How do you review and update your ERM strategy to reflect changing internal and external factors?

1.Pitfall: Overreliance on tools without cultural alignment. 2.Criticism: While tools are essential, a robust ERM strategy requires a risk-aware culture. ?? Example : To effectively update ERM, first assess the organization's risk culture and staff understanding. Conduct interviews to identify barriers and opportunities. Engage with business units to clarify risk scope and expectations. This bottom-up approach ensures alignment and informs decision-making.

In my experience implementing ERM frameworks in new Risk departments, documentation is only as useful as the organization's acceptance and adoption. The first step is assessing the Risk culture and staff adoption. Conducting one-on-one sessions with departments to gauge their perception and understanding of risk management helps identify barriers to embedding Risk by design. Collaborative sessions with all business lines then clarify risk scope and context, aiding the BoD in informed decision-making on accepted tolerance and expectations for Risk Management.

Assessing alignment with organizational goals, values, and vision is crucial for evaluating an ERM strategy. Utilizing tools like risk registers, matrices, and heat maps helps measure and monitor risk performance. Reviewing roles and responsibilities of key stakeholders like risk owners, committees, and management is essential to gauge engagement and accountability levels.

Before you assess the current state of ERM strategy within your organization, be sure you understand the history and implementation of that strategy. For example, if there's a record of limited acceptance, use, or adoption of ERM strategy in the organization, it is essential to assess the current state while also understanding what is truly possible, practical, or relevant. You want to make sure the ERM Strategy is fit-for-purpose and relevant to management and leadership. To those ends, consider how to make an impactful ERM strategy knowing the prior and current state of alignment to vision, mission, values, and goals, and how that strategy is being implemented. Then, work to take the Strategy to a better place than where it was.

From my experience, before updating the ERM strategy, it’s important to first assess the current state of the risk management framework. This involves reviewing both technical and intangible parts. The technical part includes existing processes, risk categories, controls, and risk appetite. For the intangible parts, it is important to understand the enterprise risk culture, feedback from stakeholders, and regulatory landscape.

1.Pitfall: Overreliance on static risk assessments. 2.Criticism: ERM should be dynamic, not a one-time exercise. ? example : Regularly update risk registers using data analytics and key risk indicators to identify emerging threats. Drivers of change: Economic downturns, regulatory shifts, technological advancements, geopolitical tensions, climate change, and competitor actions can significantly impact risk profiles.

While tools like PESTEL and SWOT analysis, and scenario planning and horizon scanning are great for analyzing key factors of interest to your organization's objectives and strategies, I recommend starting at the best level and scope of analysis for your enterprise and working to keep the process as simple and accessible as possible to increase both understanding and buy-in. For instance, in smaller or more agile organizations, focused interviews and surveys with the risk committees and leadership may be the best methods to understand key drivers of change. On the other hand, in more complex organizations, you may need a far more resources, staff, and tools to fully identify drivers. So, identify drivers in the way best fitting your needs.

We identify drivers of change, by complementing traditional tools like PESTEL and SWOT analyses with real-time data analytics and stakeholder feedback loops. We use horizon scanning to detect weak signals of disruption, such as emerging technologies or shifting regulations. We then engage cross-functional teams to gather insights from all areas of the business, ensuring a comprehensive view of internal and external factors. This multi-source approach helps reveal trends early, allowing us to adapt your ERM strategy in alignment with both immediate and long-term objectives.

Identifying internal and external factors that influence risk environment and objectives involves considering economic, political, social, technological, legal, and competitive aspects. Tools like PESTEL analysis, SWOT analysis, scenario planning, and horizon scanning can help analyze these factors and their impact on the organization.

Consider the history of your enterprise with risk assessment processes, and work to update risk assessments following a routine and standard process easily understood, implemented, and trained to all key contributors, managers, and leaders. As maturity increases, work to increase the frequency and detail of your risk assessment updates in ways that dovetail with leadership, management and risk committee needs. As part of your routine updates, work to leverage contributor feedback and insights to continuously improve your enterprise's risk assessments in ways that continue to enhance and improve risk management, but in ways that are incremental and hew to the policies, practices, and procedures essential to your organization.

You do not need to update the risk assessment methodology; rather, you should continuously run these assessments, at least quarterly, to account for the evolving risk environment. For cyber risk managment, this means adopting an assessment framework that can run on-demand and automatically account for the latest changes in the cyber risk landscape. Using solutions like an on-demand CRQ model, you'll gain quantified insights regarding the latest event likelihood and severity your organization faces, which can then be leveraged to update your ERM strategy. Understanding how much your organization stands to lose helps key stakeholders recalculate risk appetite and tolerance levels that better align with reality.

Update the risk assessment by continuously monitoring internal and external factors that could impact our organization. Conduct regular risk assessments, incorporating new data and insights. This involves reviewing and re-evaluating potential risks, their likelihood, and impact. By staying informed about changes in the business environment and industry trends, we ensure our risk assessment remains current and relevant, allowing us to proactively address emerging risks.

When updating the risk assessment, we incorporate a dynamic risk-ranking system that adjusts based on real-time changes in impact and likelihood. We use scenario analysis to evaluate how new risks or opportunities may evolve and affect existing risk priorities. We ensure risk owners are regularly reassigned or retrained as needed to address shifting risk profiles. By regularly updating our risk appetite and tolerance, we maintain alignment with evolving business goals and the changing risk landscape.

In the third step of risk management, updating the risk assessment involves considering drivers of change and the current state. This includes identifying new or emerging risks, changes in existing ones, evaluating likelihood and impact, prioritizing based on significance and urgency, and assigning to risk owners. Additionally, reviewing and aligning risk appetite and tolerance levels with strategic objectives and capabilities is crucial for effective risk management.

Risk response is the make-or-break part of the equation. A brilliant risk analysis may be let down by poor execution and/or the inability to build consensus on risk response. Plus, there are two aspects to the risk response i.e. the immediate treatment and the long-term solution including process automation or policy making. Both aspects need to be addressed.

I've personally experienced that KRIs (Key Risk Indicators) perform a good job of storytelling, pretty similar to KPIs in the Financial world. Notable KRIs include: 1) NC/process 2) Compliance% per process/function 3) Materiality involved 4) Efficiency achieved in terms of hours/days.

Update risk monitoring and reporting by integrating new tools and technologies to enhance real-time tracking and analysis of risks. Refine reporting processes to include updated risk indicators and metrics, ensuring they reflect the latest internal and external changes. Regularly scheduled reviews and feedback loops help us adjust our monitoring frameworks. This keeps our risk management agile and responsive to evolving circumstances, maintaining the accuracy and relevance of our reports.

We update risk culture and governance, by embedding a continuous improvement mindset in our organisation by creating feedback loops where lessons from recent risks are shared and incorporated into policies. We leverage ongoing training and awareness programs to ensure risk accountability permeates all levels. We review the effectiveness of our risk governance by assessing the performance of risk committees, charters, and policies, and recalibrate roles and responsibilities to enhance agility, ensuring that the governance framework supports both strategic alignment and rapid adaptation to emerging risks.

I agree that culture is defined by "values, behaviors, and attitudes (I will add actions) of the organization", but the phrase "update your risk culture" is a misnomer. You can AFFECT and INFLUENCE risk culture through risk awareness, accountability, transparency (e.g., many of the actions outlined in this step), but your organization's risk culture will be determined by the manner and extent - and at what levels - these concepts are accepted and incorporated.

Update the risk culture and governance by promoting continuous learning and awareness about emerging risks among all employees. Revise policies and procedures to incorporate best practices and ensure compliance with new regulations. Regular training sessions and workshops reinforce the importance of proactive risk management. By engaging leadership in driving these changes, we foster a culture that prioritizes risk awareness and strengthens governance structures to support our evolving ERM strategy.

To adapt your ERM strategy: 1. Review: Regularly assess risk landscape (internal & external). Look for new threats and changes in existing ones. Evaluate past events to understand their impact on current risks. 2. Update: Based on review, adjust your risk tolerance, prioritize risks, and refine response plans. Consider emerging technologies for risk management. 3. Communicate: Share updates with stakeholders to maintain awareness and ensure alignment with overall strategy. This continuous process ensures your ERM adapts to a dynamic environment.

Updating your cyber risk management strategy according to the latest landscape is a must, considering how quickly things can change in the digital realm. This rapid evolution also requires an on-demand cyber risk quantification tool that can generate updated results within a maximum of two days. Organizations can't afford to wait around while cyber risk managers manually gather information and research the latest cyber risk landscape because by the time these results have been rendered, the environment may have changed, meaning they need to update their ERM strategy yet again. The reassessment process should be conducted on a quarterly basis, ensuring that cybersecurity programs are targeting the highest priority threats.

"ERM Strategy" implies that ERM is its own initiative with its own objectives. I believe this is where ERM implementation efforts most often fail - because of outdated beliefs that ERM can, on its own, deliver effective risk oversight and management while remaining disconnected from the strategic decision-making efforts of an organization. Many of the suggested steps are key elements of designing, implementing and maintaining an effective ERM framework/management system (ala ISO or COSO), so maybe a more appropriate title for the article would be "How do you ensure continuous improvement and effectiveness of your ERM framework?".