Strategic Risk Management: Improving Your Organization’s Chances for Success RIMS Conference 2012 Philadelphia Two perspectives: IBM Paychex Strategic Risk Management Defined (RIMS) Enterprise Risk Management (“ERM”) is a strategic business discipline that supports the achievement of an organization’s objectives by addressing the full spectrum of its risks and managing the combined impact of those risks as an interrelated risk portfolio. Strategic Risk Management (“SRM”) is a business discipline that drives deliberation and action regarding uncertainties and untapped opportunities that affect an organization’s strategy and strategy execution. Today’s Panel Stuart Horn Director, Enterprise Risk Management IBM Armonk, New York Stuart is Director of Enterprise Risk Management at IBM, in the role since 2008. The ERM program has a global scope over all IBM business lines and internal operations, which reaches 170 countries, over $100B of revenue, and 400K employees. During his 27 years at IBM, Stuart has had experience in application development, IT services delivery, consulting, and business process services interacting and overseeing working operations centers globally. This background provides him the institutional knowledge to implement, align, and customize ERM for IBM's context. Frank Fiorille Director of Risk Management Paychex, Inc. Rochester, NY Moderator Frank is the Director of Enterprise Risk Management at Paychex, a leading provider of payroll, human resource, and benefits outsourcing solutions for small- to medium-sized businesses. The company has more than 100 offices and serves approximately 564,000 payroll clients and 12 million employees nationwide. Fiorille has over 20 years experience in risk management and credit and joined Paychex in 2002 to lead the company’s initiative to build an enterprise wide risk apparatus. John Phelps Director, Business Risk Solutions Florida Blue Jacksonville, Fl. Company Profile • • • • • • Revenue: $107B Operating Net Income: $16.3B Workforce: 433K Countries: 170 Countries Acquisitions: 130 Companies since 2000 Capital Expenditures: $50B over past 12 years IBM’s ERM mission is about enhancing the odds of success Take advantage of the scale and scope of IBM’s globally integrated enterprise to improve performance through enhanced identification and management of enterprise risks. IBM’s ERM Mission Statement IBM’s ERM Mission ERM is an approach to identify, assess and address risk in the Formulation of the Strategy of an Enterprise ERM is an approach to identify, assess and address risk in the Execution of the decided Strategy of an Enterprise ERM is an approach to identify, assess and address risk in the Operations of an Enterprise Doing business in new places and new ways while providing new solutions presents new risks we may be unfamiliar with Risk management is centered in the Business Units, where risk is taken for commercial gain IBM Organization At a Glance Geographies Business Units Processes & Functions HR Opportunity to Order Sales & Distribution (S&D) Major Markets - North America - Europe - Japan Mkting & Comms IT Global Technology Services (GTS) Order to Cash Set the tone to take and manage risks across the business for commercial gain Finance Sales Incentives Software Group (SWG) Legal Growth Markets Business Units Senior Vice Presidents Lead and Own strategic and operational risk management Systems & Technology Group (STG) Global Business Services (GBS) RESO Sales Ops Supply Chain HW Product Mgmt Transformation Service Labor Mgmt Transformation ERM Steering Committee ERM Executive Council Oversee program Effectiveness of risk mgmt Cross enterprise collaboration ERM reports to CFO, but takes an enterprisewide view of strategic and operational risks CEO CFO Strategy General Counsel Chief Trust & Compliance Officer BU CFO CFO, S&D Tax General Auditor Chief Risk Officer Corporate Development Treasury Controller CFO, STG CFO, SWG Enterprise Risk Mgmt Financial Risk Assess Pension Fund Risk & Insurance Management Corporate Business Controls Enterprise Risk Mgmt Department (3 Headcount): • Supports the ERM Steering Committee and Executive Councils in assisting the business in identifying and managing enterprise level risks • Sets standards for ERM assessment & reporting • Integrates risk with strategy & execution • Institutionalizes ERM knowledge CFO, GBS CFO, GTS Setting the context for ERM is important and unique to each company Recognizing emerging risks provides value by driving business change Exiting Businesses Setting Strategic Direction Acquisitions Operating PTI / EPS * $13.44 Operating PTI / EPS * Shifting market mix to enable growth $13.44 Segment Operating PTI Operating EPS Segment Operating PTI Operating EPS BRIC country revenue up 16% (constant currency) Growth Markets are 22% of Geographic Revenue (constant currency) '00 '01 '02 '03 '04 '05 '06 Hardware / Financing '00 '01 '02 '03 '04 '07 '08 '05 '06 '07 '09 '10 '11 Software Services '08 '09 '10 '11 * Non-GAAP: Excludes acquisition-related charges and non-operating retirement-related charges 2000 & 2001 segments not restated Hardware for stock based compensation; 2000-2010 Segment PTI is reclassified to conform with 2011 operating presentatio Software / Financing Services Sum of external segment pre-tax income not equal to IBM pre-tax income * Non-GAAP: Excludes acquisition-related charges and non-operating retirement-related charges 2000 & 2001 segments not restated for stock based compensation; 2000-2010 Segment PTI is reclassified to conform with 2011 operating presentatio Sum of external segment pre-tax income not equal to IBM pre-tax income Risk Management is explicit in Board & Executive responsibilities Proxy Statement General Information – Board of Directors …The Board is responsible for overseeing management in the execution of its responsibilities and for assessing the Company's approach to risk management… … an overall review of risk is inherent in the Board’s consideration of the Company’s long-term strategies and in the transactions and other matters presented to the Board... … the Board's three committees, each of which examines various components of enterprise risk as part of their responsibilities… Executive Compensation Section of the IBM Proxy …motivate our leaders to deliver a high degree of business performance without encouraging excessive risk taking; …emphasis on longer-term financial success and prudent risk management… …our compensation program and policies do not encourage excessive risk taking… Risk is an integral part of IBM’s Business Leadership Model Anticipate and prepare for Consider risk in the formulation of strategy managing risk in execution Integrate risk actions into management systems Supplement market insight with external risks, challenge the innovation process, question assumptions, and assess the viability execution Marketplace assumptions, Client priorities, Technology shifts Marketplace Insight • External risks • Migration of client value risks • Competitive risks Innovation Focus • Identify & cover discontinuities • New risk take-over offerings Business Design Alternatives Execution • Capabilities required to effectively manage the risks inherent in the business design Corporate strategy and growth priorities guide the business unit strategies & execution Strategy Cycle Strategy cycle emphasizes risks associated with enterprise initiatives and achieving growth Consider new risks which may emerge in the pursuit of growth strategies Identify other key risks that could be obstacles to achieving unit’s objectives Cross-business unit interdependencies Execution Cycle Execution cycle emphasizes risks associated with execution of strategy Risk associated with the execution of strategies, actions to manage them, and metrics for measuring the effectiveness of the actions Provide discrete allocation of funds or resources (as appropriate) Cross-business unit interdependencies Scenario-based analysis to test and improve flexibility and resiliency Scenarios where the company exceeds or misses performance objectives Consider external risk factors, business context, and unit interdependencies Identify upside opportunities where we can help clients address the risk Problem Statement • Identify Risks • Define potential outcomes: likelihood of occurrence, timeline and implications on the market and our business Scenario Modeling • Develop scenarios based off range of outcomes • Size business and financial implications • Prioritize scenarios based on likelihood and size of impact Response • Preventative actions to manage risk • Responsive actions should scenario materialize • Both proactively and reactively under different conditions Management Actions • Recommend next steps • Immediate actions • Management system to monitor, determine future action Summary • Inform strategy with consideration of risk – Understand the risks the company can and should take on and how to be appropriately compensated for taking on those risks • Prepare to manage risk in the execution of strategies – Identify additional actions to take to improve the chances of success • Manage risk in ongoing operations – Are there process changes or standards that should be set or augmented or are there opportunities to collaborate on best practices to increase uniformity • Provide value – Keep line of sight to the elephants and gorillas in the room – Enhance strategy effectiveness by engaging cross-enterprise to address interdependencies and take advantage of scale – Transparency of risks and effective management enables greater appetite and tolerance in pursuit of commercial gain Paychex Profile • Provider of comprehensive payroll, human resource, and benefits outsourcing solutions for small to medium sized businesses • Approximately 564,000 clients • More than 100 offices nationwide 17 Board & Executive Engagement Company Strategy “We are focused on achieving strong, long-term financial performance by…” “Our future results of operations are subject to a number of risks and uncertainties. These risks and uncertainties could cause actual results to differ materially from historical and current results and from our projections…” Corporate Governance “…lead the Board, particularly as it focuses on strategic risks and opportunities facing the Company.” Risk Oversight “One of the functions of the Board is oversight of risks inherent in the operation of the Company’s business. The Board fulfills this function through reports from officers for oversight of particular risks within the Company, through legal review of the Company’s strategic plan, and through delegation of certain risk oversight functions…” Strategic Risk Management • A comprehensive process to identify, evaluate and manage strategic risks to reduce uncertainty AND maximize opportunities • Guiding Principles of SRM: – – – – – Primary component of an organization’s ERM process Ultimate goal is protecting and enhancing shareholder value Effected by boards of directors, executive management and others A strategic approach to risk and managing uncertainty is necessary to achieve company objectives Continuous process Related Impacts Interdependencies Identify Assess Analyze Corporate Tolerance Risk/Opportunity Risk Profile Informed Decisions Align to Corporate Objectives Adapt/Improve Mitigate/Control Monitor/Report Frequency & Severity Retain/Finance Or Transfer Establishing Context Setting strategy, objectives, tone, policies, risk appetite and accountabilities; monitoring performance. Identifying and assessing risks that may affect the ability to achieve objectives; determining risk response strategies and control activities. Extended Enterprise & Value Chain 20 Operating in accordance with objectives; ensuring adherence to laws and regulations, internal policies and procedures, and stakeholder commitments. Strategic Risk Management Process New Strategy & Risks Maximizing return on capital Business Planning & Strategy Long term growth in shareholder value Risk Strategy Capital Management, Business Performance Monitoring Economic Capital Allocation Maximizing operational cost effectiveness Regulatory Capital Calculation Corporate governance Risk Identification & Assessment Risk Framework, Control & Monitoring Operational & Change Mgmt (Systems, Processes, People) 10 Projects (Objectives, Resources, Risk, Capital) Market, product, customer, operational strategy New ventures, risk/capital impact Optimizing volume and profitability Why Integrate ERM with Strategy? “Paychex, like most firms, makes money and creates value by taking intelligent risks and loses money or gets in trouble by failing to manage risk effectively.” 22 Paychex Strategic Process External Pressures Shareholder Expectations Regulators Rating Agencies Stakeholders Board of Directors Internal Forces “Enabling Activities” Information C u l t u r a l O b j e c t i v e s S t r a t e g y A p p e t i t e T o l e r a n c e Risk ERM Process Opportunity Protect and Enhance Shareholder Value E t h i c s Guidance P o l i t i c a l Paychex Profile • Provider of comprehensive payroll, human resource, and benefits outsourcing solutions for small to medium sized businesses • Approximately 564,000 clients • More than 100 offices nationwide 24 Board & Executive Engagement Company Strategy “We are focused on achieving strong, long-term financial performance by…” “Our future results of operations are subject to a number of risks and uncertainties. These risks and uncertainties could cause actual results to differ materially from historical and current results and from our projections…” Corporate Governance “…lead the Board, particularly as it focuses on strategic risks and opportunities facing the Company.” Risk Oversight “One of the functions of the Board is oversight of risks inherent in the operation of the Company’s business. The Board fulfills this function through reports from officers for oversight of particular risks within the Company, through legal review of the Company’s strategic plan, and through delegation of certain risk oversight functions…” Strategic Risk Management • A comprehensive process to identify, evaluate and manage strategic risks to reduce uncertainty AND maximize opportunities • Guiding Principles of SRM: – – – – – Primary component of an organization’s ERM process Ultimate goal is protecting and enhancing shareholder value Effected by boards of directors, executive management and others A strategic approach to risk and managing uncertainty is necessary to achieve company objectives Continuous process Related Impacts Interdependencies Identify Assess Analyze Corporate Tolerance Risk/Opportunity Risk Profile Informed Decisions Align to Corporate Objectives Adapt/Improve Mitigate/Control Monitor/Report Frequency & Severity Retain/Finance Or Transfer Establishing Context Setting strategy, objectives, tone, policies, risk appetite and accountabilities; monitoring performance. Identifying and assessing risks that may affect the ability to achieve objectives; determining risk response strategies and control activities. Extended Enterprise & Value Chain 27 Operating in accordance with objectives; ensuring adherence to laws and regulations, internal policies and procedures, and stakeholder commitments. Strategic Risk Management Process New Strategy & Risks Maximizing return on capital Business Planning & Strategy Long term growth in shareholder value Risk Strategy Capital Management, Business Performance Monitoring Economic Capital Allocation Maximizing operational cost effectiveness Regulatory Capital Calculation Corporate governance Risk Identification & Assessment Risk Framework, Control & Monitoring Operational & Change Mgmt (Systems, Processes, People) 10 Projects (Objectives, Resources, Risk, Capital) Market, product, customer, operational strategy New ventures, risk/capital impact Optimizing volume and profitability Why Integrate ERM with Strategy? “Paychex, like most firms, makes money and creates value by taking intelligent risks and loses money or gets in trouble by failing to manage risk effectively.” 29 Paychex Strategic Process External Pressures Shareholder Expectations Regulators Rating Agencies Stakeholders Board of Directors Internal Forces “Enabling Activities” Information C u l t u r a l O b j e c t i v e s S t r a t e g y A p p e t i t e T o l e r a n c e Risk ERM Process Opportunity Protect and Enhance Shareholder Value E t h i c s Guidance P o l i t i c a l The Paychex ERM Framework Paychex ERM Framework Mission: Protect and enhance shareholder value Infrastructure Vision/Goals Governance Oversight structure Common language Policies Technology Tools Techniques Tolerance/appetite Monte Carlo simulation Integration Process Identify Risks & Opportunities Assess Risks & Opportunities Monitor & Report Results Business goals, objectives and strategies Integrate Results Develop Action Plans Operational processes Strategic planning Quality process Competency models Product development Capital projects Performance management Implement Strategy Culture: Enabling Activities: “Become a part of the company’s DNA” •Risk management is recognized as a key contributor to value creation. •Equal attention is paid to both quantifiable and unquantifiable risks. •The risk culture is defined and enshrined to give managers and employees the requisite freedom of maneuver. •Risk management is everyone’s responsibility and is not fragmented into compartments and silos. •An awareness of risk and the need to manage it pervades the enterprise. •The enterprise avoids products and businesses it does not understand. •Scenario planning embraces uncertainty and considers all possible developments. •Risks are identified, reported, and quantified to the greatest possible extent. 31 Environmental Scan •Credit Default •New or Foreign Competitors •Shareholder Activism Financial Risks •Liquidity/Cash •Interest Rate Fluctuations •Counterparty Risk •Revenue Management •Currency/Foreign Exchange Rate Fluctuations •Asset Valuation •Business Acquisitions/Divestitures •Economic Recession •Inadequate/Inaccurate Financial Controls/Reporting •Currency Inconvertibility •Adverse Changes in Environmental Regulations •Adverse Changes in Industry Regulations •Accounting/Tax Law Changes •Uncompetitive Cost Structure •Fuel Prices •Tornados •Directors/Officers Liability •3rd Party Liability •Building Subsidence/Sinkholes •Terrorism/Sabotage •Loss of Key Facility •Earthquake •Building/Equipment Fire •Hurricane/Typhoon •Lightning Strikes •Volcano Eruption •Building Collapse •Cargo Losses •Flooding •Hail Damage •Boiler/Machinery Explosion •Geopolitical Risks •Cargo Losses •Severe Hot/Cold Weather •General/Product Liability •Animal/Insect Infestation •Asbestos/Mold Exposure Hazard Risks 32 •Market Share Battles •Public Boycott or Condemnation •Pricing/Incentive Wars •Technology Decisions •Seasonality/Variability •Ineffective Planning •Foreign Market Protectionism •Customer Demand •Program Launch •Mergers/Industry Consolidation •Attacks on Brand Loyalty •Product Market Alignment •Product Design/Engineering •Union Relations/Labor Disagreements/Contract Frustrations •Product Development Process •Ethics Violations •Customer/Supplier/Dealer Relations •Budget Overruns/Unplanned Expenses •HR Risks – Key Skill Shortage, Personnel •IT System Failure – Hardware/Software/LAN •Deductible Limits •Property Damage •Workers Compensation •Wildfire •“Gotta Have Products” Enterprise Risks •Land/Water/Atmospheric Pollution •Disease/Epidemic •Offensive Advertising •Loss of Intellectual Property •Timing of Business Decisions/Moves •Equipment/Facilities •Transaction Processing Errors •Corporate Culture •Inadequate Management Oversight •Health Care/Pension Costs •Debit/Credit Rating Strategic Risks •Negative Media Coverage •Financial Markets Instability •Tsunami •Blizzard/Ice Storms/Wind Damage •Heavy Rain/Thunderstorms •Computer Virus/Denial of Service Attacks •Extortion •Warranty/Product Recall Campaigns •Turnovers •Operator Errors/Accidental Damage •Kidnapping •Health/Safety Violations •Theft/Embezzlement •Loss of Key Equipment/Personnel •Vandalism •Accounting/Internal Controls Failures •Information Management Problems •Harassment/Discrimination •Arson •Workplace Violence •Utilities Failures – •Gov’t Inquiries Communications, Electricity, •Dealer Distribution Water, Power Network Failures – Logistics Provider Failures, Logistics Route/Mode Disruptions •Joint Venture/ Alliance Relations •Perceived Quality •Service Provider Failures •Restriction of Access/ Egress •Supplier Business Interruption •Loss of Key Supplier •Tier 1,2,3 – Supplier Problems, Financial Trouble, Quality “Spills”, Failure to Deliver Materials Operational Risks Identify & Assess Risk Interactive Risk Assessments Identifying the effectiveness of processes and controls via interactive participation with subject matter experts. Step 1: Pre-work: Step 2: Workshop Failed Processes Internal Fraud Vendor Failure Failed Systems Human Error Operating Risk • Business unit identifies risks associated with operational errors. • Step 3: Mitigation Step 4: Results Voting technology is utilized to score/rank the risks 5 Assurance of preparedness Impact 2 9 4 Impact Enhance risk mitigation 7 15 3 3 Redeploy resources 6 12 8 4 5 10 1 Measure for cumulative impact 14 13 11 2 Likelihood • Top-ranked risks are identified and reviewed to assess counter-measures 1 2 3 Vulnerability 4 5 • Key risks are identified and better understood creating awareness and accountability 33 Dimensioning Risk Inherent Risk Residual Risk Inherent Risk = Impact x Likelihood Residual Risk = Inherent Risk x Uncontrolled Management Effectiveness High Critical High Under-controlled Risk 1 Risk 1 Risk 2 Risk 2 Risk 7 Risk 3 Risk 3 Risk 4 Risk 4 Inherent Risk Risk 8 Impact Risk 5 Risk 6 Risk 10 Risk 9 Risk 5 Risk 6 Risk 7 Risk 8 Risk 9 Risk 10 Nominal Over-controlled Low High Low Likelihood High Management Control Effectiveness Risk Velocity Slow Average Fast Methodology – Top enterprise level risks are dimensioned using a proprietary 10 factor probability risk scoring formula. Risk velocity is incorporated and weighted in the calculation of inherent and residual risk to represent how quickly the onset of each risk measured translates to impact. 34 Risk Scenario Planning “The present moment used to be the unimaginable future” Possible - “might” happen (future knowledge) Probable - “likely to” happen (current trends) Plausible - “could” happen (current knowledge) Preferable - “want to” happen (value judgements) Ranges of Usefulness U Uncertainty F S H Predictability Forecasting Scenario Planning Distance into the future “Hoping” time Key Risks Detail 1. Credit/ACH 2. Risk Description Risk of financial loss due to client defaults, dependencies on banking partner lines of credit, NACHA rules/regulations, unsecured credit and reliance on ACH as vehicle for collection and recovery Regulatory Compliance Risk Description Maintaining compliance for all products and services with applicable federal, state and local statutes, laws and regulations; ensuring timeliness and accuracy of regulatory change on Paychex platforms Primary Organization Owner(s) - Risk Management Primary Organization Owner(s) – Risk Management Risk Type - (K) Known Risk Type - U1 (Unknown) Primary Indicators Bad debt write-offs, National Economic Indicators, ACH return regional/industry factors, credit agency reporting CEI/DSO indicators Primary Indicators Regulatory activity, laws enacted, warranties/penalties, lawsuits, enforcement activity, regulatory inquiries activity, Mitigation Strategies •Branch and client transaction thresholds •Credit bureau monitoring; consumer and commercial credit review •Credit policies, including secured funding and security deposits •Monitoring for credit deterioration, industry/economic data and bankruptcy •Allowance for doubtful accounts (reserve) •Fraud industry coalition Mitigation Strategies •Monitoring enforcement trends, relevant publications and industry news •Strong regulatory agency relationships •Active participation in Payroll Consortium •Ongoing review and audit of compliance •Increased training for applicable personnel •Change management control process Trending - Small businesses continue to hold course even though threat of a doubledip recession is starting to look more plausible. Access to credit continues to be elusive for many struggling businesses as evident by the SBA adding “extra support” to lenders to boost loan approvals; however, SBA-backed loans make up only a small portion of over all business loans market. Balance sheets have improved as businesses continue to deleverage due to caution about the future economic outlook and legislative landscape. Trending - Increasing pre-election pressures on the administration and Congress around lingering economic weakness and the debt ceiling may result in ad-hoc measures requiring compressed implementation timeframes. Debt ceiling legislation does not include a payroll tax reduction, but a push for an extension of the current employee payroll tax reduction through 2012. The Obama jobs proposal contains aspects which, if enacted, could present operational and systemic challenges, with a reduced implementation period. Results - While soft credit risk exposure has nearly doubled over the past several years to over $266 billion dollars, credit losses are down 82% from approximately $11 million to just $2.0 million last year. Results - Despite the extraordinary environment of accelerated legislative changes under the Obama administration heightened by the recent recession, Paychex has been able to execute required changes with minimal to no adverse impact. 36 ERM Dashboards Providing the Board and senior management with greater risk transparency Compliance with risk policies and regulations • Exposures vs. policy limits • Regulatory compliance Earnings-at-risk • Major internal drivers • Key external variables Risk/return performance tracking • Business units • Customer segments • Products Real time risk reporting • One touch visibility • Drill down capabilities • 24x7 escalation • Early warning signals Value Preservation to Value Creation The discipline of risk management has evolved from strictly a value preservation-based focus to a balanced focus between protecting assets and creating or enhancing value. A flexible and dynamic risk management discipline is uniquely positioned to quickly adapt to change and identify opportunistic risk to create new streams of revenue and increase value Model Risk Risk Management •Target Models (3B); Lifetime Value Models •Churn Models; Discount Engine Models •Upsell Models; Sales Territory Models Entrepreneurial Risk •$100M Revenue Over Past 5 Years •EGTRRA Restatement •PBS, HRO, 401(k) Service Fees Regulatory Compliance Risk •Public Relations & Marketing Initiatives •Industry Coalitions •Client/CPA Webinars Credit Risk Operating Risk Future/White Space •EDI Program •RCX Stale Date Fees •Taxpay Premium Processing Fee •Federal Deposit Frequency Program •Client Penalty Abatement Service •IRS/Paychex Partnerships Questions?