Implementing Enterprise Risk Management

A practical, real-world guide for implementing enterprise risk management (ERM) programs into your organization

Enterprise risk management (ERM) is a complex yet critical issue that all companies must deal with in the twenty-first century. Failure to properly manage risk continues to plague corporations around the world. ERM empowers risk professionals to balance risks with rewards and balance people with processes.

But to master the numerous aspects of enterprise risk management, you must integrate it into the culture and operations of the business. No one knows this better than risk management expert James Lam, and now, with Implementing Enterprise Risk Management: From Methods to Applications, he distills more than thirty years' worth of experience in the field to give risk professionals a clear understanding of how to implement an enterprise risk management program for every business.

• Offers valuable insights on solving real-world business problems using ERM

• Effectively addresses how to develop specific ERM tools

• Contains a significant number of case studies to help with practical implementation of an ERM program

While Enterprise Risk Management: From Incentives to Controls, Second Edition focuses on the "what" of ERM, Implementing Enterprise Risk Management: From Methods to Applications will help you focus on the "how." Together, these two resources can help you meet the enterprise-wide risk management challenge head on--and succeed.

Auteur

JAMES LAM is president of James Lam & Associates, a risk management consulting firm. He serves on the board of directors of ETRADE Financial and chairs the Risk Oversight Committee. An NACD Board Leadership Fellow, he is author of the bestselling risk management title, *Enterprise Risk Management.

Contenu
Preface xiii

Acknowledgments xix

Part One ERM in Context

Chapter 1 Fundamental Concepts and Current State 3

Introduction 3

What Is Risk? 4

What Does Risk Look Like? 8

Enterprise Risk Management (ERM) 11

The Case for ERM 13

Where ERM Is Now 18

Where ERM Is Headed 19

Notes 20

Chapter 2 Key Trends and Developments 21

Introduction 21

Lessons Learned from the Financial Crisis 21

The Wheel of Misfortune Revisited 26

Global Adoption 34

Notes 37

Chapter 3 Performance-Based Continuous ERM 41

Introduction 41

Phase Three: Creating Shareholder Value 43

Performance-Based Continuous ERM 44

Case Study: Legacy Technology 56

Notes 59

Chapter 4 Stakeholder Requirements 61

Introduction 61

Stakeholders Defined 62

Managing Stakeholder Value with ERM 79

Implementing a Stakeholder Management Program 80

Appendix A: Reputational Risk Policy 83

Notes 87

Part Two Implementing an ERM Program

Chapter 5 The ERM Project 93

Introduction 93

Barriers to Change 93

Establish the Vision 95

Obtain Buy-In from Internal Stakeholders 97

Assess Current Capabilities against Best Practices 100

Develop a Roadmap 104

Appendix A: ERM Maturity Model 108

Appendix B: Practical Plan for ERM Program Implementation 111

Chapter 6 Risk Culture 115

Introduction 115

Risk Culture Success Factors 117

Best Practice: Risk Escalation 130

Conclusion 130

Notes 131

Chapter 7 The ERM Framework 132

Introduction 132

The Need for an ERM Framework 132

ERM Framework Criteria 136

Current ERM Frameworks 138

An Update: The Continuous ERM Model 145

Developing a Framework 150

Conclusion 153

Notes 153

Part Three Governance Structure and Policies

Chapter 8 The Three Lines of Defense 157

Introduction 157

COSO's Three Lines of Defense 158

Problems with This Structure 160

The Three Lines of Defense Revisited 164

Bringing It All Together: How the Three Lines Work in Concert 172

Conclusion 173

Notes 173

Chapter 9 Role of the Board 175

Introduction 175

Regulatory Requirements 176

Current Board Practices 179

Case Study: Satyam 180

Three Levers for ERM Oversight 181

Conclusion 189

Notes 189

Chapter 10 The View from the Risk Chair 191

Introduction 191

Turnaround Story 191

The GPA Model in Action 192

Top Priorities for the Risk Oversight Committee 192

Conclusion 196

Notes 197

Chapter 11 Rise of the CRO 198

Introduction 198

History and Rise of the CRO 199

A CRO's Career Path 201

The CRO's Role 202

Hiring a CRO 206

A CRO's Progress 208

Chief Risk Officer Profiles 212

Notes 225

Chapter 12 Risk Appetite Statement 227

Introduction 227

Requirements of a Risk Appetite Statement 228

Developing a Risk Appetite Statement 233

Roles and Responsibilities 239

Monitoring and Reporting 242

Examples of Risk Appetite Statements and Metrics 246

Notes 250

Part Four Risk Assessment and Quantification

Chapter 13 Risk Control Self-Assessments 255 <p...