Norman:

Here's my perspective.  Nothing in this world is static - business conditions change continuously.  Therefore, one of the main tenets of "effective" would have to include the ability of risk management to adapt to changes within the business conditions an organization faces. 

While frameworks, tools and strategies will help risk managers mature the practice of RM within an organization, effectiveness does not necessarily need to be a formalized set of policies and procedures.  Rather, I would argue, a consistent understanding across the organization of what risk management is (and isn't), coupled with a culture of continually assessing the potential impacts of changing business conditions and the management responses needed as a result, makes a solid foundation on which to build an "effective" risk management process.

Thanks for the interesting article!

 Very good question you pose.

I tend to agree more with the view that the effectiveness of the process is related to quality of the outcome/deliverable?

I would focus especially on the ongoing management of the controls/mitigations that have been identified (ensuring that these have in fact been implemented and they actually work as intended).

Learning from near misses and the continued improvement of the process would also be features of an effective process.

To your original question of how to determine whether the organization's risk management process is effective, my answer would be that you would have to (be able to) independently confirm whether all important uncertainties to the organization achieving its objectives are managed down to what is deemed to be the appropriate level, in the most cost-effective way.

The most important reason that this is typically easier said than done is that, oftentimes, there will be very limited visible (and therefore verifiable) information on what all of the different variables are in this short sentence. So what exactly are the most important objectives, what are the relevant uncertainties and what is the most cost-effective way. Anyone?

To me then, the challenge lies in getting management to carefully articulate these variables, including the 'managed' part, and this will be the starting point for not only auditing, but more importantly, improving the state of risk management in an organization.

Criteria for an effective risk mgmt program:

1) Objectives are clearly defined, measured and aligned for the enterprise and business units.  COSO: "Objective setting is a precondition to risk assessment."  Metrics would be "drivers" (e.g., number of subscribers at a magazine) and not "results" like profit.

2) Key risks to realizing these objectives are identified. Risks can be internal or external, conditions or events.

3) Risks identified are prioritized by mgmt in accordance with some a methodology that considers likelihood and magnitude, or leverage and volatility. Contrary scenarios and assumptions are considered.

4) Responses are identified that management considers effective in managing the risks within tolerance.

5) Parts 1-4 are reviewed with the Board (strategic & operational risks) or Audit Committee (financial & compliance risks).

6) Effective monitoring of progress towards the objectives occurs. The extent to which risks are affecting progress are discussed.

7) Incentives are aligned with these metrics and discounted based on the degree of risk taken by the firm, business unit or individual.

8) Continuous improvement mechanisms are in-place.

Mark:
I agree 100% with you that the criteria to determine when a process is "effective" should be agreed with senior management and, and I repeat the word "and", the board.

Many board members when surveyed have stated that a priority outcome from an IA function is "no surprises".  I believe that an "effective" risk management system should strive to deliver no significant surprises where surprises are defined as risks that have the potential to materially impact the value of the entity. If senior management and the board are aware of areas of high retained risk and have decided to accept the retained risk it shouldn't come as a surprise if a negative identified risk outcome occurs.  If estimates of frequency/severity/consequence/liklihood used to base the decision are proven to have been materially wrong at the time the original risk acceptance decision was made, the risk management process should be reevaluated.

I encourage IA departments to survey senior executives and the board to seek agreement on the criteria to define what constitutes  "effective" risk management.  Once the criteria, including desired performance metrics are agreed, an audit of an organization's risk management processes will be a much easier next step.

Good question and some thoughtful responses but nobody has mentioned the international standard, ISO 31000: 2009 Risk Management – Principles and guidelines. This sets out 11 principles for effective risk management as described by an international committee representing diverse management activities. It also sets out an agreed risk management process and other guidance. Electronic copy of the standard can be bought from the Standards New Zealand website (look for AS/NZS ISO 31000: 2009).

In 24 pages it so much more than the ERM documents from the USA.

We all believe that there are state owned enterprises. must they practice best corporate governance and if so, are the issues of remuneration, disclosure hence transparency, laws ,policies and regulations be in the interests of the public and the tax payer?

What is corporate practice in a state owned enterprise and how must it be assessed?

Charles, you make an interesting point. I have only seen studies that show that having a risk management process adds value by increasing share price, enhancing results, and improving resiliance. I have not seen any studies that show that risks are actually reduced.

All I can say is that everybody who has a solid risk management process in place believes in it. Their experience is that it works by reducing the likelihood of an adverse event (e.g., at SAP we have withdrawn from $100m of bad deals in the last year) or reducing the potential impact of that adverse event.

The only way to determine whether the risk assessment is accurate is to decide not to take any action and see what will happen - and people don't do that unless the risk is within their tolerance levels.

Charles,

You raise interesting points. In many ways we are facing the challenge of building a bridge to Governance transparency needs, from organizational operations. We have lots and lots of great building materials, and many experts yet we have not found the lasting bridge design.  We have engineers (Management) and analysts (Auditors). Engineers who are experts at building things and Analysts who can critically value and report.

In my mind we the Analysts are still emerging from a traditional skill set focused on valuing completed bridges against external standards. We are unfamiliar with the process of building bridges. We are just now coming to a broad recognition that we have to better understand engineering processes. (After all risk management is about managing and acheiving business objectives). The value will come in helping the engineers take the next best step. This thrusts the analyst into an unknown world of defining best practices and standards around strategic development, objective implementation, people, process and technology maturity-all the while maintaining independence.

In my mind, risk management will never be fully effective until we have incorporate standards for measuring good management as part of the process. This is where the capability maturity model has such promise. If we can capture the maturity of people, processes and technology along a standard spectrum we have created a way to communicated vulnerability to management. Risk Management is one part vulnerability awareness, and one part risk identification...