Development of Risk Management in the Contemporary World 9th Dec 2011 CFO Summit, New Delhi. Presented by: Venkataram Arabolu, MD, BSI India.

“The policy of being too cautious is the biggest risk of all” Jawaharlal Nehru

Risk Mismanagement Risk mismanagement or the absence of risk management are at the root of each and every corporate failure that we have seen

Sample Organizational Risk Culture Board Seeks strategic dialogue about risk but must rely on intuition Lacks the knowledge & risk vocabulary to engage in dialogue with management Understands the risks but has little influence on decision making CEO Has narrow & siloed view of risk, often focusing on compliance CRO CFO Treasurer's office Business Unit Business Unit Business Unit Uses sophisticated risk management tools, but only for short term risk Lacks the sophistication to understand, much less measure, their own risks Source HBR Sept 08

Risk Management A survey by

Key Finding 1 Overall, post the global crisis, there is a consensus that anticipating and managing risks proactively is going to deliver tremendous long term value to organizations. Establishing a global footprint, cross border regulations, geo-political events and increased complexity in the value chain are leading to more risks.

Key Finding 2 While organizations are making progress in implementing risk management processes and structures, the biggest challenge is around integrating risk with strategy and the business. There is a need to de-mystify risk and make it simpler for business managers to grasp and implement. A firm commitment at the top and training in the use of risk management tools and approaches is essential to overcome this hurdle.

Key Finding 3 Boards today are expected to play the watchdog role – that of linking strategy, risks, rewards and executive compensation to ensure that there are no misalignments. Risk oversight challenges faced by independent directors are on account of their limited review of strategy and inadequate inputs into the information architecture to know about the business, industry and external factors.

Key Finding 4 The survey also reveals that organizations have made little or no progress in actually linking up the dots. Risk responses / mitigation strategies are still developed in isolation rather than on the basis of more holistic views that takes into account multiple scenarios and potential events. The usage of economic models and technology is limited. Also, few organizations look beyond 3 years while identifying and assessing risks and aspects such as sustainability and climate change are given limited importance.  Some companies are now adopting the practice of appointing Chief Risk Officers; even within the non-financial services sector. CEOs expect their risk officers to be more market and strategy-oriented than be overly focused on the operations and processes. Risk officers who are able to transcend to a strategic role will deliver the greatest value to their organizations.

Today's risk management

The Seven Golden Truths of Risk Management

Risk is not uncertainty. Risk is the effect of uncertainty

Risk is not uncertainty. Risk is the effect of uncertainty The impossible always happens somewhere, sometime, to someone....

Risk is not uncertainty. Risk is the effect of uncertainty The impossible always happens somewhere, sometime, to someone.... The greatest risk of all is denial

Risk is not uncertainty. Risk is the effect of uncertainty The impossible always happens somewhere, sometime, to someone.... The greatest risk of all is denial Much of the risk that affects us is manufactured by us

Risk is not uncertainty. Risk is the effect of uncertainty The impossible always happens somewhere, sometime, to someone.... The greatest risk of all is denial Much of the risk that affects us is manufactured by us Control what we can control – don’t try to control what we cannot control

Risk is not uncertainty. Risk is the effect of uncertainty The impossible always happens somewhere, sometime, to someone.... The greatest risk of all is denial Much of the risk that affects us is manufactured by us Control what we can control – don’t try to control what we cannot control Risk management is impossible without knowledge

Risk is not uncertainty. Risk is the effect of uncertainty The impossible always happens somewhere, sometime, to someone.... The greatest risk of all is denial Much of the risk that affects us is manufactured by us Control what we can control – don’t try to control what we cannot control Risk management is impossible without knowledge The ‘Unthinkable’, the ‘Impossible’ and the ‘Unknowable’ together can create the perfect risk storm which no company can survive

Risk is not uncertainty. Risk is the effect of uncertainty The impossible always happens somewhere, sometime, to someone.... The greatest risk of all is denial Much of the risk that affects us is manufactured by us Control what we can control – don’t try to control what we cannot control Risk management is impossible without knowledge The ‘Unthinkable’, the ‘Impossible’ and the ‘Unknowable’ together can create the perfect risk storm which no company can survive

Obstacles to Effective RM Top management support Internal communication/buy-in Fragmented risk systems/processes Risk measurement Dispersed/global operations Changing regulatory/legal requirements 3rd-party risks Risk prioritization over time On a positive note, stress that one of the key elements of success is embedding a culture to support risk management.

Historically Speaking 2001 The terrorism of September 11 and the collapse of Enron remind the world that nothing is too big for collapse 1993 The title “Chief Risk Officer” is first used by James Lam, at GE Capital, to describe a function to manage “all aspects of risk,” including risk management, back-office operations, and business and financial planning 1950s-1960s Traditional Risk Management (“TRM”) 1970s Risk management gains wider acceptance 1980s Companies begin Risk departments, typically focused on insurance 2004 Release of COSO ERM Integrated Framework 2009 ISO 31000 published- Principles and Guidelines. 1950 2010 1977 Foreign Corrupt Practices Act (“FCPA”) 1992 Committee of Sponsoring Organizations (“COSO”) published Internal Control — Integrated Framework 2002 Sarbanes-Oxley Act of 2002 1920 British Petroleum forms Tanker Insurance Company, Ltd., one of the first captive insurance companies, beginning a movement that exploded in the 1970s and 1980s. 1995 A multi-disciplinary task force of Standards Australia/Standards New Zealand publishes the first Risk Management Standard, AS/NZS 4360:1995. 2008 BS 31100 published which is Principles and Guidelines on Risk Management.

Risk - definition Effect of uncertainty on objectives Effect: is a deviation from the expected –positive and/or negative Objectives can have different angles (such as financial, health and safety and environmental goals) and can apply at different levels (such as strategic, organisation wide, project, product and process)

The RiSM Model Mandate and commitment Framework design for managing risk Implementing risk management Monitoring and review Maintenance and improvement

How we look at Risk

How should we look at Risk?

ISO 31000:2009, Risk Management Principles and Guidelines.

17