4 The components of a company-wide ERM framework
An ERM framework covers the whole organisation. It includes: process, tools, governance, measures and people, all underpinned by an appropriate culture. Take a look at the elements of an ERM framework.
First take a look at Video 4 and hear what the experts say should be in a risk management framework.
Download this video clip.Video player: Video 4 What would be in a risk management framework?
Transcript: Video 4 What would be in a risk management framework?
SPEAKER 1
So I think a risk management framework should include a policy, so how we're going to do things, the tools and training, people in place, and a governance structure as well so that we can monitor how we're doing against our policy.
SPEAKER 2
It needs to tell me very clearly what am I supposed to do, who is supposed to do it, strictly speaking. It needs to give advice on where does risks need to be communicated to in order to be addressed in the most effective way. And last but not least, it needs to give me a clear indication of how much risk is this company prepared to take in order to get a reward, not for the sake of it.
SPEAKER 3
I would expect, in a risk management framework, people who understand the key concepts around risk. They're comfortable in applying those. They're comfortable in raising risks, or shining a light on risk so that people are aware of them. I would expect there to be a degree of rigour in terms of how people are recording things as well because it's important for people to be able to look at, for example, key sets of data around risk to maybe backup or provide evidence to a case that they're making. So yeah, a timely awareness and raising of those particular risks, I think, is fundamental.
Video 4 What would be in a risk management framework?
Interactive feature not available in single page view (see it in standard view).
Now have a look at Video 5, which covers an Enterprise Risk Management framework.
Download this video clip.Video player: Video 5 An Enterprise Risk Management framework
Transcript: Video 5 An Enterprise Risk Management framework
INSTRUCTOR
So in risk management framework needs to include all the things that are necessary for good risk management to take place. So really, importantly, there needs to be the right people involved. And those people need to have the right behaviours to encourage the right risk management conversations.
They need to be very good at helping to join different people together so that we can get that combined knowledge through the company. And we've got the best chance of putting the right things in place to be successful in that company. So that's the people aspect of it. We need a very clear and as-simple-as-possible process that is consistent wherever in the company you happen to be and recognised and understood. And alongside that, you need the right training as well. And this is hopefully what this kind of training will help people to understand about what is risk management, why is it important, how can you help good risk management take place?
We also need to make sure we've got the right tools that help us to do risk management. Now that's all about either consistent templates. So we're capturing the right kind of information. And we can learn from previous conversations about risk.
And we can make sure all the right elements of the process are happening. And it's also about having maybe the right software solution in place, which helps to make sure that the risk management activity that's happening is really adding value. And we try to remove any of the non-value added activities so that we can make risk management as lean and effective as possible.
We need the reporting framework, which means that the right people get to know about the risks so that the right things can be put in place. And really, importantly, we need the right culture of the organisation surrounding that framework to make sure that we can surface any risks that are there and put specific timely actions in place.
Video 5 An Enterprise Risk Management framework
Interactive feature not available in single page view (see it in standard view).
Before moving on to the next section you should recognise there is no ‘one right way’ to do risk management and most of the standard guides and codes refer to the need to ‘customise’ the approach to fit each organisation. The example given in the next two sections relates to practice used in Rolls-Royce, but these will not necessarily work in whole or even in part in other organisations.