Tag Archives: CRO

Immediate Vault Immediate Access

In a Changing World, Questions For the CRO

Posted on by

Before the financial crisis in 2008-2009, many businesses didn’t think of risk as something to be proactively managed. After the crisis, however, that paradigm shifted. Companies began perceiving risk management as a way to protect both their reputations and their stakeholders.

Today, risk management is not just recommended, it is considered crucial to successful operations and is required by federal and state law. The SEC’s Proxy Disclosure Enhancements, enacted in 2010, mandate that organizations provide information regarding board leadership structure and the company’s risk management practices.

buy lipitor online www.mariettaderm.com/wp-content/uploads/2022/08/pdf/lipitor.html no prescription pharmacy

Company leadership is required to have a direct role in risk oversight, and any risk management ineffectiveness must be disclosed.

The CRO’s role

Volatility in the current business environment—a confluence of factors including transfers of power, the world economy and individual markets—is nothing new. Political transitions have always been accompanied by new agendas and shifting regulations, economies have always experienced bull and bear markets, and the evolution of technology constantly changes our processes.

Even so, recent events like Brexit, the uncertainty of a new administration’s regulatory initiatives, and thousands of annual data breaches have contributed to an unprecedented atmosphere of fear and doubt. To navigate this environment, the chief risk officer needs to adopt a proactive risk management approach. Enterprise-wide risk assessments grant the visibility and insight needed to present an accurate picture of the company’s greatest risks. This visibility is what the board needs to safely recognize opportunity for innovation and expansion into new markets.

To grow a business safely—by innovating and adding to products/services and expanding into new markets—risk professionals should not focus on identifying risk by individual country. This approach naturally leads to a prioritization of “large-dollar” countries, which aren’t necessarily correlated with greater risk. Countries that contribute a small percentage of overall revenue can still cause major, systemic risk management failures and scandals.

A better approach is to look at risk across certain regions; how might expanding the business into Europe, for example, create new challenges for senior management?

buy tamiflu online www.mariettaderm.com/wp-content/uploads/2022/08/pdf/tamiflu.html no prescription pharmacy

Are there sufficient controls in place to mitigate the risks that have been identified?

When regional risks are aggregated to create a holistic picture, it becomes possible for the board to make sure expansion efforts are aligned with strategic goals.

Three processes that require ERM

Risk management is an objective process, and best practices, such as pushing risk assessments down to front-line process owners who are closest to operational risk, should be adhered to regardless of the current state of the international business arena.

While today’s political climate has generated a significant amount of media strife, it’s important not to let emotion influence decision-making. By providing the host organization with a standardized framework and centralized data location, enterprise risk management enables managers to apply the same basic approach across departments and levels.

This is particularly important when an organization expands internationally, which involves compliance with new sets of regulations and staying competitive. Performing due diligence on an ad hoc basis is neither effective nor sustainable. Instead, the process should follow the same best-practice process as domestic risk management efforts:

  1. Identify and assess. Make risk assessments a standard part of every budget, project or initiative. This involves front-line risk assessments from subject matter experts, revealing key risks and processes/departments likely to be affected by those risks. For example, financial scrutiny is no longer a concern just for banks. Increased attempts to fight terrorism mean transactions of all kinds are becoming subject to more review. Anti-bribery and anti-corruption processes estimate and quantify both vulnerability and liability.
  2. Mitigate key risks. Connect mitigation activities to the resources they depend on and the processes they’re associated with. ERM creates transparency into this information, eliminating inefficiency associated with updating/tracking risks managed by another department.
    buy stromectol online www.mariettaderm.com/wp-content/uploads/2022/08/pdf/stromectol.html no prescription pharmacy

    Control evaluation is the most expensive part of operations. Use risk management to prioritize this work and reduce expenses and liability.

  3. Monitor the effectiveness of controls with tests, metrics, and incident collection for risks and controls alike. This ensures performance standards are maintained as operations and the business environment evolve. Evidence of an effective control environment prevents penalties and lawsuits for negligence. The bar for negligence is getting lower; technology is pulling the curtain back not only internally but (through social media and news) to the public as well.

Lastly, the CRO role is increasingly accountable for failures in managing risk along with other senior leaders and boards—look no further than Wells Fargo.

How Cybersecure is Your Company?

Posted on by

cyber headlines

It should come as no surprise that security has moved from an afterthought at global organizations to a front-and-center consideration, often involving the CEO and board of directors. Headlines of the world’s largest companies involved in breaches are rampant, and will only increase as organizations accelerate their digital transformation plans and in doing so create lucrative opportunities for bad actors to steal valuable assets. Businesses are inherently interested in making money, and cybersecurity crimes have a significant impact on their bottom line. In fact, it is estimated that cybercrime will cost $2.1 trillion by 2019, according to Juniper Research.

For C-level execs and board members alike, their real understanding of cyber-exposure is too often binary: Are we on the front page of the Wall St. Journal or Not? While this may be an unfair over-generalization for tech-savvy board members, it is clear that cybersecurity is now included in their “fiduciary duties.” With increasing investments going to security software, consultants, and now cyber-insurance, executives and officers must know the risk profile of their digital systems and security service level agreements (SSLAs).

Organizations looking to maintain their competitive edge will take a new approach to security from the first line defenders in the IT department to the boardroom. The quickest and simplest step in moving the right direction must be to answer “How secure are we as an organization?”

The Best Defense is a Good Offense

Forward thinking organizations are appointing board members that have recognized this security paradigm shift and are moving from a defensive to an offensive mindset when it comes to protecting their assets. Some companies, like AIG, Blackberry, General Motors and Wells Fargo are even going so far as to appoint board members with cybersecurity expertise. While it isn’t mandatory that organizations have cybersecurity experts on their boards, the reality is that no board can escape responsibility, and digital threats will only become more a part of daily business life.

Ask the Right Questions

Beyond asking “How secure are we?” board members should ask their CISOs and security professionals whether their resources and budgets are appropriate. While CISOs will likely always ask for more, they need to be able to demonstrate specific holes and needs or anticipate pending regulatory changes specific to their industries. It would also be wise to regularly ask what internal changes have been made in light of developments in the industry. Additional questions that should be asked include:

  • How are you designing a security posture that does not slow down business operations?
  • How do we know that data/IP systems not in our control are safe and secure, such as internet of things (IoT) and cloud?
  • How do we ensure that we are ahead of new regulatory requirements coming down the pike?
  • Who is responsible for security—CISO, CIO or risk & compliance officer?
  • What is our risk score matrix?

Establish a Seat at the Table

For CISOs, this new attention can be a double-edged sword; while the increased visibility of their position could be beneficial to their own importance to the company, their performance will be scrutinized by the highest levels of management.

CISOs and their security equivalents presenting to the board require a persistent seat at the table. Bringing them in just for an annual report will leave many questions unanswered and does not paint an accurate picture of the organization’s risk profile. Continual updates should include both positive and negative developments, which will make budget increase requests more likely when needed.

These experts should also be expected to provide detailed analytics and a tailored executive dashboard that demonstrates the progress made against goals and benchmarks. The sophistication of these dashboards will depend on the board’s expertise but educating these members should be included in any presentation.

Put a Price on it

When taking these steps and bringing security to the forefront of business planning, each board presentation will allow organizations to make security a marketable attribute. Consumers are becoming increasingly fickle about doing business with organizations that have been breached and as a result are looking for assurance that they and their data will be secured. Promoting your organization’s commitment to security can be a valuable asset to the company’s bottom line. Board members can play a significant role in shifting perception and reality in the marketplace and would be wise to ask more questions to get closer to answering “How secure are we?”

Overcoming ‘Balkanization’ of Business Continuity Planning

Posted on by

Fragmentation

To be sustainable, organizations must prepare for crises that occur or risks that crystalize. General responses to those threats include alternative office sites, IT back-ups and communication protocols. As reality demonstrates over and over, it is critically important to have a strong leader in a crisis situation, be it the captain of a ship in a storm, the commanding officer of a platoon under fire or the CEO of a company in turmoil. A cacophony of contradicting orders or disintegration in the line of command is the surest way to increase a disaster’s impact and the time needed to recover.

Instead of creating a strong BCP landscape with clear lines of command and control, however, we more often see “balkanization,” or fragmentation of responsibilities. Business continuity planning, environmental health and safety, operational risk and IT disaster recovery are different teams with overlapping roles and responsibilities for crisis management.

The newest buzzword is resilience, which is discussed in a growing number of articles and lectures and defined as the “ability to bounce back to a normal operating status after a state of crisis.” There are also a number of overlapping areas with the aforementioned functions—and that is just on an intra-company level. The OECD has issued Guidelines for Resilience System Analysis, urging member states to set up resilience management on a country level basis.

Recent private initiatives like the 100 Resilient Cities (100RC) by the Rockefeller Foundation brings resilience management to an urban level. So if a natural disaster hits a major city, thousands of firms, and the city itself, will invoke a patchwork of crisis plans. For a larger disaster, there might also be a national crisis plan. Are there clear lines of command, however? Is everybody aware of what to do? We doubt it.

Modern BCP management does not need more specialization and buzzwords, but coordination of the different functions and initiatives to provide a clear, consistent and timely response. One of the most pressing tasks is establishing a common risk language to ensure that all stakeholders involved in the process have the same understanding. For example: While the 100RC initiative is coining the term CRO for chief resilience officer, the acronym is also widely used as an abbreviation for chief risk officer. So while talking about roles and responsibilities of a CRO, everyone involved should have a clear understanding about which CRO is meant.

100RC also looks at urban resilience in terms of surviving and thriving, regardless of the challenges—be they acute shocks (such as severe weather or earthquakes) or chronic stress (long term unemployment and violent crime)—and it seeks a much wider remit than the traditional concept of resilience as “the ability to bounce back from an event.”

The response is to call for a more coordinated approach working across multiple stakeholders through the chief resilience officer who, according to Michael Berkowitz (President of 100RC) “needs to build connections across not just various departments of municipal government, but across an entire ecosystem of people and places.” This is welcomed, since it is both forward looking and holistic in its approach to solving some of the world’s major issues in the next 20 years. Given that most entities are no longer stand-alone enterprises, but part of an increasing global network of customers, suppliers, regulators and other stakeholders, disaster recovery cannot be handled effectively by an individual member of that network. Instead, the entire group needs to collaborate to create an effective disaster recovery program. A central CRO who coordinates the needs of the various parts of the network seems to be the best way.

While we see this forward looking risk management approach to resilience as a welcome development, it does further complicate interaction between resilience and BCP by muddying command and control and introducing the potential for more stakeholders into an already complex chain. What is required for this to work is very clear planning and, one could argue, the ability for external (such as municipal) CROs to assume command of enterprises under his or her jurisdiction.

As of now, in most jurisdictions it is the responsibility of the CEO and the board to determine and define risk capacity and risk appetite. This leaves little room for outsourcing BCP or resilience planning. The key question, then, is whether a change in mindset and approach is required to enable the development of network-wide recovery solutions, thus overcoming the balkanization of BCP.

Linking ERM and the Insurance Underwriting Process

Posted on by

Enterprise Risk Management (ERM), in one form or another, has been around for almost two decades. The number of publicly traded companies, especially those in highly regulated industry sectors, have been deploying the ERM process primarily because they were pushed (explicitly or implicitly) to do so by the major credit rating agencies, government mandates such as SEC 33-9089 or Dodd-Frank, their internal/external auditors, or members of the board of directors.  No matter where the spark came from, however, the number of companies utilizing the ERM process continues to grow.

CFOs, CROs, and risk managers that have been practicing ERM for years have been incurring the expenses for doing so. As ERM programs mature it might be time to consider, in monetary terms, the value the company and its insurers places on all the work that has been done over the years. CFOs ask questions about return on investment (ROI) all the time – why not about ERM? Linking enterprise risk management and the insurance underwriting process is one approach to produce a tangible result. Because the vast majority of commercial insurance renewals are Jan. 1, CROs and risk managers should consider initiating a discussion with some of their insurers to determine the potential credits for having a functioning ERM program.

Brokers typically represent the vast majority of larger middle-market and Fortune 1000 publicly traded accounts. Brokers start to work with their larger accounts months before renewal dates and assemble a submission package for insurance underwriters. The inclusion of a timely and relevant ERM report to the underwriting submission that demonstrates the changes to the risk profile of the company should make a stronger case for favorable rate considerations for their clients. The general headings that we recommend for discussion within the underwriting submission include:

• Risk organization and governance

• Risk appetite, tolerance and limits

• Risk metrics and measurement

• Risk management process, procedures and controls

• Risk monitoring, reporting and communication

These are the same general areas that insurers themselves are being asked to discuss with their own regulators as part of the new Own Risk and Solvency Assessment (ORSA) soon to be issued by the National Association of Insurance Commissioners. If the broker or insurer does not think that having a functioning ERM program does not merit a price reduction – especially for directors & officers liability insurance – investigate further and dig deeper. Early in the renewal process is a good time for the risk manager, CRO, or CFO to meet directly with underwriters to discuss their ERM from two different perspectives: the amount of rate reduction, or the steps that could be taken to improve the risk profile enough to warrant a premium reduction.

Executive management of a company that adopted and implemented an ERM program five years ago should be considering the return on the investment that the company has made over the years. It will be up to the CFO and risk manager to demonstrate how the ERM process has been used to either change or improve the company’s risk profile from what it had been. We suggest a close working collaboration between the company and their insurance broker to craft an underwriting submission that details the benefits of the ERM program.

The collaboration would also be enhanced by including a company representative such as the CFO on the team, to represent the company in front of underwriters that may be encountering this negotiating tactic for the first time. Since the majority of corporate insurance renewals take place on Jan. 1, initiating a conversation in the summer with the insurance broker(s) involved would not be a bad idea. One caveat however, ERM in one company is not ERM in another. Completing a risk identification and assessment does not an ERM program make.