About Risk

Risk and reward/return are two sides of a coin.

Risk in terms of Enterprise Risk Management concept basically comprises of three important words: chance/probability, impact, and objective.

Chance or probability refers to events that may occur in the future. These events may present threat or opportunity. Probability of the occurrence should be identified by ERM officers using the most relevant analytical tools available. These events are called as risk issues or risk events.

Impact refers to our exposures towards the risk events describe above. Impact could be positive or negative depends on the objective. Without exposures, any events are no more than events. But with the present of exposures - means we are being exposed to certain risk events, than that events should be anticipated. Especially if they potentially threaten or strengthen the achievement of our objectives.

Objectives are those goals or targets that are well formulated by our organizations. No goals no risk. No destination no risk. If an organization does not have clear formulated goals, it essentially does not have risks. But without goals or targets they are going nowhere. It will face total failure.

Based on the above understanding, good ERM officers should be able to identify and predict what might happen to the achievement of an organization objectives based on their analyses of the internal and external context of their organization (financial, customers, people, management, information technology, partners, and regulators).

Risk Management is About People

Through my constant contact with my clients, there are 5 factors that cause a problem in an organization which in turn triggers operational risks, e.i.,:

1. People
2. Precedures
3. Information and system
4. Organizational issues: policies, other functions
5. External factors: economic, politics, nature, other parties, etc.

The most frequent factor of the above is people. Talking about people in organization, we may refer to them on individual basis such as their lack of competencies and knowledge and the possibility of their engagement in fraudulance acts or on organizational basis such as misplacement, inappropriate performance measurement, lack of appropriate rewards and punishment system, inappropriate culture, etc.Thus, enterprise risk management must also means managing your people well. HRM department becomes very critical when we talk about ERM.

Just as James Lam wrote in his book enteprise risk management is about people. Couldn't agree more with him.