Risk Management Framework

Risk management is the process in which the level of risk to be taken is defined, and the levels of risk are measured with the objective of maximizing the company or portfolio value. Risk management is not about minimizing risk; it is about actively understanding and pursuing those risks which maximize the chance of achieving goals and minimizing the chance of failure.

Designing a Framework

Risk management has to be tailored to the enterprise and requires a custom solution. The risk management framework should address the following areas:

Risk Governance

Governance is the top-level system of structures, rights, and obligations in which an organization is directed and controlled. Risk governance defines the goals, grants authority, and determines the to-level decision-making.

Risk governance is, therefore, the top-down process and guidance that directs the risk management activities to align with and support the overall enterprise. Risk governance involves determining the risk tolerance of an organization and risk oversight.

Risk governance is often determined by regulatory concerns and the fiduciary role of the governing body. For best outcomes, risk governance assumes an enterprise-wide view. Enterprise risk management is an overarching governance approach applied in the whole organization and in alignment with its strategy, guiding the risk-management framework to focus risk activities on the objective, health, and value of the entire organization.

Risk Identification and Measurement

Risk identification and measurement is the quantitative core of the risk management process. It requires ongoing evaluation, both quantitative and qualitative, to analyze the relevant risk drivers of the risk exposures and to calculate risk metrics under various stress scenarios.

Risk Infrastructure

Infrastructure refers to people and systems that carry out the risk management process. This may include technology solutions capable of capturing, storing, computing, and reporting the necessary data, as well as skilled personnel to run this process.

Policies and Processes

Policies and processes are the extensions of risk governance into the daily operations of an organization. These limits, requirements, constraints, and guidelines should be integrated into the business process. Policies and processes may entail:

• Controlling cash flows in line with risk assessments.
• Conducting due diligence on potential investments.
• Ensuring decisions made include important checklists.
• Ensuring data is updated and protected.

Risk Monitoring, Mitigation, and Management

Actively monitoring and managing risk is a challenging task that requires a continuous and comprehensive evaluation of the risk management process. When it is determined that risk exposure is out of tune with the desired risk tolerance, action needs to be taken to normalize the risk exposure.

Communication

There must be a communication loop in place to ensure governance parameters can be communicated clearly to managers. The communication loop should also facilitate clear and timely reporting of risk metrics to the governors to enable them update the same and report back to the organization.

Strategic Analysis or Integration

The risk management framework should provide tools used to separate activities that add value from those that do not. This analysis can improve decision-making and generate better risk-adjusted returns.

Benefits of a Risk Management Framework

When risk management is integrated into all levels of the business, it means there is an effective risk culture. A risk culture generally produces better results than considering risk as an afterthought or ignoring it completely. The benefits include:

• less frequent surprises and a better understanding of the potential effect of a surprise;
• more disciplined approach to decision-making based on the risk-return relationship;
• better response and risk mitigation;
• better efficiency and fewer operational errors;
• a better relationship between the governing body and organization management; and
• a better corporate reputation.

Question

Which of the following is least likely a benefit of a well-implemented risk management framework?

A. Risks are minimized across the organization to allow for better overall company performance

B. A relationship of trust is developed between the governing body and the company management

C. A risk management framework generates feedback loops to allow for more informed and disciplined decision-making

Solution

The correct answer is A.

Risk management does not set out to minimize risks; it is about actively understanding and pursuing those risks which maximize the chance of achieving goals and minimizing the chance of failure.