Guidance Paper - The Institute of Risk Management

More documents

Recommendations

Info

An example of a valuation model: shareholder value The underlying shareholder value model we have adopted is shown below. The model is based on the hypothesis that shareholder value is calculated as the cashflow from operations, discounted by the weighted average cost of capital, less the value of debt. Shareholder Value Sales Growth Cashflow from Operations Operational Issues Operating Margin Cash Tax Rate Investment Issues CAPEX Working Capital Competitve Advantage Period Discounted Rate Cost of Debt Debt Figure 9 - Shareholder Value Model (1) Our proposition is that risks, which are normally associated in most ERM programmes to objectives, need also to be linked to the underlying shareholder value drivers, although in practice, most risks will impact on several drivers, as follows: Shareholder Value Risks Risks Shareholder Value Sales Growth Cashflow from Operations Operational Issues Operating Margin Cash Tax Rate Investment Issues CAPEX Working Capital Competitve Advantage Period Discounted Rate Cost of Debt Debt Risks Risks Risks Risks Risks Sales Growth Cashflow from Operations Operational Issues Operating Margin Cash Tax Rate Investment Issues CAPEX Working Capital Competitve Advantage Period Discounted Rate Cost of Debt Debt Risks Figure 10 - Shareholder Value Model (2) Figure 11 - Shareholder Value Model (3) We think that testing risks against models such as these will enable organisations to have a much better understanding of which risks are important at a much earlier stage. 28
Strategic 319 At a strategic level we are suggesting that a variety of high level models might be used including: • Shareholder value for private sector organisations. See the box above for more information on one possible approach. (Black, Wright and Bachman, 2000) • Stakeholder value might be a more appropriate measure for not-for-profit organisations • Economic Value Added (“EVA”) has been commonly used in many organisations. The important issue here is not 320 so much the precise model that is selected, but rather that it is appropriate for the nature of the organisation. One of the key attributes of using models such as these is that there is a focus on translating strategy to the underlying value drivers and, of paramount importance, a need to identify key assumptions and therefore key risks. Such models may be more 321 sophisticated than is necessary for less mature organisations and it is clearly not appropriate to implement a shareholder value approach in the context of the public sector or some third sector organisations. We acknowledge that additional work is still required to identify other models that would be equally valid in the public sector but we do not think that this represents a significant shortcoming in the proposed framework. Tactical and operational 322 We recommend that organisations should develop a series of risk metrics and control metrics to measure tactical and operational risks and controls. The concept of risk and control metrics is widely referred to in risk management literature, normally as KRI’s and KCI’s, although implementation is at best patchy. There are many practical approaches to identifying key indicators. However, in implementing them, management should ensure that they are readily understood and are drawn from appropriate information systems and reliable data-sources which are subject to proper governance procedures. For organisations that already use KPI’s as part of their balanced scorecard management reporting information, both risk and control indicators should be relatively easy to implement. Data 323 The approach to risk appetite has to become a data-driven exercise. Much of what currently passes for risk management is often a data-free or at best data-lite zone. Organisations that manage risk in this way will not be able to manage according to a pre-determined risk appetite. Accordingly we recommend that organisations should identify the relevant sources of data that will be required and ensure that there are appropriate levels of governance over those data sources to ensure that they are sufficiently robust to form the basis of a decision-influencing and report generating management tool All forms of measurement 324 need to be tailored and appropriate to the environment within which they are being used. It is not our intention to recommend undue levels of complexity. However, as part of the regular reporting of risk appetite to senior management and boards, we believe that organisations need to develop the same level of rigour in reporting this information as they do in reporting periodic management accounts, including appropriate governance over the data and information systems employed. Constructing a risk appetite - questions for the boardroom • What are the business, regulatory or other factors that will influence the relative importance of the organisation’s propensity to take risk and its propensity to exercise control at strategic, tactical and operational levels • Does the organisation employ helpful risk taxonomies that facilitate the identification and responsibility for managing risk as well as providing insight on how to manage risks • Does the organisation understand clearly why and how it engages with risks • Is the organisation addressing all relevant risks or only those that can be captured in risk management processes • Does the organisation have a framework for responding to risks • What approach has the organisation taken to measuring and quantifying risks 29
Page 1 and 2: Risk Appetite & Tolerance Guidance
Page 3 and 4: The Chartered Institute of Internal
Page 5 and 6: In writing this paper, we are consc
Page 7 and 8: Executive Summary Principles and ap
Page 9 and 10: Putting it into practice We have so
Page 11 and 12: I Background “What is this all ab
Page 13 and 14: The original BS31100 109 contained
Page 15 and 16: A word of caution 122 The word “a
Page 17 and 18: 203 This framework has several key
Page 19 and 20: Risk Management Maturity 206 Risk m
Page 21 and 22: Multiple risk appetites 209 We beli
Page 23 and 24: III Constructing a risk appetite
Page 25 and 26: Tactical 308 Many organisations str
Page 27: Control Issues Irrespective of risk
Page 31 and 32: Sketch 403 Risk appetite should be
Page 33 and 34: V Governing a risk appetite “Maki
Page 35 and 36: VI The journey is not over 601 It i
Page 37 and 38: Appendix A: Determining the risks t
Page 39 and 40: Appendix B: List of respondents to
Page 42: Crowe Horwath Global Risk Consultin

Guidance Paper - The Institute of Risk Management

Create successful ePaper yourself

Delete template?

Save as template?