Table of Contents

Title Page

Copyright Page

Dedication

Preface

Acknowledgments

CHAPTER ONE - Corporate Governance: A Gut Check

THE GREAT SOX FALLACY

THE VISION-CHALLENGED LEADING THE EVEN-MORE-VISION-CHALLENGED

GOING BACK TO THE FUTURE? HOW NOT TO RUN IT

SYSTEMIC FAILURE: CRITICAL SHORTCOMINGS OF APPLICATION SYSTEMS IMPLEMENTATION

WHAT IS GRC ANYWAY?

ARE YOU CUBIN’?

CHAPTER TWO - What ERM Is and What It Is Not

DON’T BE MISLED: WHAT ERM IS NOT

KEY QUALITIES OF AN EFFECTIVE ERM

PRIMARY COMPONENTS OF RISK ASSESSMENT

NEED FOR A BRAIN (BUSINESS RISK ASSESSMENT INFORMATION NETWORK)

PROCESS OF CREATING A BRAIN

CHAPTER THREE - Understanding What the Business Is

DEFINING THE BUSINESS

A BANKING EXAMPLE

ANSWERING THE KEY QUESTION: WHAT IS THE BUSINESS?

DETERMINING THE CORE BUSINESS PROCESSES

SETTING THE STRUCTURE: CREATING A PHYSICAL MAP

A MEDICAL EXAMPLE: A HEALTHCARE SYSTEM

IMPACT ANALYSIS

CHAPTER FOUR - Defining What True Business Risk Is

IT’S ABOUT THE OUTCOME, STUPID!

RISK NEVER LIVES ALONE

DEFINING BASELINE CATEGORIES OF BUSINESS RISK

EVALUATING ALL OF THE POSSIBILITIES: THE RISK UNIVERSE

USING THE BUSINESS STRUCTURE TO DRIVE THE RISKS

DISTRIBUTED RISK ASSESSMENT AND MANAGEMENT (DRAM)

CHAPTER FIVE - Objectively Defining Risk

DEFINING RISK IN THE CONTEXT OF THE BUSINESS

USING THE BUSINESS-DEFINED DATA STRUCTURE

WHY USE DATA TO DEFINE RISK? THE THREE ATTRIBUTES

DATA-CENTRIC ERM (DCERM)

MULTI-DIMENSIONAL RISK ASSESSMENT

CHAPTER SIX - Building a Fluid/ Dynamic Risk Model

THE MODEL AND WHY IT IS NECESSARY

MOVING FROM REACTIVE TO PROACTIVE RISK MANAGEMENT

OUTCOME/RAW (OR) DATA AND WHY IT IS CRITICAL

KRIs NOT KPIs

OPTIONS ON HOW TO DRIVE THE MODEL

DASHBOARD INDICATORS

KEY EARLY WARNING INDICATORS

DETERMINING THE KEY RISK INDICATORS

UNIVERSAL RISK INDICATORSD

FINANCIAL, OPERATIONAL, REGULATORY, AND TECHNOLOGICAL KRIs

CHAPTER SEVEN - Top-Down Risk Assessment: Evolving the Fluid ERM Environment—A ...

BUILDING ERM ONE STEP AT A TIME

MAPPING THE PHYSICAL STRUCTURE OF THE ENTERPRISE

DEFINING THE BUSINESS RISKS OF THE ENTERPRISE: UTILIZING KEY OUTCOMES

DEVELOPING KRIs FOR ASSESSING RISK FOR THE ENTIRE ENTERPRISE

DETAILED INVENTORIES OF KRIs: WHEN GREATER AUTOMATION/SOPHISTICATION IS ACHIEVED

BUILDING A BASELINE RISK REGISTER

EMBEDDING RISK REGISTERS AND KEY INFORMATION IN THE PHYSICAL MAPPING

THE MODULAR APPROACH

DETERMINING A FOCUSED OUTCOME GROUP (FOG)

NET RISK VERSUS RESIDUAL RISK

BUSINESS RISK ANALYSIS TECHNIQUES (BRATs)

UTILIZING LOGICAL DATA PATHWAYS TO FOCUS ON ROOT CAUSE AND RESOLVE IT

CHAPTER EIGHT - The Future Evolution of the Model

ERM FOR THE TWENTY-FIRST CENTURY

SYSTEMS STRATEGIES

DESIGN CRITERIA AND SPECIFICATIONS

DESIGNING RISK-CENTRIC SYSTEMS FOR EFFICIENCY/ GOVERNANCE: STEP BY STEP

DYNAMICALLY INTEGRATED RISK EVALUATION (DIRE)

TRIGGERS AND MOMS

REAL-TIME PROFILING

SETTING STANDARDS FOR FUTURE EVOLUTION

CHAPTER NINE - Related Topics and Special Risk Situations

MANAGING RISK/AUDITING REAL TIME

MONITORING CONTROLS WITH METRICS

UTILIZING ERM TO REDUCE AUDIT FEES AND LOWER THE COSTS OF OPERATION

MERGERS AND ACQUISITIONS: LET’S BUY SOME MORE RISK

OUTSOURCING: WHAT YOU DON’T KNOW COULD KILL YOUR ORGANIZATION

DEBUNKING THE OUTSOURCING MYTHS: THE VENTORO STUDY

CHAPTER TEN - Maximizing Impact—Minimizing Exposure

WHO OWNS THE RISK MANAGEMENT PROCESS?

INVOLVING THE STAKEHOLDERS: CREATING A CRITICAL BUSINESS TOOL

EXTENDING THE IMPACT: MAKING IT A COMPANY ESSENTIAL

STRATEGICALLY LINKING KEY RISKS AND KEY CONTROLS: CREATING A HOME

BUILDING THE DREAM HOME: AUTOMATING EVEN YOUR SOX

About the Author

Index

Copyright © 2011 by John Wiley & Sons, Inc. All rights reserved.

Published by John Wiley & Sons, Inc., Hoboken, New Jersey.

Published simultaneously in Canada.

No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning, or otherwise, except as permitted under Section 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600, or on the Web at www.copyright.com. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at http://www.wiley.com/go/permissions.

Limit of Liability/Disclaimer of Warranty: While the publisher and author have used their best efforts in preparing this book, they make no representations or warranties with respect to the accuracy or completeness of the contents of this book and specifically disclaim any implied warranties of merchantability or fitness for a particular purpose. No warranty may be created or extended by sales representatives or written sales materials. The advice and strategies contained herein may not be suitable for your situation. You should consult with a professional where appropriate. Neither the publisher nor author shall be liable for any loss of profit or any other commercial damages, including but not limited to special, incidental, consequential, or other damages.

For general information on our other products and services or for technical support, please contact our Customer Care Department within the United States at (800) 762-2974, outside the United States at (317) 572-3993 or fax (317) 572-4002.

Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic books. For more information about Wiley products, visit our web site at www.wiley.com.

Library of Congress Cataloging-in-Publication Data:

Duckert, Gregory H., 1949-

Practical enterprise risk management : a business process approach / Gregory H. Duckert.

p. cm.

Includes index.

ISBN 978-0-470-55985-7 (cloth); 978-0-470-89251-0 (ebk); 978-0-470-89252-7 (ebk); 978-0-470-89253-4 (ebk)

1. Risk management. I. Title.

HD61.D85 2010

658.15’5—dc22

2010016278

To Dina,
my best friend,
my soul mate,
my heart mate,
my wife,
my everything.

Preface

THIS BOOK IS INTENDED to be a handbook of how to establish a highly effective enterprise risk management (ERM) environment that is actually a business tool that yields real business value. This book is a definitive guide for members of the Boards of Directors, the C Suite, Chief Risk Officers (CROs), and those charged with ERM, as well as all levels of management. In addition, this book is a must have for any shareholder who owns stock in any publicly listed corporation and should be read cover to cover to understand why she should be concerned. This is a how-to, hands-on guide, not a generic framework scenario.

With the advent of corporate business catastrophes such as Enron, WorldCom, Lehman Bros., General Motors, and so on it behooves corporate executives to get better connected with their businesses. In addition, the government has now initiated a number of regulatory activities, including Sarbanes-Oxley, which further complicate the lives of the auditors and the corporate executives. The only way to be truly in compliance with Sarbanes-Oxley is to be well aware of what is going on in your corporation, virtually daily. To accomplish this, it is necessary for corporations to establish a highly effective information-centric risk assessment methodology. Without such a methodology intricately woven into the fabric of the organization, it is virtually impossible to guarantee any type of compliance in a realistic fashion. Enterprise-wide risk assessment is much more than simply a catchy phrase or the latest in a string of failed corporate initiatives. If properly constructed, it can be a highly effective governance and oversight tool, which becomes almost irreplaceable in the arsenal of tools necessary for progressive organizations today.

Of interest is that the Chairman Emeritus of the Committee of Sponsoring Organizations (COSO), Larry Rittenberg, PhD., CPA, CIA attended the session I presented for the Madison, Wisconsin, chapter of the IIA on Enterprise-Wide Risk Assessment in 2001. The entire discussion was focused on the concept of using data to evaluate risk throughout an organization. In the presentation, real-time triggers, key process indicators, key risk indicators, Metric Oversight Monitoring Systems (MOMS), and numerous other concepts were discussed for consideration by the participants. I have used these and other similar tools during 30 years of data-centric risk assessment. These tools and methodology will be discussed in this book.

Dave Coderre, a very talented ACL practitioner and author, published the GTAG (Global Technology Audit Guide) on Continuous Auditing in which he presented a very convincing argument for the necessity of continuous audit tools, continuous monitoring, and continuous risk assessment. All of these advanced methods, of course, revolve around the utilization of data. I had the great pleasure of having Dave Coderre as a participant in one of my risk assessment sessions discussing the use of data-driven risk assessment a number of years ago. It is excellent to see that the subject matter is finally getting some serious discussion at these levels.

This book is meant to be a reference point for all organizations that are engaged in or will be engaged in the exercise of establishing an enterprise-wide risk assessment and management oversight system for their organization. It presents an alternative approach to the models that are most commonly seen. In keeping with the underlying thought process of this book, it is straightforward and to the point. This book is not an exercise in overcomplicating a straightforward issue. There are many people who believe that complexity adds value to a process or a methodology. I am not one of them. The whole premise of the book is that complexity in most cases adds nothing to a business process but complexity.

A risk model is no exception. The reality of the matter is that when a risk model becomes overly complex it also becomes unusable. Therefore, as we proceed from this point forward, everything will be clearly expressed and understandable. There will be no complex theories to entangle endlessly what is actually a very commonsense subject matter. Under no circumstances will there be any abstract theories or unattainable methodologies employed.

The approach to risk assessment undertaken in this book is based upon fact, common sense, and practical methodologies for implementation. The model also eliminates subjectivity and guesswork as much as possible. The model presented parallels the normal operation of the business, be able to be effectively utilized at all levels of the business, and can be truly used to create an all-encompassing risk model.

In Chapter 1 I discuss the subject of corporate governance and what is wrong with it in its current format. In addition, I call attention to one of the major shortcomings of most corporations and one of its biggest risk areas, which is systems implementation.

In Chapter 2 I address what I believe to be a significant misunderstanding relative to the subject of risk and risk management. Essentially every model that is out there to perform any type of enterprise risk management is based upon the premise of subjective scoring to arrive at a conclusion. Subjective models are always time and space dependent, and therefore inconsistent. In other words, the same exact situation will always be viewed differently by the exact same person on a different day in a different environment or on a different hour in the same environment.

In addition, when dealing with the subject of risk, you must be prepared to estimate probability and impact or exposure; these models attempt to deal with the subject matter via scoring and unexplainable calculations. Anybody that is the least bit familiar with risk or risk management knows that probability and impact can only be calculated using cold hard facts and data.

Chapter 3 is centered on the business, which is what risk assessment and risk management is all about. I discuss how to go about this and how to create pictures of the enterprise to ensure that effective risk management is put in place and becomes a must-have business tool.

In Chapter 4 I discuss what true business risk is, how it can be categorized, the fact that risk is not a one-off occurrence, and how to establish a risk universe for evaluating all risk.

In Chapter 5 I talk about one of the most critical issues in risk management—the ability to do it objectively not subjectively. I talk about utilizing a data-centric approach, why it is necessary, and why doing risk assessment and management any other way really does not track logically.

In Chapter 6 I begin the discussion of how to build a fluid dynamic risk model that is designed to flow with the movements of the enterprise and to keep pace with changes as they occur. I also discuss options that can be utilized to drive the model.

Chapter 7 is an extensive discussion of how to actually build a model with all of the various components included. It talks about how to construct an ERM environment that is absolutely centered on the organization in its day-to-day operations. There are extensive examples given throughout the chapter relative to the concept of enterprise risk management and key risk indicators (KRIs). There are examples for the administrative areas of the organization as well as operational areas.

Chapter 8 discusses the future evolution of the ERM model and why this is absolutely essential to keep the ERM environment vibrant and connected with the business. Also, the subject of how to make systems self-monitoring from a risk perspective, utilizing advanced tooling, is discussed.

In Chapter 9 I raise the issue of special risk situations and related topics that presents significant exposure to the organization. The two key topics that are discussed in this regard are outsourcing and mergers and acquisitions. In addition, I discuss significantly reducing external audit fees through the utilization of twenty-first-century approaches.

Chapter 10 is the last chapter of this book, and we talk about ownership of risk, extending the impact of the ERM environment, and summarize how to build an automated environment to handle all of your governance concerns.

Another subject that is addressed in this book is the prioritization of risk and risk management relative to internal controls. Internal controls can exist separately and distinctly from the business; however, business risk and the business are inseparably intertwined.

I have finally tired of listening to a bunch of supposed experts pontificate on what they believe enterprise risk management to be, while clearly demonstrating they have not the slightest notion of how it should be done in a manner that yields real business value. This approach actually evaluates and manages risk truly on an enterprise basis, and provides a highly effective business tool as well, while many of the others are financial or administration-centric.

Therefore, do not be surprised or alarmed when I take issue with common practices that have been espoused by very large and well-recognized organizations. I am not trying to be hypercritical nor implying that they are not competent nor unethical. I am simply trying to speak the truth regarding those situations that I believe to be counterintuitive or in some cases unacceptable business practice and a poor use of business resources.

Also, be prepared as the approach used here is different from the norm and as such you will have to expand your thought process and allow yourself to accept something other than the same old recycled ideas, not that recycling is bad, but in this case it is. Keep an open mind and shift your thought parameters and I believe you will find a much better approach to ERM at the end of the day.

I now undertake the task of clarifying once and for all what a commonsense, logically structured, ERM environment should look like and why if implemented properly, it will create a singular, highly effective overriding governance infrastructure.

Thank you for coming along on this journey!

Acknowledgments

IN CREATING THE METHODOLOGIES that underlie this book, even though they are my concepts, I have been fortunate to have the support of some key people. The first person I would like to acknowledge is Joel Kramer of MIS Training Institute, who believed in my talents and my thought processes and never once wavered in his support of me as I worked at honing my skills in the seminar business. This helped me greatly in expanding the tools in my arsenal of risk assessment/management and gave me the opportunity to attain the success I have worked very hard to achieve.

Another is Dave Coderre of Canada who had the vision and courage to take my concepts, implement them, expand on them, and standardize them in his professional career. In addition, he also is an author in his own right and gave me the encouragement I needed to undertake this challenge.

I would also like to extend my sincere thanks to Phillip J. Hatch the president of Ventoro who generously gave of his time to talk with me and his permission to use his data often cited in this work from his in-depth study of offshoring and offshore outsourcing.

Most importantly, my beautiful wife Dina and my children Andrey and Vera who are absolutely critical to my success in every way; I could not do what I do without them and their undying support.

Last, but not least, I want to thank Stacey Rivera of John Wiley & Sons for all of her patience and help in bringing this book to reality.

CHAPTER ONE

Corporate Governance: A Gut Check

THE GREAT SOX FALLACY

One of the key corporate undertakings that undermined and will continue to undermine the success of enterprise risk management (ERM) is Sarbanes-Oxley (SOX). The most amazing thing about the SOX effort was how few of the so-called knowledgeable practitioners that were giving guidance on the subject matter actually understood the salient issues relative to why SOX evolved in the first place. I authored and taught an auditor training class entitled “Sarbanes-Oxley: A Road Map to Compliance.” It was astounding to see how misguided the compliance efforts were that were being sold to these client companies as the panacea for all of their problems. It was even more astounding to hear how little people really understood about what the act was intended to do and how their whole focus in life was on Sections 302 and 404 of the act. Some of the key points I tried to explain to the seminar participants were the following:

• The problems that gave rise to SOX in the first place did not start nor would they end in finance.

• The real issues were centered on ineffective operations and the inability to generate a profit.

• When the risks that were present in operations that undermined their ability to operate effectively were not mitigated, then the risk of financial ineptness was imminent.

• This would leave the financial people with no other alternative but to manipulate the numbers to meet analysts’ expectations.

• Implementing an overabundance of controls in finance for financial reporting would not solve the problem.

• There were many more sections to the act than just Sections 302 and 404, such as Section 409 on real-time disclosure.

• The gathering up of a bunch of control information and then trying to test them inadequately with archaic methods was going to be of little or no use.

• The preferred method of compliance (a top-down risk assessment approach that would be data driven and holistic to the enterprise) was the only effective way to deal with these problems.

• When the risks were identified, the root causal events had to be addressed, and that would be the first step for resolving these issues.

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!