Basics of Risk Management – Step 4:  Close the Learning Loop to Optimize Your ERM Performance 

March 2012 Feature Article

By Diana Del Bel Belluz, M.A.Sc., P. Eng.

In this fourth article on the basics of risk management, I'll share tips on how to effectively navigate the ERM implementation journey.

This 4-part series of articles introduces the Risk Wise ERM Implementation and Organizational Learning Cycle and its four essential steps for bringing ERM to life in any organization:

1. 1. Define the context and criteria for enterprise risk management (ERM)
   2. Assess risks and its implications for performance and stakeholder value
   3. Integrate ERM into business practices
   4. Close the learning loop to fine-tune & optimize ERM

Seasoned ERM leaders will freely admit that establishing the culture of ERM is a journey not a project. Optimal risk management performance isn't achieved by merely introducing ERM tools and techniques. It requires the sustained cultivation of systematic and proactive risk management behaviour.

Indeed, the ERM journey is an exercise in culture change and organizational learning.

Yet many executives charge off on their ERM journey without giving much thought to where they are headed or what is the best path to ERM success. Without an ERM development roadmap, it's no wonder that so many ERM programs fail to gain traction, stall, or are abandoned altogether.

 "Experience is inevitable. Learning is not."
- Paul J. H. Shoemaker 

Successful ERM implementation requires both:

• an organizational learning framework (e.g., Risk Wise ERM Implementation and Organizational Learning Cycle) to benchmark ERM progress, and 
• an ERM roadmap to guide the way forward and continually develop the organization's ERM capabilities.

In the fourth step of the cycle, the ERM program is fine-tuned based on a thorough evaluation of the organization's ERM effectiveness, its successes and its shortcomings. To close the learning loop, the leadership team applies the insights gained from the evaluation by updating the ERM roadmap.

Have you defined your ERM roadmap? Whether you have an established ERM program or are just starting out, you need a roadmap to guide your organization on its unique ERM development journey.

Here are 3 tips for charting your ERM roadmap.

Tip #1. Begin with the End in Mind

As with any journey, knowing the desired destination is crucial for making decisions about what capabilities you need to get there. Do you need a bicycle, a canoe or a rocket ship to take you where you want to go?

To define your ERM vision you need to decide:

• The desired level of performance that your ERM program must produce. This means articulating what value a successful ERM program will deliver and how you will measure its performance. This becomes 'true north' on your ERM maturity 'compass' (see tip #2).
• The level of ERM capabilities that will enable your organization to meet its ERM performance goals. This means defining three kinds of ERM capital required to advance the organization's unique corporate mission:

*  STRUCTURAL capital (i.e., ERM framework, processes, and tools)  

*  HUMAN capital (i.e., your people's ERM knowledge, skills and culture), and   

*  RISK INTELLIGENCE capital (i.e., how leaders drive the ERM information flows and behaviours that optimize organizational results).

It is a mistake to blindly follow risk management "best" practices because you may end up pursuing a program that is too simple or too sophisticated for your particular needs and unique ERM vision. At Risk Wise we have facilitated many executive teams to develop their organization's ERM vision in as little as 30 minutes.

ASK YOURSELF: What benefit should the ERM program deliver to the organization? What problem will this ERM initiative solve? How should ERM benefit decision-makers? What capabilities will it take to deliver our ERM vision?

Tip #2. Check Your Compass

To properly design any initiative to enhance ERM performance, a solid assessment of the organization's current ERM capabilities and performance is required.

"Prescription without diagnosis is malpractice,
whether it be in medicine or management." 

- Karl Albrecht 

Many ERM maturity models exist. However, we developed the Risk Wise ERM Maturity model because in our review of over a dozen of the most popular risk management maturity models, we found they focused almost exclusively on the components of the ERM program and contained very little on the key capabilities required to actually implement ERM.

This gap between the design of the risk framework and the capabilities required to implement it is analogous to having a beautifully designed automobile but no driver with the skills to handle the car or to navigate the route to arrive at the destination.

The three types of ERM capabilities (STRUCTURAL, HUMAN, and RISK INTELLIGENCE) support each other like the three legs of a stool. If any one is omitted, the integrity and effectiveness of the ERM program will be compromised. Risk Wise can benchmark your ERM performance and teach you how to conduct an ERM maturity assessment in as little as 2 hours by using our proven ERM Capabilities Assessment Instrument.  

ASK YOURSELF: Is our current ERM performance adequate on these three levels: 

• Operational. Is there adequate progress against plans to manage priority enterprise risks? How effective are our current management strategies in aligning risk exposures with risk appetite / tolerance?
• Strategic. How well do our ERM priorities and strategies align with our current business priorities?
• Systemic. How well do our ERM capabilities meet the organization's needs and anticipate future needs?  

Tip #3. Be Opportunistic

When executives review the results of the assessment of their current ERM performance and capabilities and compare it their ERM vision, they can quickly identify the gaps in their ERM program. It can be tempting to try to bridge all the ERM gaps immediately and simultaneously.

It is wiser to develop a multi-staged route that is achievable given your available ERM resources and the totality of your organization's other priorities and commitments. It gives your people a chance to absorb new approaches and expectations for ERM behaviour. At the end of each phase, you can review your progress and 'recalculate' your route based on the lessons learned. 

At Risk Wise, we offer an ERM Roadmap and Planning Workshop to help our clients chart their unique step-by-step path to methodically build their ERM capacity and maturity. Through structured discussions, we facilitate the senior team to define key long-term milestones and a short-term action plan for ERM implementation.

ASK YOURSELF: Does our ERM development plan strike a balance between strategies to:

1. 1. strengthen our ERM processes and structures,
   2. develop our people's ERM competencies through training and on-the-job experience,  
   3. cultivate an ERM mindset, and  
   4. optimize the flow of risk information?

The Risk Wise bottom line…

Implementing ERM is an exercise in organizational change. An ERM roadmap is an essential tool to keep your organization moving toward ERM maturity. You need to embrace the discipline of learning to continually improve your ERM systems, practices, culture, and performance.

*

To avoid taking a wrong turn on your ERM journey and wasting your effort, time and money, contact: Diana.Belluz @ riskwise.ca  or by telephone at (416) 214.7598.

Follow the links to:

• Read this month's Bonus Resource - A Handbook of Risk Management
• Download a printable version of the entire March 2012 issue of the Risk Management Made Simple Advisory.
  
• View the Article Index to access back issues of the Risk Management Made Simple Advisory.