Northwestern Polytechnic University Integrating ERM in An Organization Research Paper The reading this week discusses strategy and how ERM can be integrate

Northwestern Polytechnic University Integrating ERM in An Organization Research Paper The reading this week discusses strategy and how ERM can be integrated with an organization’s overall strategy. Prepare a research paper on some of the various issues, protocols, methods, frameworks you found and discuss how – if possible – organizations can use ERM as strategy. It is perfectly acceptable if you deem ERM cannot be used as strategy, just back up your claim with scholarly research and justifications.Your paper should meet these requirements: Be approximately four to six pages in length, not including the required cover page and reference page.Follow APA 7 guidelines. Your paper should include an introduction, a body with fully developed content, and a conclusion.Support your answers with the readings from the course and at least two scholarly journal articles to support your positions, claims, and observations, in addition to your textbook. The UC Library is a great place to find resources.Be clearly and well-written, concise, and logical, using excellent grammar and style techniques. You are being graded in part on the quality of your writing. C o m m i t te e o f S p o n s o r i n g O rg a n iz a t i o n s o f t h e Tre a d w ay C o m m i s s i o n
Enterprise Risk Management
Integrating with Strategy and Performance
Executive Summary
June 2017
This project was commissioned by the Committee of Sponsoring Organizations of the
Treadway Commission (COSO), which is dedicated to providing thought leadership
through the development of comprehensive frameworks and guidance on internal
control, enterprise risk management, and fraud deterrence designed to improve organizational performance and oversight and to reduce the extent of fraud in organizations.
COSO is a private sector initiative, jointly sponsored and funded by:
• American Accounting Association
• American Institute of Certified Public Accountants
• Financial Executives International
• Institute of Management Accountants
• The Institute of Internal Auditors
©2017 All Rights Reserved. No part of this publication may be reproduced, redistributed, transmitted, or displayed in any form or by any means
without written permission of COSO. P254469-01 0516
Executive Summary
Foreword
In keeping with its overall mission, the COSO Board commissioned and published in 2004 Enterprise
Risk Management—Integrated Framework. Over the past decade, that publication has gained broad
acceptance by organizations in their efforts to manage risk. However, also through that period, the
complexity of risk has changed, new risks have emerged, and both boards and executives have
enhanced their awareness and oversight of enterprise risk management while asking for improved
risk reporting. This update to the 2004 publication addresses the evolution of enterprise risk
management and the need for organizations to improve their approach to managing risk to meet the
demands of an evolving business environment.
The updated document, now titled Enterprise Risk Management—Integrating with Strategy and
Performance, highlights the importance of considering risk in both the strategy-setting process and
in driving performance. The first part of the updated publication offers a perspective on current and
evolving concepts and applications of enterprise risk management. The second part, the Framework,
is organized into five easy-to-understand components that accommodate different viewpoints and
operating structures, and enhance strategies and decision-making. In short, this update:
• Provides greater insight into the value of enterprise risk management when setting and
carrying out strategy.
• Enhances alignment between performance and enterprise risk management to improve the
setting of performance targets and understanding the impact of risk on performance.
• Accommodates expectations for governance and oversight.
• Recognizes the globalization of markets and operations and the need to apply a common,
albeit tailored, approach across geographies.
• Presents new ways to view risk to setting and achieving objectives in the context of greater
business complexity.
• Expands reporting to address expectations for greater stakeholder transparency.
• Accommodates evolving technologies and the proliferation of data and analytics in supporting decision-making.
• Sets out core definitions, components, and principles for all levels of management involved
in designing, implementing, and conducting enterprise risk management practices.
Readers may also wish to consult a complementary publication, COSO’s Internal Control—
Integrated Framework. The two publications are distinct and have different focuses; neither
supersedes the other. However, they do connect. Internal Control—Integrated Framework
encompasses internal control, which is referenced in part in this updated publication, and therefore
the earlier document remains viable and suitable for designing, implementing, conducting, and
assessing internal control, and for consequent reporting.
The COSO Board would like to thank PwC for its significant contributions in developing Enterprise
Risk Management—Integrating with Strategy and Performance. Their full consideration of input
provided by many stakeholders and their insight were instrumental in ensuring that the strengths of
the original publication have been preserved, and that text has been clarified or expanded where
it was deemed helpful to do so. The COSO Board and PwC together would also like to thank the
Advisory Council and Observers for their contributions in reviewing and providing feedback.
Robert B. Hirth Jr.
COSO Chair
Dennis L. Chesley
PwC Project Lead Partner and Global
and APA Risk and Regulatory Leader
June 2017
iii
Enterprise Risk Management | Integrating with Strategy and Performance
Committee of Sponsoring Organizations of
the Treadway Commission
Board Members
Robert B. Hirth Jr.
Richard F. Chambers
Mitchell A. Danaher
Charles E. Landes
Douglas F. Prawitt
Sandra Richtermeyer
Miles E.A. Everson
Dennis L. Chesley
Frank J. Martens
Matthew Bagin
Hélène Katz
Katie T. Sylvis
Sallie Jo Perraglia
Kathleen Crader Zelnik
Maria Grimshaw
COSO Chair
American Institute of Certified Public
Accountants
The Institute of Internal Auditors
American Accounting Association
Financial Executives International
Institute of Management
Accountants
PwC—Author
Principal Contributors
Engagement Leader and Global
and Asia, Pacific, and Americas
(APA) Advisory Leader
New York, USA
Director
Washington DC, USA
Manager
New York, USA
iv
June 2017
Project Lead Partner and Global
and APA Risk and Regulatory
Leader
Washington DC, USA
Director
New York, USA
Manager
Washington DC, USA
Project Lead Director and Global
Risk Framework and Methodology
Leader
British Columbia, Canada
Director
Washington DC, USA
Senior Associate
New York, USA
Executive Summary
The Changing Risk Landscape
Our understanding of the nature of risk, the art and science of choice, lies at the core of our
modern economy. Every choice we make in the pursuit of objectives has its risks. From day-today operational decisions to the fundamental trade-offs in the boardroom, dealing with risk in
these choices is a part of decision-making.
As we seek to optimize a range of possible outcomes, decisions are rarely binary, with a right
and wrong answer. That’s why enterprise risk management may be called both an art and
a science. And when risk is considered in the formulation of an organization’s strategy and
business objectives, enterprise risk management helps to optimize outcomes.
Our understanding of risk and our practice of enterprise risk management have improved greatly
over the past few decades. But the margin for error is shrinking. The World Economic Forum
has commented on the “increasing volatility, complexity and ambiguity of the world.”1 That’s
a phenomenon we all recognize. Organizations encounter challenges that impact reliability,
relevancy, and trust. Stakeholders are more engaged today, seeking greater transparency and
accountability for managing the impact of risk while also critically evaluating leadership’s ability
to crystalize opportunities. Even success can bring with it additional downside risk—the risk of
not being able to fulfill unexpectedly high demand, or maintain expected business momentum,
for example.
Organizations need to be more adaptive to change. They need to think strategically about how
to manage the increasing volatility, complexity, and ambiguity of the world, particularly at the
senior levels in the organization and in the boardroom where the stakes are highest.
Enterprise Risk Management—Integrating with Strategy and Performance provides a
Framework for boards and management in entities of all sizes. It builds on the current level of
risk management that exists in the normal course of business. Further, it demonstrates how
integrating enterprise risk management practices throughout an entity helps to accelerate
growth and enhance performance. It also contains principles that can be applied—from
strategic decision-making through to performance.
Below, we describe why it makes sense for management and boards to use the enterprise
risk management framework,2 what organizations have achieved by applying enterprise risk
management, and what further benefits they can realize through its continued use. We conclude
with a look into the future.
Management’s Guide to Enterprise Risk Management
Management holds overall responsibility for managing risk to the entity, but it is important for
management to go further: to enhance the conversation with the board and stakeholders about
using enterprise risk management to gain a competitive advantage. That starts by deploying
enterprise risk management capabilities as part of selecting and refining a strategy.
Most notably, through this process, management will gain a better understanding of how the
explicit consideration of risk may impact the choice of strategy. Enterprise risk management
enriches management dialogue by adding perspective to the strengths and weaknesses of a
strategy as conditions change, and to how well a strategy fits with the organization’s mission
and vision. It allows management to feel more confident that they’ve examined alternative
strategies and considered the input of those in their organization who will implement the
strategy selected.
………………………………………………………………………………………..
1
The Global Risks Report 2016, 11th edition, World Economic Forum (2016).
2
The Framework uses the term “board of directors” or “board,” which encompasses the governing body, including
board, supervisory board, board of trustees, general partners, or owner.
June 2017
1
Enterprise Risk Management | Integrating with Strategy and Performance
Once strategy is set, enterprise risk management provides an effective way for management to fulfill
its role, knowing that the organization is attuned to risks that can impact strategy and is managing
them well. Applying enterprise risk management helps to create trust and instill confidence in
stakeholders in the current environment, which demands greater scrutiny than ever before about
how risk is actively addressing and managing these risks.
The Board’s Guide to Enterprise Risk Management
Every board has an oversight role, helping to support the creation of value in an entity and prevent its
decline. Traditionally, enterprise risk management has played a strong supporting role at the board
level. Now, boards are increasingly expected to provide oversight of enterprise risk management.
The Framework supplies important considerations for boards in defining and addressing their
risk oversight responsibilities. These considerations include governance and culture; strategy and
objective-setting; performance; information, communications and reporting; and the review and
revision of practices to enhance entity performance.
The board’s risk oversight role may include, but is not limited to:
• Reviewing, challenging, and concurring with management on:
–– Proposed strategy and risk appetite.
–– Alignment of strategy and business objectives with the entity’s stated mission, vision, and
core values
–– Significant business decisions including mergers acquisitions, capital allocations, funding, and
dividend-related decisions
–– Response to significant fluctuations in entity performance or the portfolio view of risk.
–– Responses to instances of deviation from core values.
Questions for
management
Can all of management—not just
the chief risk officer—articulate how
risk is considered in the selection of
strategy or business decisions? Can
they clearly articulate the entity’s risk
appetite and how it might influence a
specific decision? The resulting conversation may shed light on what the
mindset for risk taking is really like in
the organization.
Boards can also ask senior management to talk not only about risk
processes but also about culture.
How does the culture enable or inhibit
responsible risk taking? What lens does
management use to monitor the risk
culture, and how has that changed? As
things change—and things will change
whether or not they’re on the entity’s
radar—how can the board be confident
of an appropriate and timely response
from management?
• Approving management incentives and remuneration.
• Participating in investor and stakeholder relations.
Over the longer term, enterprise risk management can also enhance
enterprise resilience—the ability to anticipate and respond to
change. It helps organizations identify factors that represent not just
risk, but change, and how that change could impact performance
and necessitate a shift in strategy. By seeing change more clearly,
an organization can fashion its own plan; for example, should it
defensively pull back or invest in a new business? Enterprise risk
management provides the right framework for boards to assess risk
and embrace a mindset of resilience.
What Enterprise Risk Management
Has Achieved
COSO published Enterprise Risk Management—Integrated
Framework in 2004. The purpose of that publication was to help
entities better protect and enhance stakeholder value. Its underlying
philosophy was that “value is maximized when management sets
strategy and objectives to strike an optimal balance between growth
and return goals and related risks, and efficiently and effectively
deploys resources in pursuit of the entity’s objectives.”3
………………………………………………………………………………………..
3
2
June 2017
Enterprise Risk Management—Integrated Framework, Executive Summary, COSO (2004).
Executive Summary
Since its publication, the Framework has been used successfully
around the world, across industries, and in organizations of all
types and sizes to identify risks, manage those risks within a
defined risk appetite, and support the achievement of objectives.
Yet, while many have applied the Framework in practice, it has
the potential to be used more extensively. It would benefit from
examining certain aspects with more depth and clarity, and by
providing greater insight into the links between strategy, risk, and
performance. In response, therefore, the updated Framework in
this publication:
• More clearly connects enterprise risk management with a
multitude of stakeholder expectations.
• Positions risk in the context of an organization’s
performance, rather than as the subject of an isolated
exercise.
• Enables organizations to better anticipate risk so they can
get ahead of it, with an understanding that change creates
opportunities, not simply the potential for crises.
This update also answers the call for a stronger emphasis on how
enterprise risk management informs strategy and its performance.
Benefits of Effective Enterprise Risk
Management
All organizations need to set strategy and periodically adjust it,
always staying aware of both ever-changing opportunities for
creating value and the challenges that will occur in pursuit of
that value. To do that, they need the best possible framework for
optimizing strategy and performance.
That’s where enterprise risk management comes into play.
Organizations that integrate enterprise risk management
throughout the entity can realize many benefits, including, though
not limited to:
• Increasing the range of opportunities: By considering all
possibilities—both positive and negative aspects of risk—
management can identify new opportunities and unique
challenges associated with current opportunities.
• Identifying and managing risk entity-wide: Every entity faces
myriad risks that can affect many parts of the organization.
Sometimes a risk can originate in one part of the entity but
impact a different part. Consequently, management identifies and manages these entity-wide risks to sustain and
improve performance.
• Increasing positive outcomes and advantage while reducing negative surprises: Enterprise risk management allows
entities to improve their ability to identify risks and establish
appropriate responses, reducing surprises and related costs
or losses, while profiting from advantageous developments.
Clearing up a few
misconceptions
We’ve heard a few misconceptions
about the original Framework since
it was introduced in 2004. To set the
record straight:
Enterprise risk management is not
a function or department. It is the
culture, capabilities, and practices that
organizations integrate with strategy-setting and apply when they carry
out that strategy, with a purpose of
managing risk in creating, preserving,
and realizing value.
Enterprise risk management is more
than a risk listing. It requires more
than taking an inventory of all the risks
within the organization. It is broader and
includes practices that management
puts in place to actively manage risk.
Enterprise risk management
addresses more than internal control.
It also addresses other topics such as
strategy-setting, governance, communicating with stakeholders, and measuring performance. Its principles apply at
all levels of the organization and across
all functions.
Enterprise risk management is not
a checklist. It is a set of principles on
which processes can be built or integrated for a particular organization, and
it is a system of monitoring, learning,
and improving performance.
Enterprise risk management can be
used by organizations of any size. If an
organization has a mission, a strategy,
and objectives—and the need to make
decisions that fully consider risk—then
enterprise risk management can be
applied. It can and should be used by
all kinds of organizations, from small
businesses to community-based social
enterprises to government agencies to
Fortune 500 companies.
June 2017
3
Enterprise Risk Management | Integrating with Strategy and Performance
• Reducing performance variability: For some, the challenge is less with surprises
and losses and more with variability in performance. Performing ahead of schedule or beyond expectations may cause as much concern as performing short of
scheduling and expectations. Enterprise risk management allows organizations
to anticipate the risks that would affect performance and enable them to put in
place the actions needed to minimize disruption and maximize opportunity.
• Improving resource deployment: Every risk could be considered a request for
resources. Obtaining robust information on risk allows management, in the face
of finite resources, to assess overall resource needs, prioritize resource deployment and enhance resource allocation.
• Enhancing enterprise resilience: An entity’s medium- and long-term viability
depends on its ability to anticipate and respond to change, not only to survive
but also to evolve and thrive. This is, in part, enabled by effective enterprise risk
management. It becomes increasingly important as the pace of change accelerates and business complexity increases.
These benefits highlight the fact that risk should not be viewed solely as a potential
constraint or challenge to setting and carrying out a strategy. Rather, the change that
underlies risk and the organizational responses to risk give rise to strategic opportunities
and key differentiating capabilities.
The Role of Risk in Strategy Selection
Strategy selection is about making choices and accepting trade-offs. So it makes
sense to apply enterprise risk management to strategy as that is the best approach for
untangling the art and science of making well-informed choices.
Risk is a consideration in many strategy-setting processes. But risk is often evaluated
primarily in relation to its potential effect on an already-determined strategy. In other
words, the discussions focus on risks to the existing strategy: We have a strategy in place,
what could affect the relevance and viability of our strategy?
But there are other questions to ask about strategy, which org…
Purchase answer to see full
attachment