles in managing risks. Effective communication and educational programs emphasize the importance of risk management. Open discussions, transparency, and reward systems encourage risk-aware behaviors, leading to a culture that promotes risk identification, assessment, and mitigation. A strong risk culture empowers employees to make informed decisions and contribute to the organization's overall success and resilience.

The risk culture should be oriented not to explain the past, but to improve the future. To the extent that people understand risk as an opportunity to make a difference and prepare for the unexpected, it opens up the possibility of moving forward in the midst of current challenges and proposing alternatives to respond to future adverse events.

For me, everyone has a role and impact in shaping a risk culture. As you scale the risk program throughout the organization, establishing clear expectations and getting buy-in at all levels goes a long way. I like to reference recent history either within the organization or within our industry to examine how we can better respond to a risk event in the future. Looking at real instances rather than just talking about hypotheticals can help reduce complacency and increase awareness of potential risks we may encounter.

The purpose of review and update the ERM program is to ensure its continued effectiveness with alignment of the evolving risks and the strategic objectives of the organisation. Here are some guidance to ponder: Timing for Review: i) Conduct regular review of minimum one a year ii) When key events trigger Processes for Review and Update: a) Assess current status of the ERM register, mitigation strategies, risk assessment methods and processes b) Gather feedback and records from risk registers, loss incident data c) Update risk profiles d) Assess Risk appetite and risk capacity again e) Evaluate the effectiveness of existing risk mitigation strategies f) Update risk responses g) Communicate latest findings and changes to all stakeholders

It’s really important to provide tools and automation to make it easy for staff to review and update risks. When the process isn’t easy, you risk your profile being outdated.

Regularly reviewing and updating the ERM program is crucial to ensure its effectiveness and relevance. This involves assessing performance, identifying areas for improvement, and learning from past experiences. Evaluating risk identification, mitigation, and monitoring methods helps enhance the program. By analyzing emerging risks, regulatory changes, and stakeholder expectations, organizations can update the program accordingly. Reviews also allow for adjusting risk appetite and identifying growth opportunities. Through ongoing updates, organizations maintain a robust ERM program that supports strategic objectives and enables them to navigate a dynamic risk landscape.

Imperativo medir el desempe?o del sistema integral de gestión de riesgos de cara a la aportación de valor, algunos kpi a considerar son: 1. Cumplimiento a plan de trabajo 2. Capacidades de quienes integran el equipo 3. Cantidad de riesgos que poseen controles Además, se debe considerar establecer un kpi para los principales ejecutivos: 1. Mitigación de riesgos, esto alineado al pago de bonos, lo que hace este indicador es identificar si hay debilidades de control interno que no han sido atendidas por la administración.

Regular reviews and updates are crucial components of a scalable ERM program. Given the dynamic nature of risks and the ever-changing business environment, organizations must establish a continuous improvement process. Periodic assessments ensure that the ERM program remains aligned with business objectives, adapts to emerging risks, and complies with evolving regulatory requirements.

frameworks, workflow, checklists, cheat sheets, tech solutions, lectures, online training, certifications inwriting or online all are delivery mechanisms, on occcassions leverage for litigation or employee sanction. But the best tool of all is CULTURE. It out paces, out reacts, pivots, mitigates and solutions faster, resetting all the bars on the way. So focus on culture over mechanism

The ERM (enterprise risk management) process is an unnecessary acronym. In our respectful view, depending on where one falls within a particular spectrum of business enterprise of growth - different philosophy apply. Consider the balance of risk and the rewards those risks may yield (paraphrasing risk v reward). The fundamentals of business are straight forward. Find the demand, provide supply, distinguish via service or quality and critically profitability - balancing risk, ethics, compliance and governance. #zbalawyers #zivbenarie

Cuando estamos hablando de diferentes negocios y geografías, es un error común que los risk managers piensen que lo que les ha funcionado en el pasado, les va a funcionar en los nuevos negocios y países y aprenden con sangre que hay que entender la cultura local para hacer la debida equalizacion del modelo para adaptarlo con cosas tan simples del léxico o costumbres

Risk management is a tool that is excellent to assist businesses to help protect themselves against inevitable and undue exposure to loss. The ideal risk assessment system will be if one can predict the future and with confidence forecast the evevent and sidestep it at a much reduced impact and cost cost. That to me ìs the point we should be looking at.

Desde mi perspectiva, considero que el crear cultura de manera creativa acelera la implementación del sistema integral de gestión de riesgos, asimismo el conseguir patrocinio de la Junta Directiva, y para finalizar capacitar a nuestro equipo para que comprendan la metodología.