In ERM terms, the first course is identifying current and emerging risks. The identification process often starts on a small scale, with face-to-face interviews. Groups of key managers and staff are asked about root causes and drivers of risks in their particular areas.

Next, the ERM team will look at any connected risks that might affect multiple departments. The review may increase in complexity. The company can conduct surveys, review news, and retain experts and consultants. A harvest of potential risks will be gathered, sliced and diced, and main groups of risk bucketed and blended. Even the smallest tidbits of information gleaned here can reveal patterns and trends of loss not previously appreciated.

This is a fundamental step, designed to form the basis for the entire ERM plan, and can whet the appetite for future ERM work. Often, participants get their first real taste of the magnitude and financial impact of risk in such interviews. As new ideas and risks come to light, participants may begin to realize how vulnerability in their areas of responsibility can impact the company on a greater scale. New, interesting flavors are added to responsibilities already on their plates.

The identification course also can introduce a “theme” for the overall ERM project. The company begins to educate all staff about ERM principles early in the process. The instructions given, the questions and answers elicited, and the information gathered can leave an impression. With care, that impression will be that the company is serious about risk management, sees ERM as a collaborative effort, and is committed to developing a sustainable, long-term approach. ERM is not fast food.

Salad: Metrics Assess Frequency/ Severity

The salad adds something the main entrée itself may lack—flavor, texture, color, or nutritional base. Salads complement the dining experience.

Metrics could be considered the “salad” of ERM—something that complements and completes the risk-analysis process. A company that has catalogued its risks and established some controls to manage them has accomplished a major step toward mitigating future losses. But it is not quite enough.

Adding the step of developing metrics allows a company to rank risks and prioritize resources and activities around the most dangerous risks and most beneficial controls. It provides objective, quantitative measurements of specific risks against an organization's risk appetite—the statement of a company's willingness to assume a degree of risk in pursuing opportunities.

In this phase, companies assess the frequency of a potential risk—how often could an event happen? They also measure severity—how bad could it be? Other metrics can also be used, such as the duration of an event or loss and the development time for that risk or loss.

A key feature of any ERM program is to set standard scales/metrics for evaluation of different kinds of risk across different business divisions so they can be compared on an “apples-to-apples” basis.

The Sorbet: REPORTING & MONITORING

Serving sorbet between courses cleanses the palate and freshens a taster's perspective. ERM programs must also have planned pauses for participants to evaluate prior work.

The world of risk is constantly changing. In ERM, risk reporting and monitoring will be scheduled on a regular basis, so that risks can be reviewed, re-ranked and controls tested. Risks become more or less significant to a company over time, while others are newly identified. Building time into the overall process to appreciate what has passed, address needed changes and prepare for the next course refreshes perspective on risk.

The Main Course: Setting Effective Controls

A well-planned main dish is the heartiest course and the highlight of a meal. ERM's main course is effective controls. It is the ultimate goal of an ERM program to establish a suite of specific techniques, policies and procedures to reduce or mitigate identified risks as much as possible. While they won't operate to eliminate 100 percent of all risk, well-developed, sustainable controls will have a direct financial impact on a company.

Controls can make or break a company, as is being recognized by such industry gourmet critics as regulators and shareholders.

Dessert: Strategic Analysis

From a chef's perspective, dessert can revive the palate or facilitate digestion. For the diner, dessert is pure pleasure. In either case, a superb dessert can make the entire meal truly memorable.

Strategic analysis is the icing on the cake for many ERM programs. Strategic analysis is the process of weighing whether potential gains will outbalance losses in a proposed course of action. Once main controls are established and operating smoothly to mitigate the “downside” of risk, a company can push its analyses to a new level, allowing it to more fully address the “upside” of risk: opportunities.