Question

In light of the recommendations for organizational strategic approach, what are four critical gaps linking strategy and risk for board members?

Answer 1

early 1990s as an extension of hazard risk management. It argues that an organization should manage enterprise risks in a single, comprehensive program.

RISK VERSUS UNCERTAINTY

 Risk. Something that we attach to a probability. In many cases, we can also calculate or estimate the financial cost or benefit.

 Uncertainty. Something that can go wrong without an understanding of the consequences, likelihood, or cost or benefit.

ERM raises issues about risk tolerance. How much risk are we willing to take? Which risks are we managing? Which risks are unbearable? Which are important? Which are unimportant? ERM became an organizational priority to identify and manage new exposures. ERM became a buzzword on the lips of CEOs, CFOs, members of boards of directors, and shareholders. Everybody understood that ERM was important. The question confronting organizations was how to get it right.

By 2005, ERM had bogged down. Still, many risk observers pushed a strong ERM agenda. They recognized the logic of coordinating the management of risk. So why did ERM implementation stall? The answer starts with several definitions of ERM.

ERM Defined

Enterprise risk management is a broad and complex concept that reaches into every major area of an organization. As such, it is not surprising that many definitions of ERM have been offered. These definitions fall into three categories. A strategicdefinition focuses on results, as ERM is expressed in terms of organizational objectives. Afunctionaldefinition describes ERM in terms of activities that reduce risk. A process definition focuses on actions undertaken by managers to manage risk. A consensus definition might look something like this:

GENERAL MOTORS INVENTORY

As organizations reach maturity, they can no longer depend on a rapidly growing market for goods and the continuation of the business that made them successful. They must seek new approaches to operations to increase their success in managing life cycle risk. The following discussion involves Bo Andersson and his experience at General Motors Corporation. It provides a good story about modern risk management.

In 2001, Bo Andersson became the top purchasing manager at GM. When he arrived, he realized that GM was spending $85 billion on car parts each year, purchased from 3,200 suppliers. He also learned that GM had separate engineering for almost every type of vehicle it produced. Vehicles did not share common parts. Seat frames were an example of a particularly interesting subculture feature. They were expensive, partly because GM had 26 different seat frames. Toyota had only two.

A similar situation existed with V6 engines. Once again, GM had high costs because it had 12 V6 engines, whereas Toyota and Honda had two each. What about fuel pumps? GM had 12. Toyota and Nissan had two.

Moving on, Bo Andersson addressed the rather simple topic of door hinges. He learned that they could be made out of three pieces instead of five. Making the change would save $100 million annually. He had a subculture response. Engineers and designers debated the change for more than three months. Then they reluctantly began a lengthy process of design and testing for the new door hinges.

After studying the situation to be sure he understood it, Bo Andersson identified the design and purchasing problems and brought them to the attention of the engineers who worked in manufacturing. His arguments were carefully framed, but they were not well received. The different units did not support changes, arguing that a change in one component would have ripple effects throughout the entire line of automobiles. In the end, change came slowly over the period from 2001 to 2006 (BusinessWeek, July 31, 2006).

Lessons Learned: GM lacked a modern risk management approach to internal manufacturing. Production efficiency lagged badly while GM failed to make desperately needed changes to be competitive. GM needed ERM. One additional note: The GM situation is also a failure of leadership risk. This is covered in Chapter 14.

Enterprise risk management is the process of identifying major risks that confront an organization, forecasting the significance of those risks in business processes, addressing the risks in a systematic and coordinated plan, implementing the plan, and holding key individuals responsib