RM in your Role >

 S&P's and the ERM Review

S&P's announcement that from next year they will review the quality of enterprise risk management (ERM) as a new component in their reviews of credit ratings - for all listed companies – can be seen as the catalyst for a wave of change in business leadership and performance management around the world.

Every so often a paradigm shift, long in the making, seems to emerge suddenly, as parallel forces, each disruptive in their own right, converge at the same time. Combined with tightening credit conditions, a storm of uncertainty about scarce resources, and fundamental imbalances in the world economy, ERM is, to many, no longer an option, but a strategic imperative.

ERM is not a new concept, but neither is it, as S&P's put it “a passing fad”. It is not, as some commentators expected, going away. One of the reasons is that software can put the long cherished theory into practice.

ERM can now be seen as an entirely new way of doing business.

What is ERM?

Yet the implications of ERM are not fully understood.  It is not, for example, as many believe, about risk, but about qualitative and quantitative assessments of business strategy and performance – about the relationships between risk and reward. 

In other words, ERM is, as S&P's have recognized, about the upside and how to improve the chances of success, as much as it is about mitigating or adapting to possible downsides.

Put simply, ERM is a set of new cultural practices, information management and organizational processes designed to help organizations deliver their business vision, strategy and objectives.  It introduces, amongst many things, systems and disciplines aimed at identifying, measuring and actively managing threats that may throw sustainable growth, profitability and new investment opportunities off course.

Just as the deep workings of a modern car are hidden from the driver, or as the fail-safe systems in aircraft are screened from the pilot, modern risk-reward control and navigation systems constantly measure vital signs and deliver early warnings and alerts when current – or future - performance falls outside selected parameters.

In this sense, ERM is top down.  At the same time, implemented successfully, ERM must engage everyone in the business in considering risk-reward relationships.  In this sense it is bottom up and a question of implementing the right cultural practices, processes and software tools.

Beyond enterprise-wide

Yet in an age of increasingly interdependent, networked business models, ERM it can be seen as a way of capturing risk and reward information not in these conventional hierarchical terms, or in terms of linear supply chains, but in terms of complex supply/demand ecosystems.  In this sense, ERM is about networked business intelligence.

Seen holistically, ERM brings with it a critical strategic advantage: it delivers to top management and potentially all stakeholders what we call the true picture – sometimes seen as the ‘portfolio view’ - of the entire business.  This includes views of the critical relationships with customers, suppliers, regulators and sources of finance.  Hence, in its most advanced and developed forms, it is beyond enterprise-wide.   In its best, it delivers ‘risk adjusted performance’ - a level of both quantitative and qualitative assurance that a business is resilient and will achieve its financial and business forecasts.

Software and cultural practice

The benefits envisaged by S&P's naturally focus on the relationship between performance, the quality of ERM and the direct financial and capital efficiency impacts they will have on credit ratings.  Downgrades are costly.   Upgrades are valuable and are already attributable to ERM performance, as recently illustrated by Royal Sun & Alliance, who benefitted not simply in financial terms, but in reputational terms too.

In practice, S+P intend to focus initially on what they call ‘culture’ and ‘strategic risk’.  They have deferred specific ERM evaluation of ‘emerging risks’ and ‘risk controls’ until suitable benchmarks are developed.

This is understandable.  However, our experience is that the ERM journey is best undertaken with the destination in mind and this means taking into account the question of maturity, as well as benefits beyond ratings.  S+P have recognized that not all organizations, or all industries, can be seen or measured in the same way.  Yet the vision of ERM in its most mature form means that laying the groundwork is important from the outset.  Emerging risks and risk controls are, after all, integral to good business management, whether they can be measured and benchmarked - or not - for rating purposes.

Bearing in mind S&P’s interest in ‘culture’, our view is that software is not only necessary, but is a set of tools by which culture can be changed.  In other words, software provides the framework, information-sharing, codification, analysis tools and disciplines that can be used to define, develop, embed, and re-enforce cultural practices.  Of course, not all companies will adjust to disclosing all risks in a transparent, timely way.  Yet because software, at its best, is simple to use, it can reduce barriers and fit into established ways of working.  In this sense, software can be used to frame and encourage cultural change.

Beyond ratings

Clearly, improved credit ratings provide direct financial benefits, including reduced cost of capital and increased funding options.  Risk adjusted performance measures increase the certainty of ‘making the numbers’ and improve decision-making.

Yet ERM has the potential, in its more mature forms, to deliver deeper and wider benefits, such as:

• Deliver capital projects: shared risk evaluation improves collaboration with partners and customers and so reduces costs; improves delivery performance; enables lower pricing and/or higher margins; and better knowledge means the risk envelope is more accurate;
• Risk assessed supply chain: in complex consortia risk systems improve communication around boundaries; increase transparency and so trust; improve visibility of risk controls and mitigations; provide early warning of failures; and deliver common views of risks related to shared performance objectives;
• Process excellence improves margins: enables cutting of unnecessary or duplicated risks and costs internally and across boundaries with customers and suppliers; optimizes relationships between cash to delivery and so reduce capital, cash employed and improved margins;
• Reduced insurance costs: provides management information to cut insurance premiums and/or self-insure part of the portfolio in ways that in the past were not possible;
• Enhanced business continuity: minimizes exposure to operational failures and associated costs/penalties; protects reputation for reliability; and minimizes risks to financial results.

To put it more simply, ERM is not simply about credit ratings: it can bring direct business benefits for all companies.  Similarly, credit ratings are not solely about ERM maturity – there are many other vital factors.  It is clear that the importance of ERM will vary widely according to individual needs to raise capital, risk-reward profiles and both industry and peer standards.

In other words ERM can be critical to a business without ratings being critical.  But if ratings are critical, chances are that ERM is critical too.