Enterprise Risk Management (ERM) Framework

Enterprise Risk Management (ERM) Framework
As mentioned in Chapter 1, the general ERM framework has been around
for many years, emanating from the finance and classical risk insurance
disciplines. We’ll take a high-level view at ERM first, and then dig deeper
with profiles from CAS, the Casualty Actuarial Society. Recall that
Chapter 1 provided one perspective of ERM. A second perspective is from
CAS, which has defined ERM as the discipline by which an organization
in any industry assesses, controls, exploits, finances, and monitors risks
from all sources for the purpose of increasing the organization’s shortand long-term value to its shareholders.
ERM can also be described as a risk-based approach to managing an
enterprise, integrating concepts of strategic planning, operations management, and internal control. ERM is still evolving to address the needs
of various stakeholders who want to understand the broad spectrum of
risks facing complex organizations and their supply chains to ensure they
are appropriately managed. Government regulators and debt-rating agencies have increased their scrutiny of the risk management processes of
many companies.
Schlegel, Gregory L., and Robert J. Trent. Supply Chain Risk Management : An Emerging Discipline, Taylor & Francis Group,
2014. ProQuest Ebook Central, http://ebookcentral.proquest.com/lib/apus/detail.action?docID=1680353.
Created from apus on 2021-01-02 23:04:42. Copyright © 2014. Taylor & Francis Group. All rights reserved.
Emerging Risk Management Frameworks for Success  •  167
COSO ERM Framework
An important perspective about risk is put forth by the Committee of
Sponsoring Organizations of the Treadway Commission (COSO), a wellknown group formed to help businesses develop their internal control
systems. Thousands of organizations have incorporated COSO’s Internal
Control Integrated Framework to help manage their activities. In 2001, in
response to a heightened awareness of global risk, COSO partnered with
PriceWaterhouseCoopers to develop a framework that would enable organizations to evaluate and improve enterprise risk management. COSO
defines ERM as follows:
A process, effected by an entity’s board of directors, management and other
personnel, applied in a strategy setting and across the enterprise, designed
to identify potential events that may affect the entity, and manage risk to
be within its risk appetite, to provide reasonable assurance regarding the
achievement of entity objectives.3
Eight interrelated components comprise COSO’s ERM framework.
These components are derived from the way management runs an enterprise and are integrated within the management process. These eight components, which are also relevant to our discussion of SCRM, comprise a
fully developed ERM system:
• Internal Environment. The internal environment sets an organization’s tone, including how risk is viewed and addressed by an organization’s people, including its risk management philosophy, risk
appetite, integrity, and ethical values.
• Objective Setting. Enterprise risk management ensures that
management has a process to set objectives and that the chosen
objectives support the entity’s mission and are consistent with its
risk appetite.
• Event Identification. Internal and external events affecting the
achievement of objectives must be identified, distinguishing between
risks and opportunities. Opportunities are channeled back to management’s strategy or objective-setting processes.
• Risk Assessment. Risks are analyzed in terms of theirlikelihood and
impact. This is used as a basis for determining how to manage risks.
• Risk Response. Management selects various risk responses, including avoiding, accepting, reducing, preventing, or sharing risk. A set