登录查看更多内容

What are the most common mistakes companies make when implementing an ERM program?

由人工智能和领英社区提供技术支持

Enterprise risk management (ERM) is a strategic approach to identify, assess, and manage the potential threats and opportunities that affect an organization's objectives and performance. ERM can help companies enhance their value creation, improve their decision making, and strengthen their resilience. However, implementing an ERM program is not a simple or straightforward task. It requires careful planning, coordination, and communication among various stakeholders and functions. Many companies make common mistakes that undermine the effectiveness and credibility of their ERM program. Here are some of them and how to avoid them.

此文章中的业界达人

由社区从 6 条内容中精选。了解更多

1 Mistake 1: Lack of clear vision and alignment

One of the most common mistakes companies make when implementing an ERM program is not having a clear vision and alignment of what ERM is, why it is important, and how it supports the organization's strategy and culture. Without a clear vision and alignment, ERM can become a siloed, compliance-driven, or box-ticking exercise that adds little value and creates confusion and resistance. To avoid this mistake, companies should define and communicate their ERM vision and objectives, align them with their strategic priorities and risk appetite, and engage their senior leaders and board members in championing and overseeing the ERM program.

添加您的观点

Mauricio Ortiz, CISA

Great dad | Inspired Risk Management and Security Profesional | Cybersecurity | Leveraging Data Science & Analytics My posts and comments are my personal views and perspectives but not those of my employer
举报内容
Before integrating ERM, organizations must establish governance team who will define the ERM’s vision, mission, scope, and objectives.

已翻译

赞
Lena Vennstr?m

VP Finance, Legal and Procurement
举报内容
To be able to do this the organization have to have a broad insight and understanding of risk and risk management. It can be a catch 22 between having the right culture and setting the vision and strategy for ERM.

已翻译

赞

2 Mistake 2: Inadequate risk assessment and reporting

Another common mistake companies make when implementing an ERM program is not conducting a comprehensive, consistent, and dynamic risk assessment and reporting process. Without a robust risk assessment and reporting process, ERM can fail to capture the full range of risks that the organization faces, including emerging, interrelated, or non-financial risks. It can also fail to provide timely, relevant, and actionable information to the decision makers and stakeholders who need it. To avoid this mistake, companies should adopt a holistic, forward-looking, and scenario-based approach to risk assessment and reporting, using both qualitative and quantitative methods and tools. They should also update and communicate their risk assessment and reporting regularly, reflecting the changing internal and external environment.

添加您的观点

Mauricio Ortiz, CISA

Great dad | Inspired Risk Management and Security Profesional | Cybersecurity | Leveraging Data Science & Analytics My posts and comments are my personal views and perspectives but not those of my employer
举报内容
Agreed. Establishing a solid risk assessment process is important and most companies have it. The real mistake is to become rigid or not constantly reassess the ERM approach with key metrics to evaluate its effectiveness and adjust its criteria as needed. The ERM must be adaptive to identify and assess key risks and how they align with the company’s strategic objectives and risk appetite.

已翻译

赞

3 Mistake 3: Insufficient risk ownership and accountability

A third common mistake companies make when implementing an ERM program is not assigning clear risk ownership and accountability across the organization. Without clear risk ownership and accountability, ERM can suffer from a lack of ownership, responsibility, and empowerment among the people who are responsible for managing the risks. It can also suffer from a lack of coordination, collaboration, and feedback among the different risk owners and stakeholders. To avoid this mistake, companies should define and communicate the roles and responsibilities of the risk owners, managers, and overseers, including the board, senior management, business units, and functions. They should also establish and monitor the risk management policies, procedures, and controls, and hold the risk owners accountable for their performance and results.

添加您的观点

Lena Vennstr?m

VP Finance, Legal and Procurement
举报内容
Risk ownership is one of the most difficult thing to implement, especially on ERM level. It can be a wide gap between roles regarding understanding and knowledge of the risk, having the area most affected by the impact and being the function that can act on the risk. There is also a thin line between acting on risk vs acting on actions ongoing in the company. The organization have to watch out for implementing silos of following up on risks whereas activities should preferably be part of normal operations.

已翻译

赞

4 Mistake 4: Neglecting risk culture and behavior

A fourth common mistake companies make when implementing an ERM program is neglecting the risk culture and behavior of the organization. Without a strong risk culture and behavior, ERM can be undermined by the human factors that influence how people perceive, respond to, and communicate about risks. These factors include the values, beliefs, attitudes, incentives, and biases that shape the risk awareness, appetite, and tolerance of the organization and its members. To avoid this mistake, companies should foster and promote a risk culture and behavior that supports their ERM vision and objectives, encourages risk awareness and transparency, rewards risk taking and learning, and challenges risk complacency and groupthink.

添加您的观点

Lena Vennstr?m

VP Finance, Legal and Procurement
举报内容
Achieving this is key to avoid all listed mistakes in an efficient way. Culture overrides structure and governance every day.

已翻译

赞

5 Mistake 5: Failing to integrate ERM with other processes

A fifth common mistake companies make when implementing an ERM program is failing to integrate ERM with other processes and activities that affect the organization's performance and value creation. Without a proper integration, ERM can become isolated, irrelevant, or redundant, and miss the opportunities to enhance the organization's capabilities and outcomes. For example, ERM can be integrated with strategic planning, budgeting, performance management, innovation, project management, and crisis management, among others. To avoid this mistake, companies should align and link their ERM program with their core processes and activities, leveraging the synergies and benefits that ERM can provide.

添加您的观点

6 Mistake 6: Not measuring and improving ERM performance

A sixth common mistake companies make when implementing an ERM program is not measuring and improving their ERM performance and maturity. Without a proper measurement and improvement, ERM can stagnate, lose momentum, or become ineffective, and fail to demonstrate its value and impact to the organization and its stakeholders. To avoid this mistake, companies should establish and track the key performance indicators (KPIs) and key risk indicators (KRIs) that measure their ERM performance and maturity, such as risk coverage, risk response, risk exposure, risk appetite, risk culture, and risk value. They should also conduct regular reviews and audits of their ERM program, identifying the strengths, weaknesses, opportunities, and challenges, and implementing the necessary actions and changes to enhance their ERM program.

添加您的观点

Mauricio Ortiz, CISA

Great dad | Inspired Risk Management and Security Profesional | Cybersecurity | Leveraging Data Science & Analytics My posts and comments are my personal views and perspectives but not those of my employer
举报内容
Yes. This is the most important step and the most critical mistake for organizations. If there is a good governance model in place, this should be prevented and constantly reassess for improvement.

已翻译

赞

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

Corporate Finance

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

What are the most common mistakes companies make when implementing an ERM program?

1

2

3

4

5

6

7

1 Mistake 1: Lack of clear vision and alignment

2 Mistake 2: Inadequate risk assessment and reporting

3 Mistake 3: Insufficient risk ownership and accountability

4 Mistake 4: Neglecting risk culture and behavior

5 Mistake 5: Failing to integrate ERM with other processes

6 Mistake 6: Not measuring and improving ERM performance

7 Here’s what else to consider

Corporate Finance

给文章评分

感谢您的反馈

更多Corporate Finance相关文章

更多相关阅读内容