1. The Center for Professional Education 11 Presentation AIG CIRC October 21 11:00-12:30 Seven Contributions of Enterprise Risk Management

2. The Center for Professional Education 22 Enterprise Risk Management (ERM) Newest entry in the risk management. Hazard (insurable) Risk. Fortuitous losses in traditional risk management. Business Risk. When an organization has the chance for either a gain or a loss.

3. The Center for Professional Education 33 Contributions of ERM (1-3) #1. Recognize Upside of Risk. Failure to take a risk is a risk itself. #2. Identify Risk Owners. Assign each risk to a single owner with hierarchical co-owners. #3. Align Risk Accountability. Match risks with business units and key initiatives.

4. The Center for Professional Education 44 Contributions of ERM (4-5) #4. Create a Central Risk Function. Identify exposures and share findings. #5. Create a High-tech Platform. For risk identification and collaboration.

5. The Center for Professional Education 55 Contributions of ERM (6-7) #6. Involve the Board. Make it easy to view critical risks. #7. Standardize Risk Evaluation. Follow a consistent process.

6. The Center for Professional Education 66 7 ERM Contributions #1 Recognize Upside of Risk #4 Create a Central Risk Function #7 Standardize Risk Evaluation #5 Create a High-tech Platform #3 Align Risk Accountability #2 Identify Risk Owners #6 Involve the Board

7. The Center for Professional Education 77 #1. Recognize Upside of Risk Risk Interaction. An exposure does not occur in isolation. One risk affects other risks. Upside of Risk. Business risk can produce gains and losses. A failure to take a risk is a risk itself.

8. The Center for Professional Education 88 #2. Identify Risk Owners A risk owner has: Responsibility. Identify a strategy. Authority and Resources. To deal with the exposure. Support. Shares ideas with so risk management is coordinated.

9. The Center for Professional Education 99 #2a. Risk Owner Example: Exposure: Avoid money laundering. Risk Owner: Chief Financial Officer

10. The Center for Professional Education 10 #3. Align Risk Accountability Align risk categories with business model. Strategy to be successful. Least disruption of current successful practices. New perspective on business risk.

11. The Center for Professional Education 11 Business Model Alignment Functional Staff. C-level production, marketing, finance, administration, technology, Business Units. Regions, autonomous operations, and subsidiaries. Key Initiatives. Major activities reflecting highly visible goals.

12. The Center for Professional Education 12 Match Risks with Owners We look only at important risks. Key risks have risk owners. Internal controls take care of “all” risks.

13. The Center for Professional Education 13 Match Key Risks Example European Aeronautic Defense and Space Company (EADS) and its Airbus unit. (Next slide)

14. The Center for Professional Education 14 EADS Key Risks EADS CEO Defense & Security Military Transport OtherAirbus Astrium Space

15. The Center for Professional Education 15 A380 Key Initiative Risk All by itself, A380 Airbus Engineering Procurement A380 Operations Aircraft Programs

16. The Center for Professional Education 16 Power8 for the A380 Operations Cut Costs Structure Improve A380 Streamline Assembly Lean Manufacturing Power8 Program Airport Issues

17. The Center for Professional Education 17 Key Risk of A380 Large Size Assign an owner. Develop options. Take action. (Next slide.)

18. The Center for Professional Education 18 Large Size – Airport Risk 8 Airports in the world? One bag at a time? Emergency with 800 people? One passenger at a time? Airport Risks

19. The Center for Professional Education 19 Large Size – Airline Risk Passenger Handling Emergency Management Airline Risks at Airports Baggage Handling

20. The Center for Professional Education 20 #4. Create a Central Risk Function An individual or unit coordinates risk discussions. It: Should occupy a high position in an organizational hierarchy. Should facilitate efforts by risk owners to manage risk. Should not manage risk itself.

21. The Center for Professional Education 21 Role of Central Risk Function A central risk function enhances an ERM program: Risk Identification. Risks that might otherwise be missed by key executives. Risk Sharing. Open channels for collaboration.

22. The Center for Professional Education 22 Scan Externally for Risks A central risk function should scan the horizon for: Operating risk. Market risk. Regulatory risk Political risk. Other exposures.

23. The Center for Professional Education 23 Scan for Internal Risks A central risk function should scan for Cultural risk. Management risk. Leadership risk. Human resources risk. Unit life cycle risk.

24. The Center for Professional Education 24 Central Risk Leader Title of chief risk officer (CRO)? CRO title can become a distraction. CEO is the real chief risk officer. Senior vice president avoids the problem.

25. The Center for Professional Education 25 Central Risk Function Senior Vice President Consultant #2 Project Analyst Consultant #1 Industry Analyst Human Resources Analyst

26. The Center for Professional Education 26 #5. Use Technology to Collaborate An ERM high-tech electronic platform allows: Risk identification by any authorized party. Collaboration among risk owners and others to understand risk and find solutions.

27. The Center for Professional Education 27 Authorized individuals share ideas. Electronic Platform. Can be queried by remote parties. Access. Passwords and authorizations. Contributor or Risk Owner. Authorized to add risks.

28. The Center for Professional Education 28 Airport Risk with the A380 Board member wants to know situation. Risk ownership passes through Airbus to A380 to Power8 program. Activities are visible (see next slide).

29. The Center for Professional Education 29 Airbus A380 Airport Risk Francois David Board Member Only 8 airports ready in the world? One bag at a time? Airport Risks Emergency with 800 people? Power8 Program A380 One Passenger at a time? Airbus

30. The Center for Professional Education 30 Management of the Platform Keep out unwanted visitors and messages: Queries. Searchable by key words. Formatting. User-friendly structures. Vetting. Compliance with organizational guidelines.

31. The Center for Professional Education 31 Importance of Vetting Accuracy is important: Collaboration enriches knowledge and problem solving. Still, opinion-style blogs show the danger of relying on opinions of others. Central risk should vet contributions.

32. The Center for Professional Education 32 #6. Involve the Board Various structures facilitate a fiduciary role: A central risk function working with an individual board member. Structure on next slide.

33. The Center for Professional Education 33 Member of Board Reports on ERM Board of Directors Central Risk Function CEOAudit COO Internal Audit ERM Board Member

34. The Center for Professional Education 34 #7. Employ a Standard Evaluation Process Assessment key risks: Identify the risk. Assign an owner. Assess the impact. Evaluate mitigation options. Implement, monitor, and revise.

35. The Center for Professional Education 35 Identify the Risk Risks come from various sources: External. Environment, economy, regulatory body, competitor, other. Cultural. Management or leadership styles, unit sub-cultures, relationships, other. Business Process. Internal controls, skills, capabilities, other.

36. The Center for Professional Education 36 Assign Owners Accountability and collaboration: Owner. Functional area, business unit, or key initiative. Co-owners. Work with the owner. Interested Parties. Authorized to participate.

37. The Center for Professional Education 37 Assess the Impact -- Likelihood Likelihood assessment. High. Likely at some future time. Medium. Possible. Low. Not likely to occur.

38. The Center for Professional Education 38 Assess the Impact -- Severity Severity assessment. High. Major disruption or damage. Medium. Important damage. Low. Damage but not significant.

39. The Center for Professional Education 39 Assess the Impact -- Quantification Use a common-sense system: Standardization. Approach to risk. Simple Scale. Red, Yellow, Green.

40. The Center for Professional Education 40 Identify Mitigation Options Mitigation. Risks to acceptable levels. Avoidance. Risks not mitigated. Transfer. Risks too big to keep all. Retention. Risks that are acceptable.

41. The Center for Professional Education 41 Implement, Monitor, and Revise Cost Benefit. Is mitigation cost effective? Assess. Does the risk meet an acceptable likelihood and severity? Decision Rule. Accept or avoid. Monitor Results. Revise as necessary.

42. The Center for Professional Education 42 Conclusion The brain can get it right.