is not doing well, does that mean ERM has failed? And if ERM is meant to support organizational objectives, how can leaders measure the achievement of those objectives (which are sometimes ‘soft’ and non-concrete) as well as the contribution of ERM?
For companies in Malaysia, a common problem one encounters is getting the necessary buy-in and support to implement ERM in the first place. Leaders are understandably wary of investing into frameworks and management method that are still relatively new at both industry and national levels.
There is a discretionary element to ERM, after all. ERM is not just about mitigating risk; it’s also about identifying opportunities in risk. Thus, while most, if not all, risks can be measured, there are costs and benefits to be weighed in performing that measurement. The rapidly changing nature of risk exposures means that risk identification or data collection have to be in line with strategic objectives, lest they become exercises in analyzing outdated and irrelevant information.
Attendees did not necessarily come to a firm consensus on how to define the ‘true value’ of ERM – but that might just be the nature of ERM itself. As a dynamic, evolving discipline, those seeking to practice effective ERM have to customize new knowledge and global standards to the specific needs and culture of their organization. Similarly, measuring the success of ERM in an organization can often come down to how each organization measures its objectives, goals, and performance.
Compliance vs. Risk Management vs. Enterprise Risk Management
Any evangelist of ERM will tell you that risk management is not about ticking the boxes to fulfill compliance requirements. In theory, the risk and compliance functions should be kept separate. Yet in practice–even for regulated industries such as insurance—there is often little distinction between the two. This impedes the full potential of Risk Management, let alone Enterprise Risk Management.
The IERP® September Newsletter August 2018 4
Continued >