ERM in the Trenches

Copyright 2008 ProQuest Information and LearningAll Rights ReservedCopyright 2008 Risk Management Society Publishing, Inc. Risk Management

August 2008

DETAILS; Pg. 58 Vol. 55 No. 8 ISSN: 0035-5593

23196

758 words

ERM in the Trenches

Bigelow, Mark.

Mark Bigelow

Bigelow manages the ERM program for Premera Blue Cross, in Mountlake Terrace, Washington.

ABSTRACT

While enterprise risk management (ERM) has been around for a while, many companies are just beginning their programs. But no matter what the program's stage of maturity, certain valuable lessons will help avoid common pitfalls. These lessons are: 1. Top-down support is necessary but insufficient. 2. Risk categories are not a road map. 3. Simplicity is bliss. FULL TEXT

While ERM has been around for a while, many companies are just beginning their programs. But no matter what the program's stage of maturity, certain valuable lessons will help avoid common pitfalls.

1. Top-Down Support Is Necessary but Insufficient

Countless articles and classes all mention one point: without support from the top, you might as well not have an ERM program. It is very true. If executive leadership does not support ERM, it would either not exist or not provide any value. Support from senior leaders must be built if it is to achieve its mission.

What is not mentioned very often is the importance of the support of everyone else involved in the risk assessment process. This could range from executives to project managers to all company employees. These are the people who support the process by helping identify risks and developing treatments. If these people are not involved, your assessment will not be complete.

So, how can you engage them? In our program, we have tried two things: first, we have focused our assessment process on the development of treatments. By working with our clients to improve their own organization's processes, we have demonstrated how the ERM process can help them achieve their goals.

The second way is related to the first: you have to emphasize that ERM is there to enable strategy, not curtail it. Having gone through the assessment process, a given strategy can often look more appealing because you know what to expect. When you have a good road map, you can safely navigate paths others cannot.

By demonstrating the value of ERM to the entire team, you will earn their support and with that support, your risk assessments will provide more value.

2. Risk Categories Are Not a Road Map

The way you categorize, define and describe risks is important. All stakeholders in the ERM process must understand how a given risk is defined.

But we can become complacent with our categories. It is easy to limit our risk identification efforts to those categories alone, giving ourselves a false sense of security that every area of organizational risk has been identified.

For instance, in the novel Jurassic Park, a complex computer system helped manage the dinosaurs. One of its duties was to count the velociraptors. To do this, it was programmed to look for a given number of velociraptors and it always found that number. When a mathematician suggested that the velociraptors were reproducing (they were supposed to be sterile), he told the computer to look for additional velociraptors; it found them. He asked it to find even more; it found even more. He then asked for a huge number and when the computer came back with less than that, he learned how many there really were.

The important point is this: the computer expected to find a pre-defined number of velociraptors and once it found that many, it stopped looking.

The lesson is that just because we have found all the risks we have names and categories for, it does not mean we should stop looking. As we continually seek out and identify risks, we should also see if new risks might drive us to change what we are looking for.

Of course, we all deal with resource constraints. It might be difficult to identify every risk in the organization (although that is part of the goal). But do not let the risks that already have been identified prevent you from uncovering those that still need to be found.

3. Simplicity Is Bliss

It is important to present information in such a way that ensures the most valuable discussions are being had at the top. Otherwise, key factors could be missed.

If your rating methodology is simple and transparent, this discussion is invaluable. But if your methodology is too complex, the discussion will focus on the methodology instead of the risks, which will take away from meaningful dialogue your senior leaders should be having.

The same principle applies to all aspects of your program; everything should be made as simple and transparent as possible. Of course, some aspects are inherently complex (risk interactions, for instance) and require complex thought or tools to be properly understood. But always avoid unnecessary complexity.

Photographs

August 25, 2008