Strategic and Reputational Risk
Management is responsible for managing the entity's risk, but it must go further: improving the conversation with the board and stakeholders about risks and how they are managed across the entire entity
Strategic Risk Management
Management has overall responsibility for managing risk for the entity, but it is important for management to go further: to improve the conversation with the board and stakeholders about using enterprise risk management to gain a competitive advantage. This starts with building enterprise risk management capabilities into the selection and refinement of strategy.
Through this process, management gains a better understanding of how explicitly considering risk can shape the choice of strategy. Enterprise risk management enriches the management dialogue by adding perspective on a strategy's strengths and weaknesses as conditions change, and on how well a strategy fits the organization's mission and vision. It gives management greater confidence that it has examined alternative strategies and considered input from the people in the organization who will carry out the chosen strategy.
Once strategy is set, enterprise risk management gives management an effective way to fulfill its role, knowing the organization is attuned to the risks that could affect the strategy and is managing them well. Applying enterprise risk management builds trust and gives stakeholders confidence in today's environment, which demands closer scrutiny than ever of how organizations actively address and manage their risks.
Benefits of Effective Enterprise Risk Management
Every organization must set a strategy and adjust it periodically, always aware of the ever-changing opportunities to create value and the challenges that will arise in pursuing that value. To do so, it needs the best possible framework for optimizing strategy and performance.
That is where enterprise risk management comes in. Organizations that integrate enterprise risk management across the entity can realize many benefits, including but not limited to:
- Expanding the range of opportunities: by considering all possibilities, both the upside and the downside of risk, management can identify new opportunities and unique challenges associated with current ones.
- Identifying and managing risk across the entity: every entity faces countless risks that can affect many parts of the organization. A risk may originate in one part of the entity yet affect another. Management therefore identifies and manages these risks across the entity to sustain and improve performance.
- Increasing positive outcomes and advantages while reducing negative surprises: enterprise risk management improves an entity's ability to identify risks and set appropriate responses, reducing surprises and the related costs or losses while benefiting from favorable developments.
- Reducing performance variability: for some, the challenge lies less in surprises and losses and more in performance variability. Running ahead of schedule or beyond expectations can cause as much concern as falling short. Enterprise risk management allows organizations to anticipate the risks that could affect performance and take the actions needed to minimize disruption and maximize opportunity.
- Improving resource deployment: every risk can be seen as a claim on resources. Robust risk information allows management, facing limited resources, to assess overall resource needs, prioritize deployment and improve allocation.
- Strengthening enterprise resilience: an entity's medium and long-term viability depends on its ability to anticipate and respond to change, not only to survive but also to evolve and thrive. Effective enterprise risk management makes this possible in part, and it becomes more important as the pace of change accelerates and business complexity grows.
Enterprise risk management, as it has traditionally been practiced, has helped many organizations identify, assess and manage strategy risks. But the most significant causes of value destruction lie in the possibility that the strategy does not support the entity's mission and vision, and in the implications of the strategy itself.
Our approach is comprehensive, covering strategy definition, performance, communication and control, and the integration of an efficient, straightforward risk portfolio with measurable results from day one.