Exploring Enterprise Risk Management and Organizational Culture: Part One

Tom Cooper is currently an Assistant Professor at Memorial University in the area of strategic management. As a member of the ClearRisk Board of Advisors, Tom’s research and blogging focuses primarily on the interplay between strategy, risk and compliance as well as their effects on corporate responsibility. This week Tom is shifting from his discussion of strategic risk to enterprise risk management and organizational culture.

As we all know, the concept of risk management is gaining prominence in both the corporate and academic arenas. This series of blogs explores the importance of how a risk culture achieves effective risk management practices. Focusing on how organization risk cultures develop, we need to consider the personal and organizational influences on risk culture.

Read more

Strategic Risk as an Element of Operational Risk

Tom Cooper is currently an Assistant Professor at Memorial University in the area of strategic management. As a member of ClearRisk Board of Advisors, Tom’s research and blogging focuses primarily on the interplay between strategy, risk and compliance as well as their effects on corporate responsibility. ‘Strategic Risk as an Element of Operational Risk’ is the fourth in this ongoing series.

Read more

Examining Strategic Risk – ‘Strategic’ Risk or ‘Strategic Risk’ Management?

Risk management is much wider than simple financial or operational risk. Concepts such as ’strategic risk management’, ‘integrated risk management’ and ‘enterprise risk management’ now describe the wider application of such thinking, tools and techniques.

There is a common view that strategic risk is about managing risk ’strategically’ rather than examining strategic risk as a category similar to operational, financial and other risk areas. This common view causes confusion and may be one of the reasons that strategic risk is not further researched or specifically managed.

As outlined in my previous strategic risk blogs, one of the reasons for a lack of research is that there is no commonly accepted standard definition of strategic risk.

Much of this is no doubt due to the complexity of the concept of strategic risk, which suggests that no single quantitative measure will prove satisfactory in all strategic situations. Those risks that can be precisely quantified receive most of the attention from academic researchers, as well as corporate risk managers, while ’soft risks’, however significant, often receive little notice (cf. PricewaterhouseCoopers 2005). In order to further the literature, the need for a common understanding on strategic risk must be developed.

Read more

Examining Strategic Risk – What is it – Why Should We Care? Part 2

One of the reasons for the lack of academic research about strategic risk is the confusion as to what is ’strategic risk’. Many of the early ERM adopters are at a preliminary assessment in which they treat enterprise risk management as an extension of their audit of regulatory compliance processes. Other organizations are at a more advanced stage, in which they quantify risks and link them to shareholder and risk-transfer decisions.

Read more

Examining Strategic Risk – What is it – Why Should We Care? Part 1

Within the management literature, most organizations have viewed the process of risk management primarily as an issue of compliance with statutory or regulatory requirements. Risk management within organizations has traditionally occurred within specific areas – technology, regulatory, financial, environmental etc. – with little or no coordination. Major ‘risk’ events such as September 11, Enron, WorldCom and the recent financial crisis made it increasingly apparent that the processes, policies and procedures of managing organizational risk must be a cohesive, constant analysis of both the internal and external organizational environment.

After the major ‘risk’ events of the last twenty years, the literature suggests a concentration on compliance with statutory regulatory requirements as the driver for risk management within an organization may not be an effective motivation for the management of risk.

Read more

First Principles – What is a risk?

One of the good things in writing a blog is that it is up to me to determine where I start.

In my teaching and other work, I use a concept called First Principles. A ‘First Principle’ may be seen as what is the essential element defining an area or question.

So, what is the first principle of risk management – what is a risk?

Read more

Where were the risk managers?

As a former management consultant in the financial services practice at PricewaterhouseCoopers in London, United Kingdom and now primarily an academic who teaches strategy and risk management to business students, one of the questions I am asked about the financial crisis is ‘where were the risk managers’?

In the seven and a half years I spent dealing with large, global banks and insurance companies I met all kinds of risk managers. Highly compensated, professional, and thorough were the usual adjectives I would subscribe to the vast majority. However, where the big difference was in how much influence they had in the organization. Most banks would argue that they were in the business of risk – just as insurance companies were in the business of managing risk. The difference between being a ‘risk-taking’ versus a ‘risk management’ business was huge. Walking the floors, speaking to staff members and meeting top-executives it was not too difficult to see who were ‘risk takers’ versus ‘risk managers’. Yet, what is unclear is what made certain risk managers succeed versus others.

Read more