Connect with Us

About Us

The Decision Factor offers insightful comments and observations on analytics—from views on new technology approaches and market dynamics to the latest industry trends driving demand for faster, smarter information analysis. This blog contains personal views, thoughts, and opinions from SAP employees, mentors, and friends working in the area of analytics. It’s not endorsed by SAP nor does it constitute an official communication of SAP.

Archives

Downsizing Enterprise Risk Management

Moving day at our house is approaching quickly. The the long-awaited downsizing has arrived. Decisions need to be made. What to keep, what to let go. Perfectly good, well-maintained clothing, furniture, and equipment that have served us well for years are finding a new home. We’re examining the contents of every closet, scruitinizing the contents of every drawer—basing our keep-or-toss decisions on three simple questions:

  • Is it really important?
  • Will we use it?
  • Do we need it?

It’s difficult and sometimes tedious work, but it’s having a surprising impact. Life is looking a lot simpler. Better yet, what’s left is important to us, and we know why it’s important.

Asking the Tough Questions When Downsizing ERM

It occurred to me that some of the same logic could be applied to enterprise risk management (ERM). In my years of consulting and training clients in ERM, I’ve covered boardroom walls all over the world with flip charts and projector screens listing a company’s risks.

But by the standards we’re applying to our household downsizing, most of them would be discarded. Many of those risks aren’t really important; and worse yet, those unimportant risks covered up the important ones. Downsizing ERM, like downsizing a household, requires asking some tough questions.

  1. Where is the fundamental value of the business?

    I spent a number of years with an integrated oil and gas company. Risk management there meant looking for risks related to the value or existence of refined product or crude oil in steel tanks, ships holds, or pipelines. Not a single oil and gas equity or credit analyst makes a buy recommendation or increases a credit rating based on inventory management capability. Very little of the extensive risk management work we did had anything to do with that key value driver of the business.

  2. What activities and processes create that value?

    I worked with a nonprofit provider of home healthcare services that was struggling to prepare accurate, timely, reliable financial statements. The board was tempted to spend resources assessing the financial reporting process and auditing the payment of millions of dollars in service provider invoices every month. Fortunately, they asked themselves this question.

    The value created by this business was keeping clients safe in their homes. The processes that added to this value focused on case management and vendor management. The organization solved its financial reporting problems by changing how it managed these areas, not performing risk assessments. It renewed its focus on quality healthcare and the critical processes that added value.

  3. What are the value-killer risks?

    This question is critical, because the killers may not be attached to the value drivers or the value-adding activities or processes.

    I was engaged by an electrical utility to assist with an ERM program. They defined their value driver in one word: reliability. But risks that could catastrophically impact reliability lay well outside the value-driving processes and, in some cases, the company itself. Hackers could penetrate and shut down the grid, and ice storms could damage powerlines and interrupt service for days or week to critical clients.

Just like my wife and I are downsizing and reaping unexpected rewards from it, ERM can benefit from similar downsizing. Just as we’re finding with our posessions, it’s not the number of risks that are important, it’s the importance of the risks that you maintain.

ERM holds huge promise, but it has seldom realized that promise. It needs downsizing and focus.