ERM: Where to Go from Here: Why New Tools Are Needed to Help Companies Properly Assess Risks and Opportunities
During the past decade, many corporations have embraced enterprise risk management (ERM) processes to identify and prioritize risk. The prioritization of risk is typically done through "heat maps" showing which risks are most likely and which may have the most severe consequences. Effective ERM processes force an integrated consideration of risk, looking beyond single projects and departments. They take into account strategic, operational, financial, regulatory, environmental, and human issues. They involve the development of mitigation strategies, clarification of risk management responsibilities, sharing of best practices, and periodic monitoring and reassessment. [ILLUSTRATION OMITTED] The problem is that current ERM processes, while useful, are primitive. The profession must do a better job of managing all kinds of risks, correcting for common risk-related misconceptions, and quantifying risk exposures. BAD RISKS vs. GOOD RISKS Risk management involves weighing bad risks and good risks. Bad risks are events that a company wants to avoid, if possible, at a reasonable cost. Good risks arise from opportunities companies must seize to grow and prosper. Standard ERM processes are reasonably effective at identifying and prioritizing bad risks. But they are much less effective at managing good risks. And that can make it difficult for executives to accurately determine a company's risk appetite and manage their risks to stay within it. The risk-appetite concept can easily be applied m areas such as considering whether to hedge foreign exchange risk or in assessing financial institutions that would prefer to invest in subprime mortgages rather than high-quality corporate debt. But most companies cannot define, much less quantify, their risk appetite. Other than possibly placing some boundaries on what risks should be taken, ERM processes offer managers little good-risk or risk/return optimization guidance. Risk management failures were at the heart of the 2008-09 U.S. economic crisis. Mortgage lenders and insurance companies did not understand the quality of the assets and liabilities they were managing. As a result, they did not correctly price the risks they were taking; they did not grasp the implications of how their balance sheets were being overleveraged; and they did not take necessary precautions to maintain their organizations' liquidity. KNOWN RISKS AND MISPERCEIVED RISKS When managers begin their ERM processes, they compile lists of "known risks"--problems they've encountered before, or problems they can envision. If an organizational structure does not provide for a clear separation of duties, for example, a company could face employee fraud. Similarly, if computer files are not backed up, a company risks losing important data. Some risks can be predicted by extrapolating historical patterns. If margins continue to slip at the same rate as in the past five years, for instance, the company will run out of cash in 2014. But history isn't always a good guide to the future. Neither are humans. The core risk management problem is that human beings are not good at visualizing a world they have never seen. Brainstorming, engaging outsiders to provide objective input or maybe even to play a devil's advocate role, and scenario planning might help managers develop contingencies (see "Scenario Planning: Navigating Through Today's Uncertain World," JofA, March 2011, page 22). While it's impossible to conceive of every scenario, using some of these approaches should uncover risk events that otherwise may not have been identified. Humans are not good intuitive statisticians. They often are unable to comprehend highly improbable events. They can be overoptimistic about the likelihood of positive events, and can underestimate the likelihood of negative ones. Sometimes they latch onto an initial estimate and disregard new information. …