Implementing Enterprise Risk Management

JAMES LAM is president of James Lam & Associates, a risk management consulting firm. He serves on the board of directors of E*TRADE Financial and chairs the Risk Oversight Committee. An NACD Board Leadership Fellow, he is author of the bestselling risk management title, Enterprise Risk Management.

• Preface xiiiAcknowledgments xixPart One ERM in ContextChapter 1 Fundamental Concepts and Current State 3Introduction 3What Is Risk? 4What Does Risk Look Like? 8Enterprise Risk Management (ERM) 11The Case for ERM 13Where ERM Is Now 18Where ERM Is Headed 19Notes 20Chapter 2 Key Trends and Developments 21Introduction 21Lessons Learned from the Financial Crisis 21The Wheel of Misfortune Revisited 26Global Adoption 34Notes 37Chapter 3 Performance-Based Continuous ERM 41Introduction 41Phase Three: Creating Shareholder Value 43Performance-Based Continuous ERM 44Case Study: Legacy Technology 56Notes 59Chapter 4 Stakeholder Requirements 61Introduction 61Stakeholders Defined 62Managing Stakeholder Value with ERM 79Implementing a Stakeholder Management Program 80Appendix A: Reputational Risk Policy 83Notes 87Part Two Implementing an ERM ProgramChapter 5 The ERM Project 93Introduction 93Barriers to Change 93Establish the Vision 95Obtain Buy-In from Internal Stakeholders 97Assess Current Capabilities against Best Practices 100Develop a Roadmap 104Appendix A: ERM Maturity Model 108Appendix B: Practical Plan for ERM Program Implementation 111Chapter 6 Risk Culture 115Introduction 115Risk Culture Success Factors 117Best Practice: Risk Escalation 130Conclusion 130Notes 131Chapter 7 The ERM Framework 132Introduction 132The Need for an ERM Framework 132ERM Framework Criteria 136Current ERM Frameworks 138An Update: The Continuous ERM Model 145Developing a Framework 150Conclusion 153Notes 153Part Three Governance Structure and PoliciesChapter 8 The Three Lines of Defense 157Introduction 157COSO’s Three Lines of Defense 158Problems with This Structure 160The Three Lines of Defense Revisited 164Bringing It All Together: How the Three Lines Work in Concert 172Conclusion 173Notes 173Chapter 9 Role of the Board 175Introduction 175Regulatory Requirements 176Current Board Practices 179Case Study: Satyam 180Three Levers for ERM Oversight 181Conclusion 189Notes 189Chapter 10 The View from the Risk Chair 191Introduction 191Turnaround Story 191The GPA Model in Action 192Top Priorities for the Risk Oversight Committee 192Conclusion 196Notes 197Chapter 11 Rise of the CRO 198Introduction 198History and Rise of the CRO 199A CRO’s Career Path 201The CRO’s Role 202Hiring a CRO 206A CRO’s Progress 208Chief Risk Officer Profiles 212Notes 225Chapter 12 Risk Appetite Statement 227Introduction 227Requirements of a Risk Appetite Statement 228Developing a Risk Appetite Statement 233Roles and Responsibilities 239Monitoring and Reporting 242Examples of Risk Appetite Statements and Metrics 246Notes 250Part Four Risk Assessment and QuantificationChapter 13 Risk Control Self-Assessments 255Introduction 255Risk Assessment: An Overview 255RCSA Methodology 256Phase 1: Setting the Foundation 259Phase 2: Risk Identification, Assessment, and Prioritization 262Phase 3: Deep Dives, Risk Quantification, and Management 267Phase 4: Business and ERM Integration 270ERM and Internal Audit Collaboration 272Notes 273Chapter 14 Risk Quantification Models 274Introduction 274Market Risk Models 275Credit Risk Models 278Operational Risk Models 281Model Risk Management 283The Loss/Event Database 288Early Warning Indicators 289Model Risk Case Study: AIG 289Notes 290Part Five Risk ManagementChapter 15 Strategic Risk Management 295Introduction 295The Importance of Strategic Risk 296Measuring Strategic Risk 299Managing Strategic Risk 301Appendix A: Strategic Risk Models 310Notes 312Chapter 16 Risk-Based Performance Management 314Introduction 314Performance Management and Risk 316Performance Management and Capital 317Performance Management and Value Creation 319Summary 323Notes 324Part Six Risk Monitoring and ReportingChapter 17 Integration of KPIs and KRIs 327Introduction 327What Is an Indicator? 327Using Key Performance Indicators 329Building Key Risk Indicators 330KPI and KRI Program Implementation 335Best Practices 337Conclusion 338Notes 339Chapter 18 ERM Dashboard Reporting 340Introduction 340Traditional Risk Reporting vs. ERM Dashboard Reporting 344General Dashboard Requirements 348Implementing ERM Dashboards 351Avoid Common Mistakes 357Best Practices 358Notes 361Chapter 19 Feedback Loops 362Introduction 362What Is a Feedback Loop? 363Examples of Feedback Loops 364ERM Performance Feedback Loop 366Measuring Success with the ERM Scorecard 368Notes 371Part Seven Other ERM ResourcesChapter 20 Additional ERM Templates and Outlines 375Introduction 375Strategic Risk Assessment 375CRO Report to the Risk Committee 376Cybersecurity Risk Appetite and Metrics 378Model Risk Policy 380Risk Escalation Policy 382Notes 385About the Author 386Index 387