Financial Risk Management Designation

In the aftermath of the financial crisis, companies and their boards have been grappling with new disclosure requirements related to board risk oversight in the United States, Canada, and Europe. Unfortunately, many organizations that have wanted to improve their risk management capabilities have attempted to implement a traditional form of what is generally known as enterprise risk management (“ERM”). Many companies that have tried the traditional ERM route have been disappointed with the results. Many of these ERM programs have focused on multiple workshops that ask participants to identify potentially negative events, assess their likelihood and consequence, log risks identified in “risk registers, ” plot them on color-coded risk “heat maps” and report the top 10, 20 or 100 risks to the board. In most ERM programs, this exercise is repeated each year and the updated risk register results are reported to the board or a committee of the board. This approach to ERM has proven to be suboptimal at best, and has even proved “fatal” when companies completely missed entity-threatening risks. These poor results can be related to the fact that these initiatives miss the fundamental point of formalized risk management—increasing certainty that objectives, both strategic and value creating, as well as core foundation objectives like obeying laws and producing reliable financial statements, will be achieved with a tolerable level of risk to senior management and the board.

While ERM programs purport to focus on identifying, measuring, and reporting the company’s top risks, internal audit departments continue to use traditional assessment approaches—developing and completing “risk-based” audit plans and reporting subjective opinions on “control effectiveness”—that apply to what is invariably a very small percentage of the total risk universe each year to boards of directors. Few internal audit departments today use generally accepted risk assessment methods on their audits, evaluate the full range of “risk treatments, ” including contractual risk sharing, insurance, and risk avoidance, or provide boards with much information on which objectives have the highest and most dangerous levels of retained risk.