16 The IERP® Monthly Newsletter December 2021
Additionally, firms may be able to identify opportunities by correctly managing their risk; they need to pull all elements together to create an impact on performance. But even with the best intentions, no one has all the right answers, he cautioned.
Another reason that companies may not be able to achieve integration of ERM into decision-making may be that their boards are still inclined to traditional methods and are not as supportive of ERM as they need to be. This may also indicate that risk management professionals and the industry in general are not mature or proactive enough to push the ERM agenda. ERM should ideally be embedded in organisational processes to strengthen the company as this supports risk-informed decision-making that creates value for the firm. “Risk management is about the psychology of risk,” he said. “It’s about how people react to risk, and how to deal with risk to drive performance.”
In leveraging ERM as a strategic decision-making and planning tool, organisations should ask what main risk and opportunity events could affect the achievement of their business objectives, and how much impact these could have on their expected performance. He said that they should also determine if the estimated variation from expected performance was acceptable, and if it would be sustainable over the plan’s timeframe. Stressing that analysis was always more important than data, Ramesh urged risk practitioners to always question what they saw, and not take anything at face value. This supports strategic planning.
By integrating ERM into strategic business planning processes, management and the board are actually equipping themselves in advance for further discussion of key questions. Knowledge and understanding, although integral to the process, are not enough. Risk professionals need to undertake enhanced due diligence, often on their own, to be effective and to support risk management activities in creating value. “Risk management processes are there to help you,” Ramesh said. “Policies are guidance statements. The risk management team has to ensure that the enhanced due diligence processes are ready and available.”