Beware the Risk Management Entertainment Systems

To shoot a gun, the proper command is “Ready, Aim, Fire.”  While the Fire part is the only active part of that sequence, it is clearly known by all that there is usually little point to simply sighting a gun without firing.  And in fact, for anyone who has ever owned a gun, there is at least some attention required to keep the gun clean and free of obstructions and the ammunition “fresh”.  I suppose that all fits into the “Ready” command.  So guns are not all about “fire,” but it would make little sense to talk about a gun without spending quite a bit of time talking about what happens when you pull the trigger.

Many firms have invested in ERM.  They have spent money on creating elaborate measurement systems; they have invested much, much management time in Identifying, Monitoring, Analyzing, Discussing, Reviewing, Evaluating, Communicating and Consulting about their risks.  They have brought this information to their boards and communicated about all of this activity to their board.

When asked what happens when there is a problem indicated by all of this activity, some of these firms would say that when a problem is found, they put it on the agenda for the next risk committee meeting, which may well recommend that a study be performed and the study would be reviewed at the next committee meeting.  The committee might then decide to move that risk to the top of the next report into the highlighted section of the report, when it will stay until the situation is resolved.

Perhaps these risk management systems are like the gun that is never fired.  It is cleaned repeatedly, new ammunition is purchased on time and the sight is checked, but the gun is just not fired.

In the ERM field, this is what can be called a Risk Management Entertainment System (RMES).  Below is a flow chart depicting a RMES.

In many cases, literature that describes ERM programs give so much attention to these components and so little to the other component that actually turns a RMES into an actual Risk Management System – the action part of ERM, that is when the risk manager pulls the trigger and actually does something.

The following picture, taken from the AS/NZ 4360 Risk Management Standard shows a complete Risk Management system.  The additional section of the chart that differentiates this from a RMES, titled here “Risk Treatment,” is the only active section of the chart.

But the picture of ERM is still dangerously misleading.  The danger is both to the firm managers who think that ACTION is just a tiny part of ERM and to the ultimate reputation of ERM.

The Risk Maangement Entertainment Systems create a very strong impression that ERM is a talking and paper shuffling activity.  A waste of scarce corporate time, resources and dollars.

ERM needs to be about action.  If in the end, ERM does not result in any changes to a firm’s treatment of risks or selection of risks, then there was no real business reason for ERM.

ERM needs to look like this:

Explore posts in the same categories: Action, Enterprise Risk Management, ERM, Risk Management, Risk Treatment

Tags: Enterprise Risk Management

You can comment below, or link to this permanent URL from your own site.