Professional Documents
Culture Documents
COSO ERM Volume2
COSO ERM Volume2
Final draft
Enterprise Risk Management
Integrating with Strategy and Performance
Appendices
June 2017
Volume II
This project was commissioned by the Committee of Sponsoring Organizations of the Treadway
Commission (COSO), which is dedicated to providing thought leadership through the development of
comprehensive frameworks and guidance on internal control, enterprise risk management, and fraud
deterrence designed to improve organizational performance and oversight and to reduce the extent of
fraud in organizations. COSO is a private sector initiative, jointly sponsored and funded by:
• American Accounting Association
• American Institute of Certified Public Accountants
• Financial Executives International
• Institute of Management Accountants
• The Institute of Internal Auditors
©2017 All Rights Reserved. No part of this publication may be reproduced, redistributed, transmitted, or displayed in any form or by any means
without written permission of COSO.
Appendices
Board Members
Robert B. Hirth Jr. Richard F. Chambers Mitchell A. Danaher
COSO Chair The Institute of Internal Auditors Financial Executives International
PwC—Author
Final Draft
Principal Contributors
Miles E.A. Everson Dennis L. Chesley Frank J. Martens
Engagement Leader and Global Project Lead Partner and Global Project Lead Director and Global
and Asia, Pacific, and Americas and APA Risk and Regulatory Risk Framework and Methodology
(APA) Advisory Leader Leader Leader
New York, USA Washington DC, USA British Columbia, Canada
June 2017 i
Enterprise Risk Management | Integrating with Strategy and Performance
Acknowledgments
The COSO Board and PwC gratefully acknowledge the many individuals who gave their time
and energy by participating in and contributing to various aspects of the project. The COSO
Board and PwC also recognizes the considerable efforts of the COSO organizations and
their members who responded to surveys, participated in workshops and meetings, and
provided comments and feedback throughout the development of this framework.
Advisory Council
Douglas J. Anderson Mark Beasley Margaret Boissoneau
The Institute of Internal Auditors North Carolina State University United Technologies Corporation
Managing Director of CAE Solutions Deloitte Professor of Enterprise Risk PMO Liaison
Management and Director, ERM
Initiative
ii June 2017
Appendices
Observers
Jennifer Bayuk James Dalkin Carol Fox
Citi Government Accountability Office RIMS, the Risk Management Society
Managing Director Director in the Financial Director, Strategic and
Representing International Systems Management and Assurance Team Enterprise Risk
Audit & Controls Association, ISACA
Vincent Tophoff
International Federation of
Accountants
Senior Technical Manager
Stephen Zawoyski
Partner
USA
Additional Contributors
PwC also wishes to thank Geoffrey Albutt, Catherine Jordan, Mark Tan, and Karen Vitale for their contri-
butions to the development of the Framework.
Table of Contents
A. P
roject Background and Approach for
Revising the Framework................................................ 1
C. R
oles and Responsibilities for
Enterprise Risk Management .................................... 9
June 2017 v
Enterprise Risk Management | Integrating with Strategy and Performance
Final Draft
vi June 2017
Appendices
Project Background
In October 2014, the Committee of Sponsoring Organizations of the Treadway Commission (COSO)
announced that it would be reviewing and updating the 2004 Enterprise Risk Management–
Integrated Framework (original Framework). The original Framework is widely accepted and used by
management and boards to enhance an organization’s ability to manage uncertainty and to consider
how much risk to accept as they strive to increase stakeholder value.
Since 2004, the complexity of risk has changed, significant new risks have emerged, and boards
have enhanced their awareness and oversight of risk management while asking for improved risk
reporting. Updates to the Framework reflect current and evolving concepts and applications so that
organizations worldwide can attain better value from enterprise risk management. Specifically, it now
provides greater insight into strategy and the role of enterprise risk management in the setting and
Final Draft
execution of strategy, enhances the alignment between organizational performance and enterprise
risk management, and accommodates expectations for governance and oversight.
PwC served as the author and project leader for updating the publication, preparing related doc-
uments and reporting to the COSO Board of Directors. The PwC Project Team includes senior
resource people, many who were involved in previous COSO projects and who bring in-depth
understanding of the original Framework, and others who provide current market perspectives to
this revision. To capture views of a broad range of professionals in the marketplace, the COSO Board
formed an Advisory Council representing industry, academia, government agencies, and not-for-
profit organizations and invited Observers to attend Advisory Council meetings.
June 2017 1
Enterprise Risk Management | Integrating with Strategy and Performance
• Build and Design: The PwC Project Team drafted Enterprise Risk Management–Aligning
Risk with Strategy and Performance,1 which was reviewed by the COSO Advisory Council
and Observers as well as other key users to gather reactions and suggestions. The PwC
Project Team conducted numerous one-on-one and group meetings to capture feedback
on the alternative directions being considered in drafting the Framework. These meetings,
conducted across North America, Europe, Asia, and Australia, included board members,
chief risk officers, chief financial officers, chief audit executives, and other senior
members of management.
• Public Exposure: With the assistance and oversight of the COSO Board, PwC prepared
exposure drafts and an on-line questionnaire to facilitate a review by the general public.
The PwC Project Team conducted a variety of meetings and presented at conferences to
capture added input. Appendix B presents a summary of the public comments and the
Project Team’s response.
• Finalization: The PwC Project Team reviewed and analyzed all comments received and
refined the various documents with needed modifications. The COSO Board considered
whether Enterprise Risk Management–Integrating with Strategy and Performance was
sound, logical, and useful to management of entities of all types and sizes, and the PwC
Project Team finalized the document for the COSO Board for acceptance.
Final Draft
1 This working title was used throughout the public exposure phase, and then the document was retitled Enterprise Risk
Management–Integrating with Strategy and Performance.
2 June 2017
Appendices
to update the Framework to emphasize the importance of considering risk in both strategic planning
and overall performance, add five components of enterprise risk management, and stress how
integrating enterprise risk management into the business can improve decision-making.
However, there were divergent views on certain updates to the Framework, including the definitions
of risk and enterprise risk management, the link to decision-making, the practicality of risk profiles,
and the relationship of internal control to enterprise risk management.
Some respondents sought fundamental changes to the Framework, whereas others recognized
that the Framework remains relevant and useful today for boards and management of entities
regardless of type or size, and requested that only specific areas be updated, as discussed in more
detail below.
June 2017 3
Enterprise Risk Management | Integrating with Strategy and Performance
As for the principles, some have been consolidated. Specifically, two principles within the Gov-
ernance and Culture component were combined into one to focus on core values. As well, within
the Strategy and Objective component, the principles Considers Risk while Establishing Business
Objectives and Defines Acceptable Variation in Performance were merged into one, Formulates
Business Objectives, which focuses on establishing objectives and using tolerance to understand
how risk impacts the achievement of those objectives. Lastly, within the Information, Communica-
tion, and Reporting component, the principles Use Relevant Information and Leverages Information
Systems were merged into one to focus on information and technology supporting enterprise risk
management practices.
Some respondents also expressed concern about the length of the document and complexity of the
language. Specifically, they requested greater use of plain language to make certain technical terms
accessible to a wider audience.
These concerns were addressed by consolidating principles as discussed above. Additionally,
the Framework was revised to reduce sentence length to improve readability. Specifically, the
Flesch–Kincaid readability tool was used to identify areas for improvement as well as to confirm
the readability for similar standards and frameworks. Given the complexity of certain topics,
the overall Framework remains a comprehensive document in length to sufficiently develop and
clarify concepts.
Final Draft
4 June 2017
Appendices
The Framework now includes a new chapter, “Integrating Enterprise Risk Management”, which
focuses on how enterprise risk management is integrated with strategy-setting through perfor-
mance, and the value of integration for the entity, such as improved decision-making. The new
chapter and each principle in the Framework enhance the discussion of decision-making and the
impact of management bias.
Discussion on Strategy
Respondents expressed overall support for the emphasis on strategy throughout the Framework.
Some requested clarity on the transition from strategy planning to implementation and when to
revisit strategy. A few held the view that objectives precede strategy, and others requested replacing
strategy with strategic objectives. There were varying opinions about including the setting of
mission, vision, and core values within the scope of enterprise risk management.
The Framework retains the current focus on the “possibility of strategy not aligning, implications from
the strategy chosen, and risks to performing the strategy” as these provide a more detailed analysis
of the importance of integrating enterprise risk management with strategy-setting. The Framework
now clarifies how enterprise risk management is applied across strategy and performance. It retains
the link to mission, vision, and core values as that provides the foundation of the acceptable type
and amount of risk. Additionally, the Framework retains the hierarchy relationship between strategy
and business objectives, and the terminology of strategy versus strategic objectives, as both are
consistent with commonly used strategy and business frameworks.
June 2017 5
Enterprise Risk Management | Integrating with Strategy and Performance
Role of Culture
Overall, there was positive support for the inclusion and prominence of culture in the exposure
draft. Some respondents suggested further expanding the discussion on the culture spectrum
and emphasizing links to performance management, conduct, and incentives. A few suggested
that culture is not part of the definition of enterprise risk management, while others suggested that
entities do have a culture and risk is a part of it. Some wanted a discussion on fraud risk as it relates
to culture.
The Framework has been revised to consolidate Principles 4, 5, and 6 into the new Principle 4,
Demonstrates Commitment to Core Values. This principle emphasizes the relationship between
enterprise risk management and the core values established by the board and management for the
entity. Additionally, the revised Framework is enhanced with examples of how culture influences
enterprise risk management practices and decision-making, including the influence of management
bias. It does not include discussions of fraud risk, as this is addressed in Internal Control–Integrated
Framework.
6 June 2017
Appendices
The final Framework has revised Principle 11, Assess Severity of Risk, to focus more explicitly on
the impact to the achievement of business objectives and strategy. It also clarifies how heat maps
can be used to depict risk in the context of objectives. Additionally, a discussion on quantitative
approaches to risk assessments was added.
Some respondents questioned the practical application of risk profiles, whereas others noted limiting
the risk profile to one graphic may be too prescriptive. Those supportive of the risk profiles noted
that they provide an effective explanation of the relationship between risk, performance targets, risk
capacity, and risk appetite.
The final Framework retains the use of risk profiles as they provide management with a view of how
risk impacts performance and how risk appetite can be used for decisions. Enhancements have
been made to clarify the risk profile graphics across different types of business objectives, and how
risk profiles can be used with both qualitative and quantitative data.
Guidance
Some respondents requested guidance on how a company could apply the concepts discussed
in the Framework. Specifically, they asked for more examples, including mini or full case studies,
tools to assist in evaluating enterprise risk management (e.g., maturity models), and general
implementation guidance (e.g., risk reports).
In response, the COSO Board and the PwC Project Team agreed to develop a separate document
containing examples on applying the Framework, Enterprise Risk Management–Integrating with
Strategy and Performance: Compendium of Examples. This document illustrates the application of
all the principles in the Framework across different industries, entity sizes, and types, and actual and
expected company practices.
June 2017 7
Enterprise Risk Management | Integrating with Strategy and Performance
Final Draft
8 June 2017
Appendices
The lines of accountability model offers an organization a balanced approach to managing risk
and seizing opportunities, all while enabling risk-based decision-making that is free of bias.
However, there is no one-size-fits-all approach to using this model and no prescriptive details
on the number of lines of accountability necessary. Some industries offer specific guidance for
implementing an accountability model, but organizations must consider factors such as their size,
strategy and business objectives, organizational culture, and external stakeholders. Individual
organizations may establish roles across any number of different lines of accountability with specific
regulatory guidance and oversight. Regardless of the number of lines of accountability, the roles,
responsibilities, and accountabilities are defined to allow for clear “ownership” of strategy and risk
that fits within the governance structure, and culture of the entity.
June 2017 9
Enterprise Risk Management | Integrating with Strategy and Performance
strategy achievement.
• Challenges the potential biases and organizational tendencies of
management and fulfills its independent and unbiased oversight
role.
• Understands the entity’s strategy, operating model, industry, and
issues and challenges affecting the entity.
• Understands how risk is monitored by management.
Strategy and • Sets expectations for integrating enterprise risk management into
Objective-Setting the strategic management processes, including strategy planning,
capital allocation, etc.
• Discusses and understands the risk appetite and considers whether
it aligns with its expectations.
• Engages in discussion with management to understand the changes
to business context that may impact the strategy and its linkage to
new, emerging, or manifesting risks.
• Encourages management to think about the risks inherent in the
strategy and underlying business assumptions.
• Requires management to demonstrate an understanding of the risk
capacity of the entity to withstand large, unexpected events.
10 June 2017
Appendices
Figure C.1—Continued
The board of directors may choose to manage its risk oversight responsibilities at the full board level
or may assign specific tasks to dedicated committees with a risk focus. Where a particular commit-
tee has not been established for risk oversight, the responsibilities are carried out by the board itself.
Board-level committees can include the following:
• Audit committee: Establishes the importance of risk oversight. Regulatory and profes-
sional standard-setting bodies often require the use of an audit committee, sometimes
named the audit and risk committee. The role and scope of authority of an audit com-
mittee can vary depending on the entity’s regulatory jurisdiction, industry norm, or other
variables. While management is responsible for ensuring financial statements are reliable,
an effective audit committee plays a critical risk oversight role. The board of directors,
often through its audit committee, has the authority and responsibility to question senior
management on how it is carrying out its enterprise risk management responsibilities.
• Risk committee: Establishes the direct oversight of enterprise risk management. The focus
of the risk committee is entity-wide risk in non-financial areas that go beyond the authority
of the audit committee and its available resources (e.g., operational, obligations, credit,
market, technology).
• Compensation committee: Establishes and oversees the compensation arrangements
for the chief executive officer and other executives, as appropriate, to motivate without
providing incentives for undue risk taking. It also oversees that management balances
June 2017 11
Enterprise Risk Management | Integrating with Strategy and Performance
performance measures, incentives, and rewards with the pressures created by the entity’s
strategy and business objectives, and helps structure compensation models without
unduly emphasizing short-term results over long-term performance.
• Nomination/governance committee: Provides input to and oversight of the selection of
candidates for directors and management. It regularly assesses and nominates members
of the board of directors; makes recommendations regarding the board’s composition,
operations, and performance; oversees the succession-planning process for the chief
executive officer and other key executives; and develops oversight processes and
structures. It also promotes director orientation and training, and evaluates oversight
processes and structures (e.g., board/committee evaluations).
The chief executive officer (CEO) is accountable to the board of directors and is responsible for
overall enterprise risk management culture, capabilities, and practices required to achieve the
entity’s strategy and business objectives. (In privately owned and not-for-profit entities, this position
may have a different title, but generally the responsibilities are the same.) More than any other
individual, the CEO sets the tone at the top along with the explicit and implicit values, behaviors, and
norms that define the culture of the entity.
The CEO’s responsibilities relating to enterprise risk management include:
• Providing leadership and direction to senior members of management, and shaping the
entity’s core values, standards, expectations of competence, organizational structure, and
accountability.
• Evaluating alternative strategies, choosing a strategy, and setting business objectives that
consider supporting assumptions relating to business context, resources, and capabilities
within the risk appetite of the entity.
• Maintaining oversight of the risks facing the entity (e.g., directing all management and
other personnel to proactively identify, assess, prioritize, respond to, and report risks that
may impede the ability to achieve the strategy and business objectives).
• Guiding the development and performance of the enterprise risk management process
across the entity, and delegating to various levels of management at different levels of the
entity.
• Communicating expectations (e.g., integrity, competence, key policies) and information
requirements (e.g., the type of planning and reporting systems the entity will use).
12 June 2017
Appendices
Organizations develop the CRO role and responsibilities in a way that best meets their needs for
effective enterprise risk management. Some entities choose to align the role of chief risk officer
with the chief strategy officer so that strategy and risk are managed together under the CEO. Other
entities delegate responsibility for enterprise risk management to first-line functions, including
operating unit and functional unit leaders, leaving second-line responsibility to the CRO. These
entities often align staff within divisions, operating units, and functions with the CRO to support
enterprise risk management efforts across the entity.
The CRO is typically responsible for:
• Assisting the board of directors and management in fulfilling their respective risk oversight
responsibilities.
• Establishing ongoing enterprise risk management practices suitable for the entity’s needs.
• Building and maintaining relationships with those responsible for managing risks through-
out the entity.
• Overseeing enterprise risk management ownership within the respective lines of
accountability.
• Reviewing the operation of enterprise risk management in each operating unit.
Final Draft
• Communicating with management through a forum, such as the enterprise risk man-
agement committee, about the status of enterprise risk management, which includes
discussing severe risks and emerging risks.
• Promoting enterprise risk management to the CEO and operating unit leaders and assist-
ing in integrating practices into their business plans and reporting.
• Evolving organizational capabilities in line with the maturity and suitability of enterprise
risk management.
• Escalating identified or emerging risk exposures to executive management and the board.
Management
Management comprises the CEO and senior members leading the key operating units and
business-enabling functions. Each of these management roles may have different responsibilities
and accountabilities within the lines of accountability model, depending on the entity. For example,
a chief technology officer may play a second-line role in a financial services company, but in a
technology company that same position would play a first-line role. Some smaller entities may
combine roles, with one person having responsibilities for one or more. Examples of management
for a larger public or private entity, a smaller business entity, and a government entity are noted in
Figure C.2.
June 2017 13
Enterprise Risk Management | Integrating with Strategy and Performance
counsel
• Marketing manager • Inspector general
• Chief marketing officer
• Chief operating officer
• Chief risk officer
• Chief strategy officer
In some entities, the CEO establishes an enterprise risk management committee of senior members
of management including functional managers, such as the chief financial officer, chief audit exec-
utive, chief information officer, and others. Examples of the functions and responsibilities of such a
committee include:
• Assuming overall responsibility for enterprise risk management, including the processes
used to identify, assess, prioritize, respond to, and report on risk.
• Communicating the enterprise risk management process to the CEO and the board.
• Considering and discussing emerging risks.
• Defining roles, responsibilities, and accountabilities at the different levels of management.
• Providing policies, methodologies, and tools to operating units to identify, assess, and
manage risks.
• Reviewing the entity’s risk profile.
• Reviewing acceptable variation in performance and taking action where appropriate.
Management also guides the development and implementation of enterprise risk management prac-
tices within their respective functional or operating unit and verifies that these practices are applied
consistently.
Depending on how many layers of management exist within an entity, subunit managers or
lower-level supervisory personnel are directly involved in executing policies and procedures at a
detailed level. It is their responsibility to carry out the enterprise risk management process that
14 June 2017
Appendices
senior management has designed and implemented. Each manager is accountable to the next
higher level for his or her portion of enterprise risk management, with the CEO being ultimately
accountable to the board of directors, and the board being accountable to external stakeholders
such as shareholders or other owners of the entity.
to defined standards. Each of these functions has some degree of independence from the first line
of accountability, and they challenge the first line to manage performance and take prudent risks
to achieve strategy and business objectives. In some entities, independent teams without separate
and distinct reporting lines may provide some degree of challenge. These organizational functions
or operating units support the entity through specialized skills, such as technical risk management
expertise, finance, product/service quality management, technology, compliance, legal, human
resources, and others. As management functions they may intervene directly in modifying and
supporting the first line in appropriate risk response.
Second-line responsibilities often include:
• Supporting management policies, defining roles and responsibilities, and setting targets
for implementation.
• Providing enterprise risk management guidance.
• Supporting management to identify trends and emerging risks.
• Assisting management in developing processes and risk responses to manage risks and
issues.
• Providing guidance and training on enterprise risk management processes.
• Monitoring the adequacy and effectiveness of risk responses, accuracy, and complete-
ness of reporting, and timely remediation of deficiencies.
• Escalating identified or emerging risk exposures to management and the board for aware-
ness and potential action.
There are various methods of achieving objectivity across these two lines of accountability. For
example, one company may have enterprise risk management teams embedded in the first line but
with a separate second-line risk function. Another company may spread its risk management teams
across the two lines depending on the complexity and nature of the business. These and other
approaches can work as long as unbiased oversight is not constrained.
June 2017 15
Enterprise Risk Management | Integrating with Strategy and Performance
External Auditors
External auditors provide management and the board of directors with a unique, independent, and
objective view that can contribute to an entity’s achievement of its strategy and business objectives.
In an external audit, the auditor expresses an opinion on the fairness of the financial statements in
conformity with applicable accounting standards, thereby contributing to the entity’s external finan-
cial reporting objectives. The auditor conducting a financial statement audit may contribute further
to those objectives by providing information useful to management in carrying out its enterprise risk
management responsibilities. Such information includes:
Final Draft
16 June 2017
Appendices
The risk profile, as depicted in this appendix, enables the organization to evaluate:
• The relationship between risk and Figure D.1: Risk Profile
performance, noting that the amount
of risk for a given strategy or busi-
ness objective is typically not static
and will change for different levels of
performance.
• Assumptions underlying the risk
assessment for a given strategy or
Risk
business objective.
• The level of confidence with which the
∑ Severity of
assessment has been performed and known and
the potential for unknown risks. unknown risks
• Where corrective actions may be
required in setting strategy, business Performance
objectives, performance targets, or risk Risk curve
responses.
June 2017 17
Enterprise Risk Management | Integrating with Strategy and Performance
To develop a risk profile, the organization determines the relationship between the level of per-
formance for a strategy or business objective and the expected amount of risk. On a risk graph,
performance is plotted along the x-axis and risk is along the y-axis (Figure D.1). The resulting line is
often referred to as a “risk curve” or “risk profile.”
Each data point is plotted by considering the perceived amount of risk that corresponds to the
achievement of a business objective or strategy. As performance changes, the organization identifies
how the amount of risk may change. Risk may change due to the changes in execution and business
context.
Both quantitative and qualitative approaches can be used to plot points. If the organization has
sufficient data on a strategy or business objective, it may use a quantitative approach, such as prob-
abilistic modeling or regression analysis. Where data is not available or where business objectives
are less important, the organization may prefer to use a qualitative approach, such as performing
interviews, facilitating workshops, or benchmarking. Example D.1 describes how one entity plotted
its risk profile.
A university has a strategy of becoming the institution of choice for graduate students in the region.
Final Draft
To support the strategy, it has decided on a business objective of developing a new curriculum to
meet emerging needs. The university has identified the following five risks for this business objective:
• Failing to build sufficient interest and awareness of the courses to generate growth in
student applications, which could impact the university’s reputation.
• Generating actual or perceived conflict of interest between academic freedom and the
new curriculum.
• Failing to attract and retain additional faculty required to teach and administer new
classes.
• Failing to secure additional government funding to administer the new curriculum.
• Incurring unbudgeted costs in support of the new curriculum.
In addition, the university has identified that this new objective creates potential risk to other objec-
tives, such as the possibility of marginal students affecting the university’s brand.
The university measures performance
based on the number of student
enrollments. It assesses the severity of the
risks to the achievement of the business
objective changes at various levels of
student enrollment. That is, the distance
between the point and the x-axis represents
the impact of the five risks identified, as
Risk
18 June 2017
Appendices
• How might risks change in severity and what supporting assumptions may change at
varying levels of performance? For instance, assumptions of government funding may be
contingent on achieving set levels of enrollment.
• Are there new or emerging risks with each incremental increase in student enrollment? For
instance, does enrollment above a certain level create a new risk relating to the physical
space required to accommodate students?
• Are there some risks that no longer apply at certain levels of performance? For instance,
do the concerns about failing to generate sufficient interest and awareness of the
university’s courses become increasingly irrelevant above a certain level of enrollment?
In preparing this profile, the university uses a combination of quantitative and qualitative
approaches. Quantitative approaches include data modeling (reviewing historical student
enrollments and correlation with the launch of new programs, the average number of operational
incidents, revenues and losses per student). Qualitative approaches include reviewing campus
health and safety requirements, forecasting revenue and government grants, and conducting
interviews and workshops with key stakeholders. The risk profile shown on below illustrates that:
• There is a high amount of risk assumed if only 100 new students enroll because of the
new curriculum (risk of underperformance).
Final Draft
• Risk reaches its lowest point at 600 enrollments, which may not represent the optimal
number of students from a performance perspective.
• Any enrollments in excess of 600 represent an incremental increase in risk. The university
has established that it can accept a maximum of 1,100 new students.
Having determined how the amount of risk
Target
can change, and understanding the drivers
and assumptions that support change,
the organization can determine its desired
performance target. To set that target,
the organization evaluates the business
objective in the context of the entity’s risk
Risk
June 2017 19
Enterprise Risk Management | Integrating with Strategy and Performance
Risk
given point in time. The y-axis (risk) uses the
A
same metric or expression of risk appetite
as is referred to in an entity’s risk appetite
statement. For example, the y-axis may be
earnings at risk, value at risk, or other metric.
The section of the curve from the point of
Final Draft
Alternative Strategies
Organizations can develop profiles of
potential risks as part of considering
alternative strategies. For each strategy, an
organization may prepare a risk profile that
reflects the expected types and amount of
Performance
risks. These risk profiles support the strategy
Risk curve Risk appetitle Risk capacity
selection process by highlighting differences
in the expected risk for different strategies.
Figure D.4 illustrates how profiles can be compared. Alternative A shows a flatter curve, indicating
that the entity faces less incremental risk as performance increases. That is, the intersection of the
risk curve and risk appetite is farther to the right, indicating greater opportunity for performance
before the entity exceeds appetite. Established entities operating in mature, stable markets or with
stakeholders who expect lower risk profiles may seek strategies that resemble Alternative A.
20 June 2017
Appendices
Risk
Risk
Risk
Performance Performance
Risk curve Risk appetitle Risk curve Risk appetitle
Final Draft
Conversely, risk-taking entities such as start-ups or venture capitalists may explore strategies that
are more typical of Alternative B. In this case, an entity would seek more aggressive performance in
return for assuming greater risk.
Quantitative and qualitative techniques are used to develop the profile of potential risks and may
be the same tools that are then used to support risk identification and assessment processes.
This includes quantitative analysis and modeling where there is sufficient data. Where data is not
available, more qualitative techniques may be employed.
June 2017 21
Enterprise Risk Management | Integrating with Strategy and Performance
Additional risks may be identified for a number of reasons. The organization may have completed
a more rigorous analysis after selecting a business objective, or may have gained access to more
information, giving it more confidence in its understanding of the risk profile, or may have determined
it needs to update the list of expected risks due to changes in the business context having occurred.
The outputs of the risk identification process, the risk universe, form the basis on which an
organization is able to construct a more reliable risk profile.
22 June 2017
Appendices
confidence depending on the type of business objective, experience and knowledge of the
organization, and available data. Where the number and amount of unknown risks is potentially large
(e.g., developing new technology), the distance between the risk curve and the x-axis will typically be
greater to indicate greater risk. For business objectives in more mature environments with significant
performance data, knowledge, and experience, the amount of unknown risk may be considered
much less significant, and the distance between the risk curve and the x-axis will therefore be
smaller. The distance of the curve from the x-axis also demonstrates how multiple risks impact the
same business objective.
The organization may choose to use different assessment methods for different points of the risk
curve. When focused on the acceptable variation in performance, analysis of risk data may be a
suitable approach. When looking at the extreme sections of the curve, scenario analysis workshops
may prove more effective in determining the height and shape of the curve.
As with considering alternative strategies and identifying risks, management uses quantitative
and qualitative approaches, or a combination of both, to assess risks and develop a risk profile.
Qualitative assessment is useful when risks do not lend themselves to quantification or when it
is neither practicable nor cost effective to obtain sufficient data for quantification. For example,
consider a reputable technology company that is contemplating launching a new product that is
currently not commercially available. In developing a risk profile of the risk of launching the R&D of
Final Draft
the new product, management relies on its own business knowledge and its engineers’ expertise to
determine the height and shape of the curve.
For risks that are more easily quantifiable, or where greater granularity or precision is required, a
probability modeling approach is appropriate (e.g., calculating value at risk or cash flows at risk).
For example, when the same technology company assesses the risk of maintaining operations in a
foreign country, it employs modeling when plotting the curve to identify sufficient points outlining the
severity of its foreign exchange exposure.
June 2017 23
Enterprise Risk Management | Integrating with Strategy and Performance
the particular performance target. In fact, both Risk Profile A and B have the same severity of risk
for their respective performance targets. Consequently, the severity of one risk (e.g., Risk #3 in Risk
Profile A) should not be the sole basis for prioritization relative to other risks.
Risk
Risk #3
Risk #3
Risk #2
Risk #2
Risk #1 Risk #1
Final Draft
Performance Performance
Risk curve Risk appetitle Risk curve Risk appetitle
24 June 2017
Appendices
• Share: Action is taken to reduce the severity of a risk by transferring or otherwise sharing
a portion of the risk. Common techniques include outsourcing to specialist service pro-
viders, purchasing insurance products, and engaging in hedging transactions. As with the
reduce response, sharing risk lowers residual risk in alignment with risk appetite. A section
of the risk curve may change, although the entire risk curve likely shares similarities to one
where risk has not been shared.
• Review business objective: The organization chooses to review and potentially revise the
business objective given the severity of identified risks and acceptable variation in per-
formance. This may occur when the other categories of risk responses do not represent
desired courses of action for the entity.
• Review strategy: The organization chooses to review and potentially revise the strategy
given the severity of identified risks and risk appetite of the entity. Similar to reviewing
business objectives, this may occur when other categories of risk responses do not repre-
sent desired courses of action for the entity. Revisions to a strategy, or adoption of a new
strategy, also require that a new risk profile be developed.
Figure D.8 shows how a risk profile changed Figure D.8 Effect of Risk Response
after carrying out a risk response, such as
Target and Tolerance
entering into an insurance arrangement. For
Final Draft
Performance
Risk curve
June 2017 25
Enterprise Risk Management | Integrating with Strategy and Performance
Entity
Entity Objective 1 Entity Objective 2 Entity Objective 3
Objectives
When preparing a portfolio view, the organization may also choose to develop a risk profile that
provides added context on the portfolio view. Figure D.10 illustrates the risk profile of two entity-level
objectives. The first graph illustrates how risk to the achievement of entity objective 1 (at the current
level of performance) is within the both risk appetite and risk capacity (and shown as green in Figure
D.9). The second graph illustrates how risk to the achievement of entity objective 2 is above the risk
appetite, although still within risk capacity (Red in Figure D.9). These two perspectives are reflected
above in Figure D.9.
An organization will typically use both qualitative and quantitative techniques in developing this view.
Qualitative techniques include scenario analysis and benchmarking. Quantitative techniques include
regression modeling and other means of statistical analysis to determine the sensitivity of the
portfolio to sudden or large changes. These changes may be represented as shifts in the risk curve
or gradient.
26 June 2017
Appendices
Risk
A). Further, the organization determines
that a 50% drop would affect performance A
to the extent that the entity exceeds its
risk capacity and threatens the viability of
the entity. This is represented where the
∑ total risks that rep-
risk curve intersects the risk capacity line resent the portfolio
(Point B). view
By using stress testing, scenario Performance
Final Draft
analysis, or other analytical exercises, Risk curve Risk capacity Risk appetite
an organization can avoid or more
effectively respond to big surprises
and losses. By analyzing the effect of Entity Objective 2
hypothetical changes on the portfolio
view, the organization identifies potential
new, emerging, or changing risks and
evaluates the adequacy of existing risk
responses. The purpose of these exercises
is for management to be able to assess
Risk
June 2017 27
Enterprise Risk Management | Integrating with Strategy and Performance
Risk
C
• Has the organization performed as A
expected and achieved its target?
Using a risk profile, the organization B
reviews the performance set and
determines whether targets were
Final Draft
28 June 2017