Page 4
The Robert W. Kolb Series in Finance provides a comprehensive view of the field of finance in all of its variety and complexity. The series is projected to include approximately 65 volumes covering all major topics and specializations in finance, ranging from investments, to corporate finance, to financial institutions. Each vol- ume in the Kolb Series in Finance consists of new articles especially written for the volume. Each Kolb Series volume is edited by a specialist in a particular area of finance, who develops the volume outline and commissions articles by the world’s experts in that particular field of finance. Each volume includes an editor’s introduction and approximately thirty articles to fully describe the current state of financial research and practice in a particular area of finance. The essays in each volume are intended for practicing finance professionals, grad- uate students, and advanced undergraduate students. The goal of each volume is to encapsulate the current state of knowledge in a particular area of finance so that the reader can quickly achieve a mastery of that special area of finance.
Page 5
ENTERPRISE RISK MANAGEMENT John Fraser Betty J. Simkins The Robert W. Kolb Series in Finance John Wiley & Sons, Inc.
Page 6
Copyright ©c 2010 by John Wiley & Sons, Inc. All rights reserved. Published by John Wiley & Sons, Inc., Hoboken, New Jersey. Published simultaneously in Canada. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning, or otherwise, except as permitted under Section 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 750-4470, or on the web at www.copyright.com. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at http://www.wiley.com/go/permissions. Limit of Liability/Disclaimer of Warranty: While the publisher and author have used their best efforts in preparing this book, they make no representations or warranties with respect to the accuracy or completeness of the contents of this book and specifically disclaim any implied warranties of merchantability or fitness for a particular purpose. No warranty may be created or extended by sales representatives or written sales materials. The advice and strategies contained herein may not be suitable for your situation. You should consult with a professional where appropriate. Neither the publisher nor author shall be liable for any loss of profit or any other commercial damages, including but not limited to special, incidental, consequential, or other damages. For general information on our other products and services or for technical support, please contact our Customer Care Department within the United States at (800) 762-2974, outside the United States at (317) 572-3993 or fax (317) 572-4002. Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic books. For more information about Wiley products, visit our web site at www.wiley.com. Library of Congress Cataloging-in-Publication Data: Fraser, John, 1946– Enterprise risk management : today’s leading research and best practices for tomorrow’s executives / John Fraser, Betty J. Simkins p. cm. – (The Robert W. Kolb series in finance) Includes index. ISBN 978-0-470-49908-5 (cloth) 1. Risk management. I. Simkins, Betty J., 1957– II. Title. HD61.F74 2010 658.15–dc22 Printed in the United States of America 10 9 8 7 6 5 4 3 2 1
Page 7
Contents Foreword by Robert S. Kaplan xix PART I Overview 1 1 Enterprise Risk Management: An Introduction and Overview 3 What Is Enterprise Risk Management? 3 Drivers of Enterprise Risk Management 4 Summary of the Book Chapters 5 Overview 5 ERM Management, Culture, and Control 6 ERM Tools and Techniques 8 Types of Risks 10 Survey Evidence and Academic Research 12 Special Topics and Case Studies 13 Future of ERM and Unresolved Issues 15 Notes 16 About the Editors 16 2 A Brief History of Risk Management 19 Introduction 19 Risk Management in Antiquity 19 After the Middle Ages 20 The Past 100 Years 21 Notes 28 About the Author 29 3 ERM and Its Role in Strategic Planning and Strategy Execution 31 Rising Expectations for Strategic Risk Management 32 ERM Positioned as Value-Adding 33 Board Demands for More Strategic Risk Management 34 Integrating Risk into Strategic Planning 34 Recognizing Strategic Business Risk 35 Evaluating Strategic Business Risk 36 v
Page 8
vi Contents 11 Tenets of the Return Driven Framework 37 Using a Framework to Build a Strategic Risk Management Mindset 39 Creating a Strategic Risk Mindset and Culture 40 A Strategic Risk Management Mindset 40 Recognizing Value of Strategic Risk Management at High-Performance Companies 42 Building a Strategic Risk Assessment Process 42 Strategic Risk Management Processes 43 Focus on Genuine Assets at Risk 44 Strategic Risk Management and Performance Measurement 45 Critical Steps for Value-Added Strategic Risk Management 47 Conclusion 48 Notes 48 About the Authors 50 4 The Role of the Board of Directors and Senior Management in Enterprise Risk Management 51 Introduction 51 Governance Expectations for Board Oversight of Risk Management 52 Delegation of Risk Oversight to Board Committees 58 Formalizing Risk Management Processes 58 Senior Executive Leadership in Risk Management 60 The Role of the Internal Audit Function in ERM 61 External Audit as an Independent Source of Key Risk Identification 61 ERM Implementation Strategies 62 Role of the Audit Committee 62 Role of the Board 63 Training 64 Board Composition 64 Reporting 65 Compliance 66 Culture 66 Conclusion 66 Notes 67 PART II ERM Management, Culture, and Control 69 5 Becoming the Lamp Bearer: The Emerging Roles of the Chief Risk Officer 71 The Origins of the CRO 72 The CRO as Compliance Champion 75 The CRO as Modeling Expert 76 The CRO as Strategic Controller 77 The CRO as Strategic Advisor 78 Which CRO Role to Play? 79 Conclusion 81 Notes 82
Page 9
CONTENTS vii References 82 Acknowledgments 85 About the Author 85 6 Creating a Risk-Aware Culture 87 The Importance of Culture 87 Defining Culture 87 The Goals of Culture 87 The Importance of Culture 88 When the Chips Are Down 88 Culture Can Discourage Good Risk Taking 90 Elements of a Risk-Aware Culture 91 Behavioral Elements 91 Process Elements 91 How to Create a Risk-Aware Culture 91 Defining the Elements 91 Measuring and Monitoring 92 Involvement and Buy-In 93 Openness 93 Tone from the Top 93 Alignment of Incentives and Rewards—Walking the Talk 93 What Does Risk Management Have to Do? 94 Conclusion 95 References 95 About the Author 95 7 ERM Frameworks 97 Introduction 97 Introduction to the ISO Risk Management Framework 97 Principles of Risk Management and Excellence in Risk Management 99 Elements of an ERM Framework 100 ERM Framework: Concept and Elements 100 Risk Management Process (RMP) 102 Risk Management Process: Context 105 Risk Management Process: Risk Assessment 106 Risk Management Process: Risk Treatment 109 Risk Management Process: Monitoring and Review 109 Risk Management Process: Communication and Consultation 109 Risk Management Process: Recording the Risk Management Process 110 Mandate and Commitment to the ERM Framework 110 Rationale for Commitment to ERM 111 Gap Analysis for ERM 111 Context for ERM Framework 112 Design, Decision, and Implementation of the ERM Framework 112 Risk Management Policy 113 Policies for the ERM Framework 113 Policies for Risk Management Decisions 113 Review of Policies 117
Page 10
viii Contents Integration of Risk Management and Resources for ERM 118 Communications, Consultation, and Reporting 119 Accountability 120 Continuous Improvement 121 Conclusion 122 References 122 About the Author 123 8 Identifying and Communicating Key Risk Indicators 125 Introduction 125 What Is a Key Risk Indicator? 126 Definition 126 Examples of KRIs 126 Differentiation from Key Performance Indicators 128 Practical Applications 129 Validate Organizational Planning and Monitor Performance 129 Enhance Operational Efficiency and Effectiveness 130 Clarify Risk-Taking Expectations 131 Monitor Risk Exposures 132 Measure Risk 133 Value of KRIs to Risk Management 134 Design Principles 135 Keep the Stakeholders and Objectives in Mind 135 Leverage Management Insight and Existing Metrics 135 Have a Good Basic Understanding of the Risks 135 Limit Indicators to Those That Are Most Representative 136 Ensure Clarity in What Is Being Measured 136 Focus More on Objective Measures 136 Consider the Wider Set of KRIs 136 Consider the Relative Importance of KRIs 136 Monitor for Continual Usefulness 137 Think Longer Term 137 Implementation Considerations 137 Obtaining Buy-In 138 Lack of Resources and Skills 138 Data and Technology Challenges 138 Integration with Business Activities 139 Sustainability of the KRI Framework 139 Conclusion 139 Note 139 Acknowledgment 140 About the Author 140 PART III ERM Tools and Techniques 141 9 How to Create and Use Corporate Risk Tolerance 143 Introduction 143 What Is Risk Tolerance? 144
Page 11
CONTENTS ix Why Is Setting Risk Tolerance Important? 144 What Are the Factors to Consider in Setting Risk Tolerance? 145 Attitude About Risk 146 Goals 146 Capability to Manage Risk 147 Capacity to Take Risk 149 Cost/Benefit of Managing Risk 150 How Can Your Organization Make Risk Tolerance Useful in Managing Risk? 150 Conclusion 152 Notes 153 About the Authors 154 10 How to Plan and Run a Risk Management Workshop 155 Introduction 155 What Is a Risk Workshop? 155 Why Use Workshops? 156 How to Conduct a Risk Workshop 156 Preparation 156 Identify the Sponsor 157 Set the Objectives of the Workshop 158 Set the Scope 159 Assemble Reference Materials 160 Set the Agenda 162 Decide on Attendees 164 Arrange Venue 164 Execution 165 Facilitate the Workshop 165 Record the Results 167 Prepare the Final Report 167 Techniques for Planning and Facilitating Effective Risk Workshops 168 “Anonymous” Voting 168 Useful Facilitation Tips 169 Tough Spots 169 Conclusion 170 About the Author 170 11 How to Prepare a Risk Profile 171 Introduction 171 Definition and Uses of a Corporate Risk Profile 171 Common Types of Corporate Risk Profiles 173 The “Top 10” List 173 The Risk Map 173 The Heat Map 174 Advantages and Disadvantages of Information-Gathering Methodologies 176
Page 12
x Contents How to Prepare a “Top 10” Risk Profile—Hydro One’s Experience 176 Step 1: Schedule Interviews and Gather Background Information 177 Step 2: Prepare the Interview Tools 178 Step 3: Summarize the Interview Findings 181 Step 4: Summarize the Risk Ratings and Trends 182 Step 5: Draft the Top 10 Risk Profile 182 Step 6: Review the Draft Risk Profile 184 Step 7: Communicate the Risk Profile with the Board or Board Committee 185 Step 8: Track the Results 186 Conclusion 186 Notes 186 References 187 About the Author 188 12 How to Allocate Resources Based on Risk 189 Introduction 189 Risk Policy and a Center of Excellence for Risk Management 191 Key Policy Elements 191 Center of Excellence 192 Translating Strategic Objectives into Risk-Based Concepts 192 The Consequence Domain 193 The Probability Domain 197 The Integration of Business Objectives/Risk Events/Risk Concepts 198 Risk-Based Business Processes and Organizational Considerations 200 Risk-Based Business Processes 200 Organizational Considerations 204 Concepts, Methods, and Models Enabling Risk Identification, Evaluation, Mitigation, Prioritization, and Management 206 The Concept of Evaluation Time Frames 206 Methods and Models to Quantify the Impact of Risk Events 207 Prioritization of Investment Proposals 209 Management of the Portfolio of Preferred Investment Proposals 211 Information Requirements and Challenges 211 Operational Risk Assessment Information 212 Strategic Risk Assessments 212 Measures of Effectiveness for Continuous Improvement 213 Conclusion 213 Notes 214 About the Author 216 Appendix 12.A 216 13 Quantitative Risk Assessment in ERM 219 Introduction 219 Risk Assessment: Four Alternative Approaches 222 Method 1: Active Management of the Largest Risks 222 Method 2: “High/Medium/Low” Classification of Risks: The Two-Dimensional Risk Map 224
Page 13
CONTENTS xi Method 3: Risk Assessment Using Refined Classifications: Refining the Classification 225 Method 4: Statistical Analysis 229 Aggregating Probabilities and Impacts 230 Total Corporate Risk: An Illustration 232 Incorporating Risk Quantification in the Business Planning Process 233 Sensitivities and Scenarios 233 Conclusion 234 Notes 235 References 235 About the Author 235 PART IV Types of Risk 237 14 Market Risk Management and Common Elements with Credit Risk Management 239 Introduction to Credit Risk and Market Risk 239 A Taxonomy of Market and Credit Risk 240 Credit and Market Risk in an ERM Framework 241 Responding to Credit and Market Risk 242 The Case for Actively Managing Market Risk 243 The Case for Not Actively Managing Market Risk 244 Natural Market Risk Management 245 Measuring Market Risk 246 The Markets as Risk Indicators 247 Measuring Potential Impact 248 Earnings at Risk 249 Market Risk Management with Forward-Type Products 250 Market Risk Management with Option-Type Products 253 Trade-Offs Between Option Strategies and Forward Strategies 255 Operational Issues of Using Derivatives 256 Governance and Oversight of Market Risk Management 257 Conclusion 259 Notes 259 References 260 About the Author 260 15 Credit Risk Management 261 Credit Risk Analysis 261 Fundamental Analysis of Credit Default Risk (Probability of Default) 263 Market-Based Analysis of Credit Default Probability 266 Statistical-Based Models of Credit Risk 268 Credit Risk Mitigation 269 An Analysis of the Credit Crisis 272 Conclusion 277 Notes 277
Page 14
xii Contents References 277 About the Author 278 16 Operational Risk Management 279 Introduction 279 What Is Operational Risk and Why Should You Care About It? 280 Is Risk All Bad? 283 How Do You Assess Operational Risks, Particularly in a Dynamic Business Environment? 284 Why You Need to Define Risk Tolerance for Aligned Decision Making 287 What Can You Do to Effectively Manage Operational Risk? 289 How Do You Encourage a Culture of Risk Management at the Operational Level? 296 How Do You Align Operational Risk Management with Enterprise Risk Management? 297 Conclusion 300 Notes 301 About the Author 301 17 Risk Management: Techniques in Search of a Strategy 303 Introduction 303 Current Situation 304 Risk Strategy Framework 307 Governance 312 New Directions 314 Enterprise Risk Management (ERM): The First Step 314 Enterprise Resilience (ER): The Next Step? 315 Conclusion 316 Notes 316 References 318 About the Author 320 18 Managing Financial Risk and Its Interaction with Enterprise Risk Management 321 Introduction 321 What Is Financial Risk and How Is It Managed? 322 Case 1: Currency Price Risk: The Multinational Corporation 323 Case 2: Interest Rate Risk: The “Heavy-Debt” Firm 324 Case 3: Commodity Price Risk: The Firm with a Highly Volatile Input Cost 324 Theoretical Underpinnings of Financial Hedging and Empirical Findings 325 Hedging Reduces Expected Costs of Financial Distress and Underinvestment 325 Hedging Creates More Debt Capacity 326 Hedging Reflects the Incentives of the Firm’s Management and Board 326 Does Hedging Affect Firm Value? 327
Page 15
CONTENTS xiii Interaction of Financial Hedging with Other Types of Risk Management 328 Credit Risk Management 328 Operational Risk Management 329 Strategic Risk Management 330 Reputation and Legal Risk Management 330 Financial Reporting and Disclosure Risk Management 331 What Can We Learn About ERM Given Our Knowledge of Financial Hedging? 332 Notes 333 References 333 About the Author 334 19 Bank Capital Regulation and Enterprise Risk Management 337 Introduction 337 The Evolution of Bank Capital Requirements 337 Overview of U.S. Capital Ratios 338 Basel I 339 Basel II 341 Enterprise Risk Management (ERM) and Economic Capital 343 Conclusion 345 Notes 346 References 347 About the Author 349 20 Legal Risk Post-SOX and the Subprime Fiasco: Back to the Drawing Board 351 Introduction 351 The Legal Framework of Legal and Reputational Risk Management 352 The Federal Rules of Professional Responsibility for Attorneys 355 Whistle-Blower Protection Under Sox 357 Audit Reform 358 Codes of Conduct 358 An Assessment of the SOX Framework on Legal and Reputational Risk 359 The Subprime Fiasco 360 The SOX Shortcomings 362 Toward Optimal Reputational and Legal Risk Management 363 Conclusion 365 Note 365 References 365 About the Author 367 21 Financial Reporting and Disclosure Risk Management 369 The Importance of Disclosure Management and ERM 369 Foundations in the United States 370
Page 16
xiv Contents Disclosure and Sarbanes-Oxley 371 New Group for Reporting: Public Company Accounting Oversight Board 371 Important SOX Sections 372 Section 404: Internal Controls and Compliance Management 372 Section 302: Who Is Responsible for Financial Reporting? 372 Other Financial Reporting 375 Accounting for Derivatives—FASB 133 375 Firm Choice for FASB 133 and Disclosure Risk Management 375 Risk Identification, Monitoring, and Reporting 377 Financial Reporting Challenges Today 379 Paring Down Internal Control: Auditing Standard 5 (AS5) 379 Global Financial Crisis and ERM 379 Reexamining Fair Value Accounting: FASB 157 380 Conflicts with International Standards: Rules versus Principles 381 Adding ERM to Company Credit Ratings 383 Conclusion 383 Notes 383 References 384 About the Author 384 PART V Survey Evidence and Academic Research 385 22 Who Reads What Most Often?: A Survey of Enterprise Risk Management Literature Read by Risk Executives 387 Introduction 387 Survey Methodology 389 Survey Results 390 Survey Respondent Profile 390 ERM Tools and Techniques Used by Respondents 392 Most Frequently Read Literature on ERM 396 Critical Areas of Need 399 Key Findings of Our Survey 400 Conclusion 402 Appendix 22.A: Publications Included in the Survey 403 Appendix 22.B: Survey Respondents Who Gave Permission to Be Identified 410 Notes 410 References 412 About the Authors 416 23 Academic Research on Enterprise Risk Management 419 Introduction 419 Academic Research on Enterprise Risk Management 420 Colquitt, Hoyt, and Lee (1999) 425 Kleffner, Lee, and McGannon (2003) 426 Liebenberg and Hoyt (2003) 426
Page 17
CONTENTS xv Beasley, Clune, and Hermanson (2005a) 427 Beasley, Clune, and Hermanson (2005b) 428 Desender (2007) 429 Beasley, Pagach, Warr (2008) 429 Pagach and Warr (2008a) 430 Pagach and Warr (2008b) 431 Gates, Nicolas, and Walker (2009) 431 Case Studies on ERM 432 Harrington, Niehaus, and Risko (2002) 432 Aabo, Fraser, and Simkins (2005) 434 Stroh (2005) 434 Acharyya and Johnson (2006) 435 Nocco and Stulz (2006) 436 Conclusion 436 Notes 437 References 438 About the Authors 439 24 Enterprise Risk Management: Lessons from the Field 441 Introduction 441 Lessons from the ERM Process 442 Clarifying Strategies and Objectives 442 Identifying Risks 443 Assessing Risk 444 Acting on the Risks 448 Monitoring Risks 449 Lessons from Integrating ERM with Ongoing Management Initiatives 449 Strategic Planning and ERM 449 The Balanced Scorecard and ERM 452 Budgeting and ERM 454 Internal Auditing and ERM 454 Business Continuity Planning, Crisis Preparedness, and ERM 455 Corporate Governance and ERM 456 Some Key Value Lessons from ERM 457 Conclusion 459 Notes 459 References 460 Further Reading 461 About the Authors 462 PART VI Special Topics and Case Studies 465 25 Rating Agencies’ Impact on Enterprise Risk Management 467 Introduction 467 Banking: General 468
Page 18
xvi Contents Insurance: S&P 468 Insurance: Moody’s 470 Insurance: Fitch 471 Insurance: A.M. Best 472 U.S. Energy Companies: S&P 473 Nonfinancial Companies: S&P 473 A Fly in the Ointment 476 Conclusion 476 Notes 477 Further Reading 478 About the Author 478 26 Enterprise Risk Management: Current Initiatives and Issues 479 Question 1 482 Question 2 483 Question 3 489 Question 4 491 Question 5 493 Question 6 495 Question 7 497 Question 8 499 Notes 502 27 Establishing ERM Systems in Emerging Countries 505 Introduction 505 Enterprise Risk Management and Its Benefits in Emerging Markets 506 Evolution of Risk Management in Emerging Markets 509 The Rationale for Effective Risk Management in Emerging Markets 515 The Responsibility of the Board in Risk Management and Extensions to Emerging Markets 516 Risk, Reward, and Risk Appetite in Emerging Markets 523 Observations of ERM Practices in Emerging Countries 524 Conclusion 524 Appendix: COSO Approach to Enterprise Risk Management 525 Notes 527 References 528 About the Author 528 28 The Rise and Evolution of the Chief Risk Officer: Enterprise Risk Management at Hydro One 531 Hydro One 533 Getting Started with ERM 533 Corporate Risk Management Group 534 Pilot Study 534 Final Approval 538
Page 19
CONTENTS xvii Processes and Tools 538 The Business Context 538 Identification and Assessment of Risks and Controls 540 Tolerability of Risk—and Risk Mitigation 542 Monitor and Review 543 Corporate Risk Profile 543 Description of Risk Sources 543 Quantifying the Unquantifiable 548 Benefits of ERM and Outcomes at Hydro One 550 Current Status 552 Conclusion 553 Notes 553 About the Authors 556 Index 557
Affichage des 19 premières pages. Téléchargez le document pour le voir en entier.
Commentaires (0)
Aucun commentaire pour le moment. Soyez le premier !