Rothstein Associates Inc.

ENTERPRISE RISK MANAGEMENT:
TRENDS AND EMERGING PRACTICES
by Jerry A. Miccolis, Kevin Hively, and Brian W. Merkley

Prepared by Tillinghast-Towers Perrin and sponsored by The Institute of Internal Auditors
Research Foundation in cooperation with the Conference Board of Canada.

“This detailed monograph uses first-hand accounts to illustrate:
* The traits of successful enterprise risk management (ERM) programs.
* How ERM can lead to more effective and integrated management approaches.
* Everything you need to know about hazard, operational, financial, and strategic risks.
* The benefits and pitfalls of diverse ERM methods.
* The latest information on cash-flow and stakeholder risks.
* How ERM can boost market value and improve earnings consistency.

- - - - - - - -

“As risk management processes evolve, internal auditors find their role in organizational
planning increasing. Definitions and implementation techniques for enterprise risk
management (ERM) abound, presenting a challenge to internal auditors seeking new and
innovative techniques for risk management in their organizations. Enterprise Risk
Management: Trends and Best Practices, prepared by Tillinghast-Towers Perrin and
sponsored by The Institute of Internal Auditors Research Foundation, uses the results of
literature reviews, focused interviews, and benchmarking surveys to set a benchmark for ERM
across the board.

“Because ERM implementation is in its infancy, the objectives of the research were
far-reaching. The authors first sought to create a universal definition of ERM that would
incorporate theories and ideas from cutting-edge articles and literature and in practice at top
organizations throughout the United States. They then used surveys to identify the current
state of ERM: who is practicing it, what results have been achieved, and what tools and
processes are available for its implementation. Finally, they used case studies and survey
results to predict the future of ERM—how it will be used and what can be achieved through it.
This valuable report offers an up-to-date perspective on leading-edge audit practices and
first-hand accounts of potential obstacles and opportunities facing organizations that choose
to implement ERM.

“Based on the information gathered from extensive literature reviews, the authors define ERM
as "a rigorous and coordinated approach to assessing and responding to all risks that affect
the achievement of an organization's strategic and financial objectives." In essence, ERM
incorporates risks from all sources (financial, operational, strategic, etc.) and makes use of
the natural hedges and portfolio effects from treating those risks with a collective approach. It
is a coordination of risk management strategies that span risk assessment, mitigation,
financing, and monitoring; that focus on the impact to the organization's overall financial and
strategic objectives; and that recognize the upside as well as the downside nature of risk.

“The research report includes information garnered from top professionals at more than 130
organizations—large and small, in varied industries—and outlines their knowledge of and
experience with ERM. Results from the survey indicate that many organizations are already
undertaking ERM. The top motivating factors driving ERM range from a self-motivated desire
for a unifying framework to a mandate from the board of directors or competitive pressure. The
research indicates that ERM efforts require the cooperation of internal audit and senior
management. The research also indicates that there are many organizational barriers to
successful risk management that must be addressed.

“Additionally, the research suggests that initially ERM often serves more as a management
information tool than a driver of corporate performance. Although a wide variety of tools and
metrics (from risk mapping to using optimization software) are being used in ERM activities,
comprehensive risk assessments currently exist in few organizations.

“The authors continued their research of current trends and best practices in ERM with case
studies of several organizations: Hydro-Quebec, Bradford & Bingley Building Society,
Australian Communications Company, Clarica Life Insurance, KeyCorp, Infineon
Technologies AG, Holcim Ltd., and Wal-Mart Stores, Inc. Although these organizations have
much in common, ranging from corporate philosophy to corporate structure, the level of
success with ERM implementation is varied.

“Interviews with leading organizations in ERM and literature reviews helped the authors
identify several key success factors for ERM. According to the results of this research, ERM
efforts are more successful when there is strong and visible support from senior management
and dedicated cross-functional staff to drive ERM implementation and push it into operation.
Most executives interviewed stressed the importance of linking ERM objectives to the key
financial and strategic objectives of the organization and to the business-planning process. In
addition, those interviewed suggested introducing ERM as an enhancement to already
entrenched and well-accepted processes, rather than as a new stand-alone procedure, and
then proceeding incrementally to avoid great internal resistance.

“The authors conclude the report with a brief summary of their findings on the current state of
ERM and its implementation. They also include a list of issues that any organization should
consider before embarking on an ERM initiative. Organizations must consider every aspect of
implementation from choosing a conceptual model to how it will be rolled out within the
organization, from the tools and metrics that will be used to measure its success to how
those results should be communicated to stakeholders.

“Clearly, ERM is more than another management fad or buzzword and much more than an
academic theory. The authors hypothesize that ERM will become an integral part of the
management process for organizations in the 21st century and that it will influence corporate
structure, with some organizations appointing a chief risk officer who reports to the CEO or
board of directors. In short, they draw the conclusion that the future of ERM is the future of
successful business ventures.”

- - - - - - - -

CONTENTS

Enterprise Risk Management: Definitions and Theories
Survey of ERM Trends and Emerging Practices
ERM Case Studies
The Future of Enterprise Risk Management

- - - - - - - -

ABOUT THE AUTHORS

“JERRY A. MICCOLIS is a risk management consultant and consulting actuary with
Tillinghast - Towers Perrin in its Parsippany office. He is a principal of Towers Perrin.

“KEVIN HIVELY is a managing consultant with the Towers Perrin Business Performance
Practice. Mr. Hively's strategic advisory work has included business planning, market
research, transaction support, and industry analyses.

“BRIAN W. MERKLEY served as the project coordinator in the development of this
publication. He is a risk management consultant with Tillinghast - Towers Perrin in its Dallas
office. Prior to joining Tillinghast, he worked for several yers as a project manager for a
national consulting firm that specializes in measuring and managing environmental, health,
and safety risks.”

- - - - - - - -
2002, 179 pages Order #.DR718. Special Order Item.
- - - - - - - -

4 Arapaho Rd.

Brookfield, CT 06804-3104

1-888-ROTHSTEin

Telephone: 203.740.7444; 888.768.4783

Fax: 203.740.7401

All bookstore enquiries should be sent to Rothstein Associates at the above address.

Looking for Practical Knowledge?