GRC Journal - (Page 29) Governance, Risk & Compliance Managing risk in the current era of enforcement, shareholder suits and explosive class action activity poses huge risks if you fail – and presents potentially entity-changing opportunities if you choose to embrace them. To address these concerns, a number of enterprise risk management frameworks have been developed over the past decade or so. And while each of these frameworks has its own strengths and weaknesses, and each its own supporters and detractors, together they provide a wealth of information about the essential steps of identifying and assessing risk. For this reason, many leading companies use not one approach, but rather apply a “metaframework” that draws on relevant portions of all and customizes the selected elements to fit their own cultures and goals. But in every case, the same basic steps must be taken to identify and rank risks before you can properly determine how to allocate limited resources to address them. These essential steps of the risk assessment process can be summed up in the acronym “BELIEVE.” There are seven areas of action represented by this term: Boundary Identification Event Identification Likelihood of Occurrence Impact of Occurrence Effectiveness of Current Controls Value Opportunity Effective Strategic Plan Each of these must be evaluated and developed in a meaningful risk assessment process. BOUNDARY IDENTIFICATION The goal of every organization is to achieve its business objectives while avoiding the many roadblocks that arise along the way. Yet, every organization must also operate within defined parameters of acceptable business conduct – what I call the mandated and voluntary boundaries. The mandated boundary includes laws, rules, and regulations with which the organization must comply – and of which we have no choice. The voluntary boundary, by contrast, is selected by management and includes those values, internal policies, and contractual obligations that we agree to abide by. As a first step in risk assessment, facts specific to the entity’s operations must be analyzed to determine whether specific laws or regulations apply, and in what fashion. Importantly, there will be some legal factors that can be defined as being of “primary” importance to the entity’s operations because they apply to major and frequently occurring operations; while others may be “secondary” because they arise only rarely or upon the occurrence of specific events outside the normal course of business. Beyond this identification of mandatory boundaries, the business must identify its voluntary boundaries – those which reflect the values, ethical principles, prevailing social norms, and internal policies that the management and leadership of the company wish to uphold. Only after both mandatory and voluntary boundaries of conduct are established can we truly determine how the organization can achieve its business goals while avoiding obstacles and staying within the boundaries. EVENT IDENTIFICATION A wide variety of events can give rise to risk occurrences, but these generally can be grouped as internal and external events which can prevent (risk) or assist (opportunities) you in achieving your objectives. Internal events include those that affect or bring change to the business architecture, generally including any changes to strategy, people, process, technology, location, or other infrastructure such as facilities and equipment. Some potential events are: merger and acquisition activity; labor disputes; new product and service development; and emergency or unanticipated situations such as environmental releases or violence in the workplace. You should focus specific attention on key business processes that may introduce risks. For example, foreign sales processes in certain regions may carry with them the risk of bribery and corruption. External events include economic and business events, natural hazards, political events and changes, and shifts in societal attitudes and actions. And events do not occur in isolation – you have to consider how one may cause a ripple effect of other events, or how opportunities in one area might be able to “offset” the risks found in other areas. But how do you go about identifying these risks? And must every risk be considered, even those that are remote? Of course, to do that would itself be a burden on limited resources. So the key is to involve a multi-disciplinary team from throughout your organization to identify the most significant events – those that are at least likely to occur and to affect desired outcomes. Consider what has happened before, both within your own organization and to others in your industry. What are the common risk events faced by your peers? What plans does your company have on the horizon that may create risk or opportunity? LIKELIHOOD OF EVENTS For each identified risk event, you then need to assess the likelihood and the extent to which the company may be affected. You can’t effectively set priorities for action and allocation of resources without thinking about these factors. You should use both quantitative and qualitative methods to conduct this risk assessment, and you should consider each in the context of the organization’s risk appetite. If you understand the likelihood and impact of risks, you will have a basis for resource allocation to establish appropriate responses and controls. IMPACT OF OCCURRENCE Knowing how likely an event is to occur is only the beginning of the analysis; you need to know what the impact will be if and when the event does take place. Not only do you need to evaluate the direct cost of the event, you must take into consideration the course of events and related costs that Q1 2007 | www.btquarterly.com BTQ Business Trends Quarterly 3 http://www.btquarterly.com
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.