Enterprise risk management : modern approaches to balancing risk and reward

Preface to the Second Edition
Preface to the First Edition
Acknowledgements
Contents
1 Introducing ERM
	Abstract
	1.1	Why ERM Matters
	1.2	Definition of ERM
	1.3	Risk Definition in the ERM Approach
	1.4	ERM Frameworks
	1.5	Challenges to ERM Implementation
	References
2 Countering Biases in Risk Analysis
	Abstract
	2.1	Motivational Biases
		2.1.1	Affect Heuristics
		2.1.2	Attribute Substitution
		2.1.3	Confirmation Bias
		2.1.4	Desirability of Options and Choice
		2.1.5	Optimism
		2.1.6	Transparency Bias
	2.2	Cognitive Biases
		2.2.1	Anchoring Bias
		2.2.2	Availability Bias
		2.2.3	Dissonance Bias
		2.2.4	Zero Risk Bias
		2.2.5	Conjunction Fallacy
		2.2.6	Conservatism Bias
		2.2.7	Endowment and Status Quo Bias
		2.2.8	Framing
		2.2.9	Gambler’s Fallacy
			2.2.9.1 Hindsight Bias
			2.2.9.2 Outcome Bias
			2.2.9.3 Overconfidence
			2.2.9.4 Perceived Risks
			2.2.9.5 Ambiguity Aversion
			2.2.9.6 Dread Risk Bias
			2.2.9.7 Normalcy Bias
	2.3	Group-Specific Biases
		2.3.1	Authority Bias
		2.3.2	Conformity Bias
		2.3.3	Groupthink
		2.3.4	Hidden Profile
		2.3.5	Social Loafing
	References
3 Creating Value Through ERM Process
	Abstract
	3.1	Balance Rationality with Intuition
	3.2	Embrace Uncertainty Governance as Part of ERM
	3.3	Collect Risk Scenarios
		3.3.1	Identify Sources, Events and Impacts of All Risks
		3.3.2	Develop an Effective and Structured Risk Identification Approach
		3.3.3	Identify Risks Enterprise-Wide
		3.3.4	Treat Business and Decision Problems not as True Risks
		3.3.5	Don’t Let Reputation Risk Fool You
		3.3.6	Focus on Management Assumptions
			3.3.6.1 Start with Understanding the Business Strategy and Strategic Risk
			3.3.6.2 Collect All Management Assumptions
			3.3.6.3 Use Strategic Tools to Complement Assumption Analysis
			3.3.6.4 Risk Identification: Mission Accomplished?
		3.3.7	Conduct One-On-One Interviews with Key Stakeholders
			3.3.7.1 Prefer Interviews Over Templates and Surveys
			3.3.7.2 Select and Inform Interviewees Carefully
			3.3.7.3 Elicit Feedback on Major Risks
			3.3.7.4 Focus on Plausible Stories, not on Numbers
		3.3.8	Complement with Traditional Risk Identification
			3.3.8.1 Conduct Risk Workshops Carefully
			3.3.8.2 Consider Process-Based Risk Identification
			3.3.8.3 Use Risk Checklists with Caution
			3.3.8.4 Try Fault Tree Analysis (FTA) for Critical Processes and Systems
			3.3.8.5 Prevent Costly Errors with Failure Mode and Effects Analysis (FMEA)
	3.4	Assess Key Risk Scenarios
		3.4.1	Identify Key Risk Scenarios
			3.4.1.1 Exclude Unrealistic, Devastating Risks
			3.4.1.2 Separate Pure Management Action Items
			3.4.1.3 Avoid Risk Maps as Selection Criterion
			3.4.1.4 Avoid Expected Values as Selection Criterion
			3.4.1.5 Prefer Impact Over Probability
			3.4.1.6 Distinguish Between Key and Non Key Risks
		3.4.2	Quantify Key Risk Scenarios
			3.4.2.1 Why Risk Quantification Matters
			3.4.2.2 Develop Quantitative Key Risk Scenarios
			3.4.2.3 Store Key Risk Scenarios in a Database
		3.4.3	Support Decision-Making
		3.4.4	Differentiate Between Decisions and Outcomes
		3.4.5	Overcome the Regulatory Risk Management Approach
		3.4.6	Overcome the Separation of Risk Analysis and Decision-Making
		3.4.7	Assess Impact on Relevant Objectives
		3.4.8	Avoid Pseudo-Risk Aggregation
		3.4.9	Develop Useful Risk Appetite Statements
		3.4.10	Make Uncertainties Transparent and Comprehensible
		3.4.11	Exploit the Full Decision-Making Potential of ERM
		3.4.12	Align ERM with Business Planning
		3.4.13	Replace Standard Risk Reporting
		3.4.14	Disclose Risks Appropriately
	3.5	Assess and Improve ERM Quality
		3.5.1	Test ERM Effectiveness Appropriately
		3.5.2	Increase ERM Maturity Level
	References
4 Setting up Enterprise Risk Governance
	Abstract
	4.1	Comply with Laws and Check Relevant Governance Codes
	4.2	Consider ERM-Frameworks Thoughtfully
		4.2.1	Motivation for Risk Management Standards
		4.2.2	ISO 31000
		4.2.3	COSO ERM
		4.2.4	Similarities and Differences
		4.2.5	Limitations of ERM Frameworks
	4.3	Develop a Sound Risk Policy
		4.3.1	Risk Policy and Corporate Strategy
		4.3.2	Risk Policy as the Basis for Dealing with Risks
		4.3.3	Limitations of Risk Policies
	4.4	Enhance Risk Culture
		4.4.1	Relate Risk Culture to Corporate Culture
		4.4.2	Understand How Risk Culture Evolves
		4.4.3	Increase Risk Culture Maturity Level
	4.5	Organise ERM Properly
		4.5.1	Does a Best-Practice ERM Organisation Exist?
		4.5.2	ERM Organisation Options
		4.5.3	Some Thoughts on Roles and Responsibilities
	References
5 Looking at Trends in ERM
	Abstract
	5.1	Emerging Digital Risks
		5.1.1	Impact of Disruptive Technologies
		5.1.2	Digital Risk Framework
	5.2	Digitization of ERM
	5.3	Using Multiple Sources of Data
	5.4	Increasing Demand for Analytic Skill Sets
	5.5	Increasingly Sophisticated Software Tools
	5.6	Networked Economy and Collective ERM
	5.7	Improving ERM Skills
	References