Nigeria: Positioning The Enterprise Risk Management Function For Strategic Organizational Efficiency

In any organization, risk is the primary source of uncertainty. The business environment is dynamic and ever-changing, as such, there is a need for all companies and its stakeholders to stay one step ahead of the uncertainties by adopting an all-inclusive and integrated mechanism of managing risks from identification, to control, to monitoring and reporting in a bid to minimize their intended impact on an organization.

By establishing an Enterprise Risk Management (ERM) program, businesses can set themselves up to be resilient in the face of uncertainty. Employing a holistic approach to risk management is a prerequisite for building corporate resilience and achieving organizational efficiency. Due to how interrelated and rapidly emerging risks are nowadays, senior management and boards are obliged to commit considerably more time to risk management.

ERM is a continuous process, traditionally driven by the firm's board of directors, implemented by management and practiced by the employees, who are individually enabled to recognize, understand and manage risks in the performance of their assigned roles.

Thus, it may be noted that ERM encompasses the full extent of the organization's operations and is not restricted to a particular event or circumstance impacting the organization's operations. it is a dynamic process that involves individuals at all levels, covers every area of the organization's resources and operations, and creates a comprehensive image of the entire business. The stakes when managing risk are higher now than ever before. As companies seek to grow organically or through strategic partnerships, their risk exposure extends as well. Without a comprehensive understanding of the specific risks and vulnerabilities that could threaten the organization's overall business strategy, no ERM program can succeed. This is why risk identification and a future-focused risk evaluation are the pertinent steps to allow a company to readily identify its key risks and subsequently assess the threat of each risk to the accomplishment of its goals.

In addition to a focus on internal and external threats, ERM emphasizes the significance of managing positive risk. Positive risks are opportunities that could boost the business value or, alternatively, adversely impact an organization if not taken. Indeed, the aim of any ERM program is not to eliminate all risk but to preserve and add to enterprise value by making smart risk decisions thus achieving operational efficiency.

Building an effective ERM Function

"The only thing constant in life is change." The current business climate continues to validate this statement as new threats and opportunities put organizational operating models to the test. Events past and present such as the financial crisis, technological advances, a global pandemic, and environmental, social and governance issues are critical stepping stones for the continuous development of ERM.

ERM necessitates assessing the firm's risk capacity and the determination of risk appetite to equip the Board of Directors to make an informed decision in setting objectives, evaluating options, and making a choice of strategy in pursuit of realizing the corporate vision. It seeks to strike the right balance between risk and return, with the considerations of risk capacity and risk appetite, at various activities and levels of the organization, across the company.

To build an effective ERM framework or model, the ensuing components need to be developed:

• First and foremost, the company needs to foster a culture of risk awareness where everyone in the organization is aware of risk and the importance of managing risks. When there is a strong risk culture in place, employees are better able to consider risk when making decisions and escalate problems as they arise.
• In addition, risk appetite is a key component of any ERM model. This is the level of risk that an organization is prepared to accept. It helps a company ensure that resources are not spent on further reducing risks that are already at an acceptable level. Risk appetite can be defined in both quantitative and qualitative terms.
• Another component is risk assessment. ERM requires an in-depth identification of internal and external risks and subsequently evaluating the potential likelihood of occurrence and impact of each risk.
• The two final components are risk reporting and risk governance. Periodic risk reporting of the risk profile to senior management and the board is needed to achieve risk transparency. Risk governance ensures that there is adherence to the ERM policy and oversees key points of interaction with other risk functions.

Merits of an effective ERM Function

Risk management strengthens the culture of an organization. A culture that values open and upward communication, the sharing of knowledge and best practices, ongoing process development, and a strong commitment to moral and ethical conduct in business are all fostered by an efficient risk management department. A functional ERM framework results in a unified culture that removes the barriers between siloed teams, directs decision-making, and promotes workflow effectiveness.

Organizations that prioritize risk management are more proactive than those that do not. ERM requires firms to carefully examine their business environment, scanning for risks and vulnerabilities using extensive what-if analysis and developing risk management strategies, mitigation plans, controls, and actions at the organizational, departmental, and individual levels. This assists companies in remaining prepared for change and coping with threats that may result from the crystallization of identified risks. By linking risk management more closely to business and front-office processes, a company stands to benefit more.

The Risk toolbox: Approaches to risk management

Risk management creates and protects enterprise value. As such, it is critical to employ methods that could lower the probability of a risk event happening or lessen the effects of the risk should it do so.

The following are various methods the rational risk taker can employ as a means of controlling enterprise risks:

Transfer: This is where organisations transfer the financial burden of a potential loss to another party. Insurance is a traditional, tried-and-true method of transferring risk whereby organizations pay a sum to an insurance provider (premium) in exchange for the provider covering any financial losses incurred should the insured risk materialize. Although risk transfer has a cost to the business, the cost ought to be less than the possible impact of that specific risk had it not been transferred.

Treat: To reduce the likelihood or impact of the most critical enterprise risks, organizations could decide to treat them. Risk treatment is used to mitigate the potential effects of identified hazards. The objective is to ensure that identified risks are handled with efficient controls, enabling a business to prevent potential losses in terms of money, reputation, and operation downtime.

Tolerate: A risk is tolerated if no action is taken to reduce or mitigate it. It is possible that this is the case because implementing risk reduction or mitigation measures is expensive or because the negative impact or likelihood of the risk materializes are so minimal that the organization considers them tolerable. Even if the dangers are accepted, they still need to be watched because future developments might render them intolerable.

Terminate: Some enterprise risks may be outside their internally approved risk appetite limits. Termination, as a risk management strategy, ensures that those processes and activities that create more risks than benefits are terminated. Rather than attempting to treat, tolerate, or transfer a risk, the first alternative to be explored is to remove it if it can be changed or removed without having a major negative impact on the firm.

Risk Management as everyone's job

Understanding the "enterprise" in ERM is important. This enterprise- or organization-wide view approach requires a holistic and hands-on approach to risk management. It involves all staff and a thorough diagnosis of all areas and processes of the organization. Undoubtedly, the ultimate advocate for risk management in any enterprise is the Chief Executive Officer (CEO). However, the collective employee workforce is just as important in the creation of enterprise value and the inherent success of any ERM framework.

Managers and supervisors must recognize the importance of this and ensure that the organization's culture supports a collaborative environment for voluntarily sharing both quantitative and qualitative data in the form of recommendations, experiences, and concerns from across the organization's core and support operations in order to effectively advance the ERM agenda. Therefore, there should be a constant flow of information that adds value between the ERM function and line management.

Conclusion

Traditionally, risk management is often met with pushback when its activities are being carried out. A major reason for this is that ERM activities are typically seen as a compliance activity that has to be done rather than a value-adding activity that helps the organization. It is necessary to integrate risk activities into business processes and activities and to foster an open-ended information flow that emanates from the top in order to position the ERM function to achieve operational efficiency in a company.

A successful ERM policy articulates a clear and compelling business case to showcase to internal stakeholders how crises and changes such as global pandemics, disruptive technologies, evolving customer expectations, digital transformation, regulatory and economic change can be managed and how to increase operational efficiencies.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.