World Bank Risk Management
Seminar
Enterprise Risk Management
May 19, 2004
James Lam
President
ph: 781.772.1961
jameslam@comcast.net
Enterprise risk management should be
defined as a value added function
Definition of ERM:
“An integrated framework
for managing credit risk,
market risk, operational
risk, economic capital,
and risk transfer in order
to maximize firm value.”
1
ERM is useful because the risks faced
by companies are highly interdependent
Enterprise-Wide Risks
Financial Risks
FX risk in a new
foreign market
Financial
Risk
Business
Risk
Technology and
operations
outsourcing
Operational
Risk
Derivatives
documentation and
counterparty risk
Credit Risk
Associated with
Investments
Market
Risk
Liquidity
Risk
Funding Liquidity
Asset Liquidity
Credit
Risk
Credit Risk
Associated with
Borrowers and
Counterparties
2
The growing acceptance of ERM is
driven by four key forces
• Banks
• Asset Managers
• Energy Firms
• Corporations
Best
Practices
Corporate
Disasters
• Enron
• WorldCom
• Adelphia
• Mutual Funds
Enterprise
Risk
Management
Regulatory
Actions
• S.E.C.
• Sarbanes-Oxley
• Basel II
• Treadway Report, US
• Turnbull Report, UK
• Dey Report, Canada
Industry
Initiatives
3
While regulatory mandates are useful,
don’t let the tail wag the dog
Proactive Approach
Reactive Approach
Current state
CEO
?
?
?
SarbanesOxley
?
?
• Benchmarking
• Gap analysis
• Recommendations
Basel II
Desired state (best
practices or best-in-class
practices)
• Common themes
• Unique standards
Governance
Requirements
New
industry
standards
SarbanesOxley
Basel II
Governance
Requirements
New
industry
standards
4
Over the past decade, CROs have
gained acceptance and prominence
5/00
“This decade's hot
executive is shaping
up to be the CRO.”
5/00
“As interest in
enterprise risk
management grows, so
does the acceptance of
the role of chief risk
officers to manage
such programs.”
5
An ERM framework should encompass
seven key building blocks
1. Corporate Governance
Establish top-down risk management
2. Line Management
Business strategy
alignment
3. Portfolio
Management
Think and act like a
“fund manager”
5. Risk Analytics
Develop advanced
analytical tools
4. Risk Transfer
Transfer out
concentrated or
inefficient risks
6. Data and Technology
Resources
Integrate data and
system capabilities
7. Stakeholders Management
Improve risk transparency for key stakeholders
6
CROs must overcome significant
barriers to success
 Inertia – absence of crisis; general resistance to change
 Lack of management sponsorship or line support
 Episodic initiatives with no long-term vision
 Ineffective and inconsistent risk metrics and reporting
 Insufficient human, systems, and data resources
 Failure to clearly demonstrate “early wins” and sustainable
benefits
 Move too fast or too slow, without addressing change
management issues
7
Case study:
Background
• $1 trillion of
assets under
management
3-Year ERM Program
• Organized Global Risk Forum
• Implemented annual Global Risk
Review
• Automated loss accounting
• Private company
• Decentralized
business culture
• Developed ERM framework
• Implemented intranet-based
Global Risk MIS
• Experienced significant reduction
in loss ratio
8
Early adopters of ERM have reported
significant and tangible benefits
Benefit
Company
Actual Results
Market value improvement
Top money center bank
Outperformed S&P 500
banks by 58%
Early warning of risks
Large investment bank
Global risk limits cut by 1/3
prior to Russian crisis
Loss reduction
Top asset management
company
Loss-to-revenue ratio
declined by 30%
Regulatory capital relief
Large commercial bank
$1 billion regulatory capital
relief
Insurance cost reduction
Large manufacturing
company
20-25% reduction in
insurance premium
9
Ten predictions on the future of
enterprise risk management
1. ERM will become the industry standard
2. CROs prevalent in risk-intensive companies
3. Audit committees will evolve into risk committees
4. Economic capital in; VaR out
5. Risk transfer executed at enterprise level
6. Advanced technologies key to advancement
7. A measurement standard will emerge for operational risk
8. Risk-based or economic reporting becomes standard
9. Risk becomes part of corporate and college programs
10. Salary gap among risk professionals continues to widen
10