Enterprise Risk Management (ERM) in Nonprofit Organizations. How to Get Your Organization to the Other Side of the Strategy Coin

Transcription

1 Enterprise Risk Management (ERM) in Nonprofit Organizations How to Get Your Organization to the Other Side of the Strategy Coin

2 Overview Ø What and Why ERM? Ø How is ERM Different? Ø Where Does it Fit? Ø What Makes It Meaningful? Ø How to Communicate? Ø Key Risks: Now What? Ø What is Your Appetite for Risk? Ø How Do You Put It All Together?

3 What is ERM? ERM is a process for identifying the key risks facing an organization; managing and mitigating those risks; and identifying and seizing opportunities to meet the organization s objectives.

4 Why is ERM important? Ø Regulators require it for certain industries. Ø Rating agencies and auditors ask about it. Ø Boards inquire about it. Ø Its an effective way to identify and/or eliminate risks that derail success.

5 Why is ERM really important now? Ø The world is changing faster than we are. Ø Seeing around the corner is harder. Ø Today s business world is volatile, uncertain and complex. Ø The past may not predict the future in a way that allows us to anticipate the risks and challenges of tomorrow. Ø The need for integrated ERM is a result of the changing business world where organizations face a broader risk scope, a higher risk complexity, and increasing interactions and dependencies that affect how we manage risk.

6 How is ERM different? Traditional risk management tends to focus on a reactive silo approach, where individual units deal with their own risk without focusing on the enterprise risks or risks across departments and the interdependencies of risk and opportunities.

7 How is ERM different? Value Tradi.onal Risk Management Focus: Hazard and Casualty Risks Scope: Insurance ERM Focus: Inter- Related Business Risks Scope: Align Strategy, processes, people, technology and knowledge on an Business Risk enterprise basis Management Focus: Individual Business Risks Scope: Business Managers Strategy Accountable Opera.ons Management Financial Time

8 Where does ERM fit? ERM is: Ø Board and executive leadership supported Ø Cross functional and integrated Ø Focused on risks to strategies rather than just risks to assets

9 What makes ERM meaningful? Ø Strategic Process need not be complex; time spent on risk identification and mitigation strategies allow for adjustment in strategies to take advantage of shifts in the environment. Ø Value Add Process should help senior management, not waste time. Ø Integrated Process should become another layer in your strategy for meeting goals.

10 Where does ERM fit? Ø ERM focuses on identifying, mitigating and managing key risks to meet strategic goals. Ø Compliance focuses on providing policies, training and oversight to ensure compliance and minimize risks, often manages hotline. Ø Audit focuses on review and audit of procedures and controls for handling and protecting our assets. Ø Business Continuity focuses on establishing plans to protect individuals and assets and to restore business operations if disrupted.

11 What are different ways to implement ERM? Ø Quantitative Expensive computer systems Sophisticated and statistically valid numerical rating systems Large ERM staff and significant time commitment from departments Ø Qualitative Meaningful and thoughtful discussions of risks and mitigating strategies

12 What makes it meaningful? See the forest for the trees. Ø Avoid complex ranking systems. Ø Spend your time listening. Ø Engage in meaningful conversations about key strategic goals and what could threaten them. Ø Balance qualitative & quantitative analysis. Ø Always consider and discuss emerging risks.

13 What are different ways to implement? Ø Stand Alone Program Ø Integrate Into Existing Activities Strategic Plan Annual Budget Processes Audit/Compliance/Legal/Business Continuity

14 How to Communicate? Its hard to engage successful people in a conversation about failure. Ø Reframe the conversation. Ø Start with your strategic goals & objectives. Link risks to strategies. Ø What has to happen to meet them? What could prevent you from accomplishing them? Ø ERM s purpose is to ensure that the organization meets its objectives.

15 How to Communicate? Identify Risks Ø Recognize that staff may be reluctant or uncomfortable talking about risk (lawyers are not the norm). Ø Having a written questionnaire may help staff think about the risks and articulate them (eat the elephant slowly). Ø Having an interview may help staff describe what they really meant (she said it not me).

16 One Simple Approach Identify Risks Give staff categories: Reputational Operational Financial GeoPolitical Regulatory Technology/Cyber Volunteers Partners/Vendors

17 One Simple Approach Identify Risks Ø What are the risks that could keep us from meeting our goals over the next three to five years? Ø What keeps you up at night? Ø What are more worried about this year than you were last year at this time? What are you less worried about?

18 One Simple Approach Evaluate Risks Ø What is the likelihood and severity of each risk? Ø How soon could each risk be realized? Ø How prepared is the organization for each risk? Numerical rankings can get tricky, hard to quantify meaningfully, often folks can spend time debating rankings or calculating rather than synthesizing the information

19 One Simple Approach Determine Risk Appetite Ø How much risk is acceptable? Ø How aggressive are our goals?

20 One Simple Approach Determine Key Risks Ø Synthesize information. Ø Look for root causes. Ø Plotting on heat map based on severity and likelihood can be helpful. Use your judgment. Synthesize the information.

21 Key Risks: Now What? Not all risks are treated equal. Ø Preventable Internal Risks= Avoidable and undesirable. No benefit to risk but tolerate minor errors. Ø Unpreventable External Risks = Uncontrollable. Reduce impact through planning and simulation exercises. Ø Strategy Risks = Desirable when ROI. Requires measurement against the strategic plan and desired mission outcomes.

22 One Simple Approach Ø Create a Framework- For each key risk category, evaluate the risk tolerance to meet the strategic goals, risk owner, action plan and trigger points as applicable and how it is monitored. Memorialize into Key Risk Table. Ø Identify Key Risk Indicators (KRIs) Determine the metrics that provide an early sign of increasing exposure to a key risk. Often metrics look backward not forward.

23 Preventable Internal Risks Ø Develop or emphasize mission or values statement. Ø Develop internal controls. Ø Make legal one of the team. Go to events. Learn operations. Ø Avoid silos. Ensure cross-functional teams touch every program. Ø Monitor and Communicate.

24 Unpreventable External Risks Ø Anticipate the unanticipated. Ø Develop systems to monitor and communicate external events/trends that could have impact. Ø Participate in table top and scenario exercises for crises and catastrophes. Ø Develop process for what happens when.

25 Strategy Risks Ø Understand what has to happen to meet the organization s mission and objectives. Ø Identify key areas of risk to those objectives. Ø Develop mitigation strategies. Ø Monitor and communicate. Ø Discuss risks.

26 Monitor Results Objectives Strategies Risks KRIs Link objectives

27 ERM in Practice So how does it really work? What worked? What didn t? How did it improve the organization s strategies and/or performance? What you wished you would have known when?