14 Sep The reading this week (2017- COSO.pdf) discusses strategy and how ERM can be integrated with an organization
The reading this week (2017- COSO.pdf) discusses strategy and how ERM can be integrated with an organization’s overall strategy. Prepare a research paper on some of the various issues, protocols, methods, frameworks you found and discuss how – if possible – organizations can use ERM as strategy. It is perfectly acceptable if you deem ERM cannot be used as strategy, just back up your claim with scholarly research and justifications.
Your paper should meet these requirements:
- Be approximately four to six pages in length, not including the required cover page and reference page.
- Follow APA 7 guidelines. Your paper should include an introduction, a body with fully developed content, and a conclusion.
- Support your answers with the readings from the course and at least two scholarly journal articles to support your positions, claims, and observations, in addition to your textbook.
- Be clearly and well-written, concise, and logical, using excellent grammar and style techniques. You are being graded in part on the quality of your writing.
Enterprise Risk Management Integrating with Strategy and Performance
Executive Summary
C o m m i t te e o f S p o n s o r i n g O r g a n i z a t i o n s o f t h e Tr e a d w a y C o m m i s s i o n
June 2017
This project was commissioned by the Committee of Sponsoring Organizations of the Treadway Commission (COSO), which is dedicated to providing thought leadership through the development of comprehensive frameworks and guidance on internal control, enterprise risk management, and fraud deterrence designed to improve organi- zational performance and oversight and to reduce the extent of fraud in organizations. COSO is a private sector initiative, jointly sponsored and funded by:
• American Accounting Association
• American Institute of Certified Public Accountants
• Financial Executives International
• Institute of Management Accountants
• The Institute of Internal Auditors
©2017 All Rights Reserved. No part of this publication may be reproduced, redistributed, transmitted, or displayed in any form or by any means without written permission of COSO. P254469-01 0516
Executive Summary
Foreword In keeping with its overall mission, the COSO Board commissioned and published in 2004 Enterprise Risk Management—Integrated Framework. Over the past decade, that publication has gained broad acceptance by organizations in their efforts to manage risk. However, also through that period, the complexity of risk has changed, new risks have emerged, and both boards and executives have enhanced their awareness and oversight of enterprise risk management while asking for improved risk reporting. This update to the 2004 publication addresses the evolution of enterprise risk management and the need for organizations to improve their approach to managing risk to meet the demands of an evolving business environment.
The updated document, now titled Enterprise Risk Management—Integrating with Strategy and Performance, highlights the importance of considering risk in both the strategy-setting process and in driving performance. The first part of the updated publication offers a perspective on current and evolving concepts and applications of enterprise risk management. The second part, the Framework, is organized into five easy-to-understand components that accommodate different viewpoints and operating structures, and enhance strategies and decision-making. In short, this update:
• Provides greater insight into the value of enterprise risk management when setting and carrying out strategy.
• Enhances alignment between performance and enterprise risk management to improve the setting of performance targets and understanding the impact of risk on performance.
• Accommodates expectations for governance and oversight.
• Recognizes the globalization of markets and operations and the need to apply a common, albeit tailored, approach across geographies.
• Presents new ways to view risk to setting and achieving objectives in the context of greater business complexity.
• Expands reporting to address expectations for greater stakeholder transparency.
• Accommodates evolving technologies and the proliferation of data and analytics in sup- porting decision-making.
• Sets out core definitions, components, and principles for all levels of management involved in designing, implementing, and conducting enterprise risk management practices.
Readers may also wish to consult a complementary publication, COSO’s Internal Control— Integrated Framework. The two publications are distinct and have different focuses; neither supersedes the other. However, they do connect. Internal Control—Integrated Framework encompasses internal control, which is referenced in part in this updated publication, and therefore the earlier document remains viable and suitable for designing, implementing, conducting, and assessing internal control, and for consequent reporting.
The COSO Board would like to thank PwC for its significant contributions in developing Enterprise Risk Management—Integrating with Strategy and Performance. Their full consideration of input provided by many stakeholders and their insight were instrumental in ensuring that the strengths of the original publication have been preserved, and that text has been clarified or expanded where it was deemed helpful to do so. The COSO Board and PwC together would also like to thank the Advisory Council and Observers for their contributions in reviewing and providing feedback.
Robert B. Hirth Jr. COSO Chair
Dennis L. Chesley PwC Project Lead Partner and Global and APA Risk and Regulatory Leader
June 2017 iii
Enterprise Risk Management | Integrating with Strategy and Performance
Committee of Sponsoring Organizations of the Treadway Commission
Board Members
Robert B. Hirth Jr. COSO Chair
Richard F. Chambers The Institute of Internal Auditors
Mitchell A. Danaher Financial Executives International
Charles E. Landes American Institute of Certified Public Accountants
Douglas F. Prawitt American Accounting Association
Sandra Richtermeyer Institute of Management Accountants
PwC—Author
Principal Contributors
Miles E.A. Everson Engagement Leader and Global and Asia, Pacific, and Americas (APA) Advisory Leader New York, USA
Dennis L. Chesley Project Lead Partner and Global and APA Risk and Regulatory Leader Washington DC, USA
Frank J. Martens Project Lead Director and Global Risk Framework and Methodology Leader British Columbia, Canada
Matthew Bagin Director Washington DC, USA
Hélène Katz Director New York, USA
Katie T. Sylvis Director Washington DC, USA
Sallie Jo Perraglia Manager New York, USA
Kathleen Crader Zelnik Manager Washington DC, USA
Maria Grimshaw Senior Associate New York, USA
June 2017iv
The Changing Risk Landscape Our understanding of the nature of risk, the art and science of choice, lies at the core of our modern economy. Every choice we make in the pursuit of objectives has its risks. From day-to- day operational decisions to the fundamental trade-offs in the boardroom, dealing with risk in these choices is a part of decision-making.
As we seek to optimize a range of possible outcomes, decisions are rarely binary, with a right and wrong answer. That’s why enterprise risk management may be called both an art and a science. And when risk is considered in the formulation of an organization’s strategy and business objectives, enterprise risk management helps to optimize outcomes.
Our understanding of risk and our practice of enterprise risk management have improved greatly over the past few decades. But the margin for error is shrinking. The World Economic Forum has commented on the “increasing volatility, complexity and ambiguity of the world.”1 That’s a phenomenon we all recognize. Organizations encounter challenges that impact reliability, relevancy, and trust. Stakeholders are more engaged today, seeking greater transparency and accountability for managing the impact of risk while also critically evaluating leadership’s ability to crystalize opportunities. Even success can bring with it additional downside risk—the risk of not being able to fulfill unexpectedly high demand, or maintain expected business momentum, for example.
Organizations need to be more adaptive to change. They need to think strategically about how to manage the increasing volatility, complexity, and ambiguity of the world, particularly at the senior levels in the organization and in the boardroom where the stakes are highest.
Enterprise Risk Management—Integrating with Strategy and Performance provides a Framework for boards and management in entities of all sizes. It builds on the current level of risk management that exists in the normal course of business. Further, it demonstrates how integrating enterprise risk management practices throughout an entity helps to accelerate growth and enhance performance. It also contains principles that can be applied—from strategic decision-making through to performance.
Below, we describe why it makes sense for management and boards to use the enterprise risk management framework,2 what organizations have achieved by applying enterprise risk management, and what further benefits they can realize through its continued use. We conclude with a look into the future.
Management’s Guide to Enterprise Risk Management Management holds overall responsibility for managing risk to the entity, but it is important for management to go further: to enhance the conversation with the board and stakeholders about using enterprise risk management to gain a competitive advantage. That starts by deploying enterprise risk management capabilities as part of selecting and refining a strategy.
Most notably, through this process, management will gain a better understanding of how the explicit consideration of risk may impact the choice of strategy. Enterprise risk management enriches management dialogue by adding perspective to the strengths and weaknesses of a strategy as conditions change, and to how well a strategy fits with the organization’s mission and vision. It allows management to feel more confident that they’ve examined alternative strategies and considered the input of those in their organization who will implement the strategy selected.
………………………………………………………………………………………..
1 The Global Risks Report 2016, 11th edition, World Economic Forum (2016).
2 The Framework uses the term “board of directors” or “board,” which encompasses the governing body, including
board, supervisory board, board of trustees, general partners, or owner.
Executive Summary
June 2017 1
Once strategy is set, enterprise risk management provides an effective way for management to fulfill its role, knowing that the organization is attuned to risks that can impact strategy and is managing them well. Applying enterprise risk management helps to create trust and instill confidence in stakeholders in the current environment, which demands greater scrutiny than ever before about how risk is actively addressing and managing these risks.
The Board’s Guide to Enterprise Risk Management Every board has an oversight role, helping to support the creation of value in an entity and prevent its decline. Traditionally, enterprise risk management has played a strong supporting role at the board level. Now, boards are increasingly expected to provide oversight of enterprise risk management.
The Framework supplies important considerations for boards in defining and addressing their risk oversight responsibilities. These considerations include governance and culture; strategy and objective-setting; performance; information, communications and reporting; and the review and revision of practices to enhance entity performance.
The board’s risk oversight role may include, but is not limited to:
• Reviewing, challenging, and concurring with management on:
– Proposed strategy and risk appetite.
– Alignment of strategy and business objectives with the entity’s stated mission, vision, and core values
– Significant business decisions including mergers acquisitions, capital allocations, funding, and dividend-related decisions
– Response to significant fluctuations in entity performance or the portfolio view of risk.
– Responses to instances of deviation from core values.
• Approving management incentives and remuneration.
• Participating in investor and stakeholder relations.
Over the longer term, enterprise risk management can also enhance enterprise resilience—the ability to anticipate and respond to change. It helps organizations identify factors that represent not just risk, but change, and how that change could impact performance and necessitate a shift in strategy. By seeing change more clearly, an organization can fashion its own plan; for example, should it defensively pull back or invest in a new business? Enterprise risk management provides the right framework for boards to assess risk and embrace a mindset of resilience.
What Enterprise Risk Management Has Achieved COSO published Enterprise Risk Management—Integrated Framework in 2004. The purpose of that publication was to help entities better protect and enhance stakeholder value. Its underlying philosophy was that “value is maximized when management sets strategy and objectives to strike an optimal balance between growth and return goals and related risks, and efficiently and effectively deploys resources in pursuit of the entity’s objectives.”3
Questions for management
Can all of management—not just the chief risk officer—articulate how risk is considered in the selection of strategy or business decisions? Can they clearly articulate the entity’s risk appetite and how it might influence a specific decision? The resulting con- versation may shed light on what the mindset for risk taking is really like in the organization.
Boards can also ask senior man- agement to talk not only about risk processes but also about culture. How does the culture enable or inhibit responsible risk taking? What lens does management use to monitor the risk culture, and how has that changed? As things change—and things will change whether or not they’re on the entity’s radar—how can the board be confident of an appropriate and timely response from management?
………………………………………………………………………………………..
3 Enterprise Risk Management—Integrated Framework, Executive Summary, COSO (2004).
Enterprise Risk Management | Integrating with Strategy and Performance
June 20172
Since its publication, the Framework has been used successfully around the world, across industries, and in organizations of all types and sizes to identify risks, manage those risks within a defined risk appetite, and support the achievement of objectives. Yet, while many have applied the Framework in practice, it has the potential to be used more extensively. It would benefit from examining certain aspects with more depth and clarity, and by providing greater insight into the links between strategy, risk, and performance. In response, therefore, the updated Framework in this publication:
• More clearly connects enterprise risk management with a multitude of stakeholder expectations.
• Positions risk in the context of an organization’s performance, rather than as the subject of an isolated exercise.
• Enables organizations to better anticipate risk so they can get ahead of it, with an understanding that change creates opportunities, not simply the potential for crises.
This update also answers the call for a stronger emphasis on how enterprise risk management informs strategy and its performance.
Benefits of Effective Enterprise Risk Management All organizations need to set strategy and periodically adjust it, always staying aware of both ever-changing opportunities for creating value and the challenges that will occur in pursuit of that value. To do that, they need the best possible framework for optimizing strategy and performance.
That’s where enterprise risk management comes into play. Organizations that integrate enterprise risk management throughout the entity can realize many benefits, including, though not limited to:
• Increasing the range of opportunities: By considering all possibilities—both positive and negative aspects of risk— management can identify new opportunities and unique challenges associated with current opportunities.
• Identifying and managing risk entity-wide: Every entity faces myriad risks that can affect many parts of the organization. Sometimes a risk can originate in one part of the entity but impact a different part. Consequently, management iden- tifies and manages these entity-wide risks to sustain and improve performance.
• Increasing positive outcomes and advantage while reduc- ing negative surprises: Enterprise risk management allows entities to improve their ability to identify risks and establish appropriate responses, reducing surprises and related costs or losses, while profiting from advantageous developments.
Clearing up a few misconceptions
We’ve heard a few misconceptions about the original Framework since it was introduced in 2004. To set the record straight:
Enterprise risk management is not a function or department. It is the culture, capabilities, and practices that organizations integrate with strate- gy-setting and apply when they carry out that strategy, with a purpose of managing risk in creating, preserving, and realizing value.
Enterprise risk management is more than a risk listing. It requires more than taking an inventory of all the risks within the organization. It is broader and includes practices that management puts in place to actively manage risk.
Enterprise risk management addresses more than internal control. It also addresses other topics such as strategy-setting, governance, commu- nicating with stakeholders, and measur- ing performance. Its principles apply at all levels of the organization and across all functions.
Enterprise risk management is not a checklist. It is a set of principles on which processes can be built or inte- grated for a particular organization, and it is a system of monitoring, learning, and improving performance.
Enterprise risk management can be used by organizations of any size. If an organization has a mission, a strategy, and objectives—and the need to make decisions that fully consider risk—then enterprise risk management can be applied. It can and should be used by all kinds of organizations, from small businesses to community-based social enterprises to government agencies to Fortune 500 companies.
Executive Summary
June 2017 3
• Reducing performance variability: For some, the challenge is less with surprises and losses and more with variability in performance. Performing ahead of sched- ule or beyond expectations may cause as much concern as performing short of scheduling and expectations. Enterprise risk management allows organizations to anticipate the risks that would affect performance and enable them to put in place the actions needed to minimize disruption and maximize opportunity.
• Improving resource deployment: Every risk could be considered a request for resources. Obtaining robust information on risk allows management, in the face of finite resources, to assess overall resource needs, prioritize resource deploy- ment and enhance resource allocation.
• Enhancing enterprise resilience: An entity’s medium- and long-term viability depends on its ability to anticipate and respond to change, not only to survive but also to evolve and thrive. This is, in part, enabled by effective enterprise risk management. It becomes increasingly important as the pace of change acceler- ates and business complexity increases.
These benefits highlight the fact that risk should not be viewed solely as a potential constraint or challenge to setting and carrying out a strategy. Rather, the change that underlies risk and the organizational responses to risk give rise to strategic opportunities and key differentiating capabilities.
The Role of Risk in Strategy Selection Strategy selection is about making choices and accepting trade-offs. So it makes sense to apply enterprise risk management to strategy as that is the best approach for untangling the art and science of making well-informed choices.
Risk is a consideration in many strategy-setting processes. But risk is often evaluated primarily in relation to its potential effect on an already-determined strategy. In other words, the discussions focus on risks to the existing strategy: We have a strategy in place, what could affect the relevance and viability of our strategy?
But there are other questions to ask about strategy, which organizations are getting better at asking: Have we modeled customer demand accurately? Will our supply chain deliver on time and on budget? Will new competitors emerge? Is our technology infrastructure up to the task? These are the kinds of questions that executives grapple with every day, and responding to them is fundamental to carrying out a strategy.
However, the risk to the chosen strategy is only one aspect to consider. As this Framework emphasizes, there are two additional aspects to enterprise risk management that can have far greater effect on an entity’s value: the possibility of the strategy not aligning, and the implications from the strategy chosen.
The first of these, the possibility of the strategy not aligning with an organization’s mission, vision, and core values, is central to decisions that underlie strategy selection. Every entity has a mission, vision, and core values that define what it is trying to achieve and how it wants to conduct business. Some organizations are skeptical about truly embracing their corporate credos. But mission, vision, and core values have been demonstrated to matter—and they matter most when it comes to managing risk and remaining resilient during periods of change.
Enterprise Risk Management | Integrating with Strategy and Performance
June 20174
A chosen strategy must support the organization’s mission and vision. A misaligned strategy increases the possibility that the organization may not realize its mission and vision, or may compromise its values, even if a strategy is successfully carried out. Therefore, enterprise risk management considers the possibility of strategy not aligning with the mission and vision of the organization.
The other additional aspect is the implications from the strategy chosen. When management develops a strategy and works through alternatives with the board, they make decisions on the trade-offs inherent in the strategy. Each alternative strategy has its own risk profile—these are the implications arising from the strategy. The board of directors and management need to determine if the strategy works in tandem with the organization’s risk appetite, and how it will help drive the organization to set objectives and ultimately allocate resources efficiently.
Here’s what’s important: Enterprise risk management is as much about understanding the implications from the strategy and the possibility of strategy not aligning as it is about managing risks to set objectives. The figure below illustrates these considerations in the context of mission, vision, core values, and as a driver of an entity’s overall direction and performance.
Enterprise risk management, as it has typically been practiced, has helped many organizations identify, assess, and manage risks to the strategy. But the most significant causes of value destruction are embedded in the possibility of the strategy not supporting the entity’s mission and vision, and the implications from the strategy.
Enterprise risk management enhances strategy selection. Choosing a strategy calls for structured decision-making that analyzes risk and aligns resources with the mission and vision of the organization.
P os
si bi
lit y
of s
tra te
gy no
t a lign
ing Implications from the strategy chosen
Risk to strate gy & p er for
m a nc
e
STRATEGY, BUSINESS
OBJECTIVES, & PERFORMANCE
MISSION, VISION & CORE VALUES
ENHANCED PERFORMANCE
Executive Summary
June 2017 5
A Focused Framework Enterprise Risk Management—Integrating with Strategy and Performance clarifies the importance of enterprise risk management in strategic planning and embedding it throughout an organization—because risk influences and aligns strategy and performance across all departments and functions.
The Framework itself is a set of principles organized into five interrelated components:
1. Governance and Culture: Governance sets the organization’s tone, reinforcing the importance of, and establishing oversight responsibilities for, enterprise risk manage- ment. Culture pertains to ethical values, desired behaviors, and understanding of risk in the entity.
2. Strategy and Objective-Setting: Enterprise risk management, strategy, and objective-setting work together in the strategic-planning process. A risk appetite is established and aligned with strategy; business objectives put strategy into practice while serving as a basis for identifying, assessing, and responding to risk.
3. Performance: Risks that may impact the achievement of strategy and business objectives need to be identified and assessed. Risks are prioritized by severity in the context of risk appetite. The organization then selects risk responses and takes a portfolio view of the amount of risk it has assumed. The results of this process are reported to key risk stakeholders.
4. Review and Revision: By reviewing entity performance, an organization can con- sider how well the enterprise risk management components are functioning over time and in light of substantial changes, and what revisions are needed.
5. Information, Communication, and Reporting: Enterprise risk management requires a continual process of obtaining and sharing necessary information, from both internal and external sources, which flows up, down, and across the organization.
ENHANCED VALUE
MISSION,VISION, & CORE VALUES
BUSINESS OBJECTIVE
FORMULATION
STRATEGY DEVELOPMENT
IMPLEMENTATION & PERFORMANCE
ENTERPRISE RISK MANAGEMENT
Review & Revision
Information, Communication, & Reporting
PerformanceStrategy & Objective-Setting
Governance & Culture
Enterprise Risk Management | Integrating with Strategy and Performance
June 20176
The five components in the updated Framework are supported by a set of principles.4 These princi- ples cover everything from governance to monitoring. They’re manageable in size, and they describe practices that can be applied in different ways for different organizations regardless of size, type, or sector. Adhering to these principles can provide management and the board with a reasonable expectation that the organization understands and strives to manage the risks associated with its strategy and business objectives.
Looking into the Future There is no doubt that organizations will continue to face a future full of volatility, complexity, and ambiguity. Enterprise risk management will be an important part of how an organization manages and prospers through these times. Regardless of the type and size of an entity, strategies need to stay true to their mission. And all entities need to exhibit traits that drive an effective response to change, including agile decision-making, the ability to respond in a cohesive manner, and the adaptive capacity to pivot and reposition while maintaining high levels of trust among stakeholders.
As we look into the future, there are several trends that will have an effect on enterprise risk management. Just four of these are:
• Dealing with the proliferation of data: As more and more data becomes available and the speed at which new data can be analyzed increases, enterprise risk management will need to adapt. The data will come from both inside and outside the entity, and it will be structured in new ways. Advanced analytics and data visualization tools will evolve and be very helpful in understanding risk and its impact—both positive and negative.
• Leveraging artificial intelligence and automation: Many people feel that we have entered the era of automated processes and artificial intelligence. Regardless of individual beliefs, it is important for enterprise risk management practices to consider the impact of these and future technologies, and leverage their capabilities. Previously unrecognizable relationships, trends and patterns can be uncovered, providing a rich source of information critical to managing risk.
• Managing the cost of risk management: A frequent concern expressed by many business executives is the cost of risk management, compliance processes, and control activities in comparison to the value gained. As enterprise risk management practices evolve, it will become important that activities spanning risk, compliance, control, and even governance be efficiently coordinated to provide maximum benefit to the organization. This may represent one of the best opportunities for enterprise risk management to redefine its importance to the organization.
…………………………………………………………………………………………
4 A fuller description of these twenty principles is provided at the end of this document.
Review & Revision
Information, Communication, & Reporting
PerformanceStrategy & Objective-Setting
Governance & Culture
1. Exercises Board Risk Oversight
2. Establishes Operating Structures
3. Defines Desired Culture
4. Demonstrates Commitment to Core Values
5. Attracts, Develops, and Retains Capable Individuals
6. Analyzes Business …
,
Integration of ERM with Strategy Case Study Analysis – April 2016
Prepared by: Ha Do, Maria Railwaywalla, Jeremiah Thayer Graduate Students, Poole College of Management, NCSU
Table of Contents
I. Introduction …………………………………………………………………………………………… 2
II. Case Study: Mitchell Industries ……………………………………………………………….. 3
III. Case Study: Eli Lilly ……………………………………………………………………………….. 9
IV. Case Study: Daisy Company …………………………………………………………………… 15
V. Conclusion …………………………………………………………………………………………….. 21
VI. Appendix ………………………………………………………………………………………………. 22
A1: Mitchell Industries: Risk Assessment Template
A2: Mitchell Industries: Template Assessing Risk in Relation to Strategy
A3: El
Our website has a team of professional writers who can help you write any of your homework. They will write your papers from scratch. We also have a team of editors just to make sure all papers are of HIGH QUALITY & PLAGIARISM FREE. To make an Order you only need to click Ask A Question and we will direct you to our Order Page at WriteDemy. Then fill Our Order Form with all your assignment instructions. Select your deadline and pay for your paper. You will get it few hours before your set deadline.
Fill in all the assignment paper details that are required in the order form with the standard information being the page count, deadline, academic level and type of paper. It is advisable to have this information at hand so that you can quickly fill in the necessary information needed in the form for the essay writer to be immediately assigned to your writing project. Make payment for the custom essay order to enable us to assign a suitable writer to your order. Payments are made through Paypal on a secured billing page. Finally, sit back and relax.
About Wridemy
We are a professional paper writing website. If you have searched a question and bumped into our website just know you are in the right place to get help in your coursework. We offer HIGH QUALITY & PLAGIARISM FREE Papers.
How It Works
To make an Order you only need to click on “Order Now” and we will direct you to our Order Page. Fill Our Order Form with all your assignment instructions. Select your deadline and pay for your paper. You will get it few hours before your set deadline.
Are there Discounts?
All new clients are eligible for 20% off in their first Order. Our payment method is safe and secure.