BUSHOR-1317; No.

of Pages 10

Business Horizons (2016) xxx, xxx—xxx

Available online at www.sciencedirect.com

ScienceDirect
www.elsevier.com/locate/bushor

The challenges of and solutions for

implementing enterprise risk management
John R.S. Fraser a, Betty J. Simkins b,*

a
Former Chief Risk Officer Hydro One Networks Inc., Toronto, Canada
b
Spears School of Business, Oklahoma State University, Stillwater, OK 74078, USA

KEYWORDS Abstract Enterprise risk management (ERM) began to take root in the late 1990s and
Enterprise risk has since become generally recognized as an expectation of good management and
management; corporate governance. However, as evidenced by surveys and research, many com-
Corporate governance; panies still struggle with ERM implementation. This article explores the challenges
Risk; companies face when implementing ERM and offers solutions for firms struggling with
Corporate culture; the concepts and execution. We draw upon Hydro One’s experience in achieving ERM
ISO 31000 maturity as a best practice case study. The company’s ERM methods have been
researched and documented extensively. With over 15 years of ERM success, Hydro
One is an excellent organization to benchmark for ERM best practices.
# 2016 Kelley School of Business, Indiana University. Published by Elsevier Inc. All
rights reserved.

1. The importance of enterprise risk portfolio across the enterprise. Leading the way
management were the Australian/New Zealand Risk Management
Standard 4360, Tillinghast-Towers Perrin, and the
Historically, risk management was viewed very nar- Conference Board of Canada. The Australian/New
rowly and handled separately in silos. Under this Zealand Risk Management Standard was first pub-
fragmented view of risk, businesses focused on lished in 1995 and the Canadian Standards Associa-
specific potential events that could be insured tion (1997) soon followed with its version that
against (e.g., property, safety, health). In financial added ‘communication’ and ‘consultation’ to the
areas, the focus was on interest rate risk, currency framework (CAN/CSA-Q850-97). The Australian/
risk, or commodity risk (Kloman, 2010). In the mid- New Zealand Standard was then re-issued (Stand-
1990s a number of publications began advocating ards Australia/Standards New Zealand, 1999) with
to businesses that risk management should include updates, including the Canadian additions.
all risks, not just specific ones that are easier to The 1990s saw an increased emphasis on gover-
quantify, and that risks should be managed as a nance, risk, and control, with several important
publications moving forward the concepts of gover-
nance and risk management. These included
* Corresponding author the Group of Thirty report (USA), CoCo (the criteria
E-mail address: [email protected] (B.J. Simkins) of control model developed by the Canadian

0007-6813/$ — see front matter # 2016 Kelley School of Business, Indiana University. Published by Elsevier Inc. All rights reserved.
http://dx.doi.org/10.1016/j.bushor.2016.06.007
BUSHOR-1317; No. of Pages 10

2 J.R.S. Fraser, B.J. Simkins

Institute of Chartered Accountants), the Toronto the challenges many organizations experience in
Stock Exchange Dey report (Canada), and the Cad- attempting to implement ERM, as well as why this
bury report (UK). During this period, many thought leads to frustration and failure or ineffective re-
of enterprise risk management (ERM) as just another sults. We then provide highlights of proven solutions
flavor-of-the-month management technique, espe- and suggestions, referencing additional guidance
cially since it was often consultants who pushed for materials to assist implementers of ERM.
it–—with their guidance, of course.
ERM has come a long way since we began re-
searching the topic at the beginning of this century. 2. The challenges
Much has been written about it and the concepts are
now well enough entrenched that ERM is likely here This section discusses challenges we have observed
to stay. Many misconceptions exist about ERM, how- in companies trying to implement ERM. We have
ever, such that someone starting on the implemen- identified these challenges–—including misconcep-
tation journey is likely to be confused. Furthermore, tions, implementation challenges, corporate gover-
a number of additional drivers for ERM have nance, and external challenges–—through our own
emerged: rating agencies (particularly Standard experience, research, analysis, and conversations
and Poor’s and Moody’s, which include assessments with risk executives. The challenges represent ob-
of ERM in their methodologies); regulators; and, in stacles to success.
the United States, the Committee of Sponsoring
Organizations of the Treadway Commission (COSO), 2.1. Misconceptions
which in 2004 developed its own ERM framework,
lending credibility to the concept of ERM among U.S. In our article Ten Common Misconceptions about
management and boards. Enterprise Risk Management (Fraser & Simkins,
The credit crisis of 2008/2009 demonstrated 2007), we described many of the misconceptions
that risk management was weak in many compa- about ERM that were then limiting organizations’
nies. As a result, financial regulators now promote abilities to implement ERM. Based on our research to
ERM to help manage risks and to demonstrate that date, we do not believe that–—in the last decade–—
they are taking action. Given this momentum, one much progress has been made in overcoming these
would expect that ERM would now be widely issues.
adopted, practiced, and entrenched. Unfortu-
nately, however, the lack of progress has been 2.2. Internal challenges
disappointing. Recent surveys demonstrate that
only about 25% of large organizations claim to We next discuss eight internal challenges we have
have ERM in place (Beasley, Branson, & Hancock, observed in implementing ERM. These are: (1) cor-
2015). Some organizations have tried and failed; porate culture, (2) boards of directors’ knowledge,
some are still trying to get started; and many of (3) not applying a KISS mindset, (4) training without
those who start are struggling and doing only a having risk workshops, (5) identifying too many
partial job. risks, (6) no timeframes, (7) not making ERM enjoy-
We use Hydro One’s ERM practices from 2000 to able or meaningful, and (8) not recognizing ERM as
2013 as a case study throughout this article to draw change management.
on the company’s experiences in achieving ERM
maturity, and illustrate the process using various 2.2.1. Corporate culture
aspects of ISO 31000 (see International Standards Unfortunately, ERM will not work in all corporate
Organization, 2009). With over 15 years of ERM cultures. Successful implementation of ERM de-
success, Hydro One is an excellent organization to pends on organizational willingness to be open, to
benchmark for ERM best practices. ERM methods at share, and to develop teamwork among the
Hydro One have been investigated and documented board of directors, senior management, and staff.
in numerous academic and other publications (e.g., Much of Hydro One’s ERM success was due to the
Aabo, Fraser, & Simkins, 2005; Mikes, 2010). We also firm’s openness and desire for transparency on the
draw on the experiences documented in our second part of various chairs, CEOs, and senior manage-
book on ERM, Implementing Enterprise Risk Man- ment over the years. More research is needed
agement: Case Studies and Best Practices (Fraser, regarding how corporate culture affects ERM.
Simkins, & Narvaez, 2014), and numerous interviews We would postulate that a firm’s chances of suc-
with active risk managers/executives. This article cess with ERM are directly proportional to its
explores the struggles organizations face and cultural capacity for openness, transparency,
offers some solutions. We proceed by explaining and teamwork.
BUSHOR-1317; No. of Pages 10

The challenges of and solutions for implementing enterprise risk management 3

2.2.2. Boards of directors’ knowledge 2.2.5. Identifying too many risks

While boards of directors’ knowledge about ERM is Some organizations–—especially those influenced by
increasing, it is still far from adequate. Various well-meaning but conflicted consultants–—create
surveys (e.g., Deloitte, 2007; Deloitte/Economist extensive lists of risks. Indeed, one author of this
Intelligence Unit, 2004) reveal a lack of knowledge article has heard of up to 700 risks being listed. If
about the information on risks, as well as the these risks are then recorded in a risk register and
purpose and value of ERM. Many director organiza- updated, this becomes an administrative burden
tions (i.e., those that train directors and provide that may impress regulators or boards, but is not
networking opportunities) offer risk training to seen as helpful or relevant by line management.
board members, but older directors especially Shorter can often be better, with the top 10 to
may feel they do not need the education. Without 20 risks being monitored by each part of the organi-
an understanding of ERM as a methodology, board zation and then reported upward, based on prede-
members will not be able to evaluate the adequa- termined criteria.
cy of an organization’s ERM processes and the
credibility of risk reporting to the board. The role 2.2.6. No timeframes
of the board in risk oversight is still not well To identify risks and the related probabilities, it is
understood (see Fraser, 2016). In brief, the board essential to define the time period being dis-
needs to review and be satisfied with the ERM cussed. Amazingly, few organizations think of this.
process and then review and be satisfied with Consider the following example we use when
the risk reporting. teaching ERM to a class: ‘‘What is the likelihood
of you dying?’’ This is typically followed by a
2.2.3. Not applying a KISS mindset variety of answers listing various percentages,
On starting the ERM journey, there is a temptation until someone shouts out ‘‘100%.’’ We acknowl-
to implement too many features at once, leading edge: ‘‘Yes, that is correct. Everyone is going to
to complexity. This can present an added bureau- die.’’ But suppose we ask: ‘‘What is the likelihood
cratic burden on line management (e.g., main- of you dying in the next five years?’’ The percent-
taining cumbersome risk/loss registers with too age will, hopefully, be much less than 100%, say
much detail). Interestingly, however, many of 2% — 5% or less. This exercise illustrates that
the organizations we have researched have en- without defining a timeframe, one cannot mean-
joyed great success with only two or three ERM ingfully discuss probabilities.
staff facilitating the methodology (see Fraser
et al., 2014). The more-successful implementa- 2.2.7. Not making ERM enjoyable or
tions seem to come from those organizations that meaningful
do pilots first and then later add additional fea- Staff members are not always enthusiastic about
tures (e.g., resource allocation based on risk cri- the advent of ERM in the organization; many view
teria, the use of key risk indicators). In the it as an additional bureaucratic burden, with sur-
beginning, it is important to remember the KISS veys or useless paperwork to be filled out. How-
principle: keep it simple, silly. ever, proponents of risk workshops have found
that participants actually look forward to these
2.2.4. Training without having risk workshops sessions, both as a learning experience and in
We have observed organizations that decide to im- helping to solve real business problems. The key
plement ERM by first launching into a series of to meaningful workshops involves having the right
training sessions. One major multinational had a people in the room (i.e., those with relevant
team traveling globally, presenting and teaching knowledge of the subjects being discussed), em-
ERM to managers; only several years later did the ploying a skilled facilitator, and designing the
firm stage its first risk workshop. There is much class/presentation to touch on important issues.
evidence that presenting and teaching ERM first The use of voting methods (e.g., software) pro-
without conducting workshops is of limited value, vides elements of surprise, excitement, and reali-
and little is retained by attendees. A far more ty that participants enjoy. Workshop attendees
practical and engaging method of training staff typically report they feel the time was well spent
entails holding workshops in which ERM methods and that they better understand organizational
can be applied to practical business realities; here, risks and what is needed in light of those risks.
attendees learn the methods, language, and risk As noted in section 2.2.1., though, some organi-
criteria being used, and then relate them to solving zational cultures will not permit open and trans-
their own real-life business problems. parent discussions.
BUSHOR-1317; No. of Pages 10

4 J.R.S. Fraser, B.J. Simkins

2.2.8. Not recognizing ERM as change pre-determined risk significance scales and what
management is/is not considered tolerable. Risk criteria may also
ERM is a change management initiative. It requires a include impact, probability and control scales, pri-
change in the way information is shared and how oritization of objectives relative to each other,
many critical activities are conducted. ERM is not and prioritization of resources as part of business
about having a separate group at headquarters planning.
manage risk while others in the organization contin- These techniques provide the basis for entrench-
ue as before, with little attention paid to this ing ERM into the organizational culture. Conversa-
initiative. ERM will re-enforce business objectives tions and prioritization are explained more fully in
by constantly referencing them during risk work- Fraser (2014). The concepts captured by Fraser are
shops, risk interviews, and business planning. Risk as follows.
will need to be factored into all capital projects, ERM, with its simple, focused approach, gives
both as part of the proposals and during the project every organization–—from small not-for-profits to
phases. All requests for funding and resources will the largest organizations and even countries–—
need to be supported by explanations as to the risks a method to come back to the basics of good
being addressed and the related strategic objec- management:
tives. By using consistent risk criteria throughout
these activities, there will be a common under-  What are you trying to achieve, and in what time
standing of agreed risk tolerances. For example, frame(s)?
on an impact scale of 1 to 5, a rating of 3, 4, or
5 was considered intolerable at Hydro One. Manag-  What are the sources of risk that could impact
ers were expected to take action to reduce any these objectives?
such-scored risks to level 1 or level 2 (i.e., tolera-
ble). After several years of having it in place, Hydro  How impactful could these be, and how probable?
One management confirmed that they could not
confidently operate the business without ERM; too  What can and should be done to optimize the
many unknowns and a lack of clarity about risks opportunities and to reduce the potential down-
would exist, they said via executive interviews sides?
(Mikes, 2010).
In summary, there are many challenges in imple-  Are resources being allocated to those areas of
menting ERM. But these are not insurmountable. risk that most need them?
Next, we offer solutions.
 How well are these objectives, risks, and treat-
ments understood by staff, and how committed
3. The solutions and engaged are they to executing the plans?

To overcome many of the ERM implementation chal- 3.2. Basic techniques for implementing
lenges discussed in the previous section, we present ERM
the following solutions.
In this section we summarize 26 basic techniques
3.1. The basics of ERM that we believe need to be considered and, as
appropriate, used to build an ERM methodology.
Much has been written about how to implement Not every feature is required for all organizations.
ERM. Our recent book, Implementing Enterprise For example, ‘champions’ (see section 3.2.6.) are
Risk Management: Case Studies and Best Practices only necessary in large, geographically dispersed
(Fraser et al., 2014), contains case studies of how organizations; here, the Chief Risk Officer (CRO)
major organizations (e.g., Lego, GM, TD Bank) have or corporate risk group cannot visit frequently, so
implemented ERM. The best practices for successful a local presence is needed.
implementation of ERM may be summarized as two
critical concepts: conversations and prioritization. 3.2.1. ERM policy
Conversations are essential in establishing un- It is recommended that firms have an overarching
derstanding and engaging staff. They are best ERM policy. This should be approved at the board
conducted via risk workshops, risk interviews, level, either by the full board or a delegated
and–—ultimately–—executive team/board talks committee such as the audit or risk committee. At
regarding objectives and risks. Prioritization is a minimum, the policy should contain the general
achieved through the use of risk criteria, such as principles (e.g., that risks will be managed
BUSHOR-1317; No. of Pages 10

The challenges of and solutions for implementing enterprise risk management 5

holistically) and define the accountabilities of key is especially critical in large, diverse organizations.
persons such as the CEO, the CRO, and the board. Champions should be trained in ERM techniques and
Definitions of major concepts such as ‘risk’ should conduct workshops, perform risk interviews, pre-
also be included so that the same definitions may be pare risk profiles, and liaise with the central risk
used company-wide (see section 3.2.4.). Some orga- group.
nizations will also include additional information,
although much of this may be better placed in the 3.2.7. Integration with loss control
framework (see section 3.2.2.). Two to four pages of Most companies keep track of their losses, however
description should suffice for an ERM policy. defined (e.g., fines, lawsuits, product returns). This
is useful information for ERM, especially as key risk
3.2.2. ERM framework indicators of future trends, and should be available
The framework is the procedure manual for how ERM to the CRO. Hopefully, these losses are already being
will be conducted. A firm can base its ERM frame- tracked and monitored by management.
work on an extant framework such as ISO 31000 and
then customize the language to suit the organiza- 3.2.8. Integration with strategic planning
tion. For small and medium-sized enterprises Each company’s definition of risk derives from that
(SMEs), the International Standards Organization firm’s business objectives. Thus, risk is variable from
(2015), or ISO, has just issued the publication ISO corporation to corporation. However, identifying and
31000 Risk Management: A Practical Guide for discussing risks as they relate to strategy is an itera-
SMEs. The length recommended for the framework tive process. The best ways to integrate ERM and
document is about 10 to 15 pages. strategy are explained by Beasley and Frigo (2010).

3.2.9. Integration with business planning

3.2.3. Executive risk committee
ERM best practice dictates allocation of resources
It is a good idea to have a management committee to
based on risks. As part of business planning, all
focus on risk. This function can be handled by an
business units should prepare risk assessments to
existing executive committee. This committee
support the need for resources. Also, enterprise-
should consist of the most senior executives, pref-
wide risk prioritization needs to be implemented to
erably including the CEO.
ensure that resources are used where the risks are
most critical. Toneguzzo (2010) and Grose (1986)
3.2.4. Common language
explain ways of prioritizing resources based on risks.
ERM is a change management initiative; as such,
there will be changes in how the business is man- 3.2.10. Risk criteria and approved risk
aged. Separate departments will now need to be on tolerances
the same page and this will require a shared under- In order to identify, evaluate, and prioritize risks,
standing of how the organization views and treats firms must have predetermined risk criteria.1 These
risks. An extensive dictionary is not needed, but are best articulated as scales to facilitate prioriti-
common ERM terms such as risk, residual risk, great- zation (e.g., with ranges from 1—5). The ranges that
est credible risk, treatment/mitigants/control, etc. are deemed tolerable versus intolerable should also
should be understood and used in the same way by be agreed on to assist in implementing ERM. As
all departments. described, this concept is sometimes thought of
or referred to as ‘risk appetite,’ but specific criteria
3.2.5. Dedicated corporate risk group provide a practical application compared to the
It is a good idea to have a centralized group, perhaps vague wording in most risk appetite statements seen
even including the CRO, that will facilitate and to date. For a more complete discussion on risk
guide ERM. Whether additional risk-related func- criteria, see Purdy (2011).
tions are added to this group is up to each organiza-
tion. Based on our research, most such groups 3.2.11. Risk workshops for line staff
require two to three individuals; however, addition- Successful ERM entails having a common under-
al functions–—such as insurance, security, whistle- standing of objectives, risks, and treatments in
blower hotlines, etc.–—can increase this number. place (or to be implemented). This is best achieved
The various types of roles that a CRO may play through conversations and prioritization among the
are explained by Mikes (2010). staff responsible. The most efficient and effective
way of doing this is via risk workshops; obviously, this
3.2.6. Champions
Champions are individuals that help promote and
1
engage employees with ERM at the local level. This Refer to ISO 31000 for examples.
BUSHOR-1317; No. of Pages 10

6 J.R.S. Fraser, B.J. Simkins

can prove more difficult in large, multinational or analysis to measure risks quantitatively for ERM is
geographically dispersed organizations. How to de- explained by Hargreaves (2010).
sign and facilitate risk workshops is described in
detail by Quail (2010). 3.2.17. Risk register
A risk register, which lists all identified risks and
3.2.12. Risk workshops for the leadership information pertinent to the same, is often consid-
team ered essential for risk management. There is a dan-
Risk workshops among the leadership team are also ger, however, that upkeep and maintenance of the
essential toward a common understanding and pri- risk register will prove an administrative burden
oritization of risks and actions to be taken. In addi- unrelated to managing the business. This, in turn,
tion, such workshops build essential team spirit. can lead to irrelevance of the process and frustration
Leadership team members will, in turn, take the on the part of management. Some records are help-
acquired risk knowledge into risk workshops with ful, but risk management is a living, real-time activ-
their own staff, thereby embedding the concepts, ity, not an outdated record. This must be understood
knowledge, and risk tolerances throughout the or- by all.
ganization.
3.2.18. Business plan templates
3.2.13. Voting software As part of risk-based business planning, it is recom-
We recommend the use of voting software for the mended that line management be provided with
immediate and iterative feedback of workshop par- templates as to what information should be supplied
ticipants. While voting can be conducted via pens on risks, and thereby support the need for resour-
and slips of paper, voting software adds a sense of ces. Risk-based resource allocation is described by
excitement that has been found to make workshops Toneguzzo (2010) and Grose (1986).
more enjoyable and efficient. Without the use of
voting technology, discussions can become dominat- 3.2.19. Key risk indicators
ed by the loudest voices or most-senior persons Key risk indicators (KRIs) are statistical data that
present. These may not be the most knowledgeable, provide potential insights to future situations. Un-
leading to biased or politically motivated decisions. like key performance indicators, which record past
accomplishments, KRIs can warn management of
3.2.14. Risk interviews evolving issues that may increase or reduce risks,
One-on-one risk interviews can be a key source of and should be developed and factored into risk
conversations to gather and disseminate informa- discussions and analyses. For further reading on
tion related to risks. These can elicit information key risk indicators, see Hwang (2010).
that some staff may not feel comfortable sharing in
a group setting. They also offer an opportunity to 3.2.20. Scenario analysis
reinforce corporate business objectives and risk- Scenario analysis, especially in a brainstorming set-
related issues outside of the interviewee’s purview. ting, is a useful technique for identifying and plan-
See Fraser (2010) for how to conduct risk interviews. ning for possible sources of risk. In the financial
industry, there are often regulatory requirements
3.2.15. Measurement: Broad ranges for stress testing the impact on an institution’s
The measurement of risks in quantitative terms is financial position under various scenarios. This tech-
relatively easy as regards certain domains (e.g., nique is also useful when discussing black swans (see
investment portfolios). This is not the case, howev- section 3.3.3.).
er, in other areas (e.g., regulatory risk, government
risk, safety); here, in order to understand and pri- 3.2.21. Sign-off by line management
oritize risks it is necessary to utilize broad ranges. Some organizations have adopted the practice of
This is the most popular method at present among having line managers sign off as to the adequacy of
organizations practicing ERM. The use of ranges to risk disclosure in their reports, business planning,
measure risks is explained by Hargreaves (2010). etc. This can be helpful in the early days of ERM to
ensure that line managers fully understand their
3.2.16. Measurement: Detailed metrics accountability regarding risk evaluation and disclo-
To better gauge the potential effects of risks among sure.
a multiplicity of scenarios, statistical analysis is a
useful tool. For example, Monte Carlo simulations 3.2.22. ERM in executives’ personal contracts
can be run to analyze the interrelationship of im- Directly referencing the risk responsibilities listed in
pacts across multiple events. The use of statistical executives’ personal annual contracts–—which are
BUSHOR-1317; No. of Pages 10

The challenges of and solutions for implementing enterprise risk management 7

used to evaluate their performance and determine more detailed oversight, the full board must do this
bonuses–—can support the attention paid to risks and review.
risk management by executives.
3.3. Additional practical techniques for
3.2.23. Corporate risk profile ERM
A corporate risk profile should periodically be pre-
pared for executive management and the board. At This section contains more-complex concepts and
a minimum, this should be done semi-annually, with additional techniques for employment in ERM. First,
updates for important changes in the interim. The we offer explanations about the confusion over risk
profile should reflect the key risk information of appetite as a concept, and provide a suggestion for
residual risks in excess of predefined tolerances addressing this concept and employing a practical
for a given future time period (e.g., five years). method of prioritizing strategic objectives. Second,
Corporate risk profiles typically take the form of risk we present guidance on the use of risk criteria, in
maps, lists of top ten risks, and heat maps, all line with ISO 31000 guidelines. Third, we proffer
supplemented with accompanying narratives ex- practical guidance on dealing with ‘black swans’
plaining the sources of risks, objectives impacted, (high-impact, low-probability events). Fourth, we
and actions in place/proposed. These profiles are supply a practical example of using risk criteria to
usually prepared by the corporate risk group under solve a major business problem. Fifth, and finally,
the direction of the CRO or equivalent, and based on we introduce a new technique: creating a ‘risk
the various databases of risk information. Such data- calendar’ to track upcoming events that could cre-
bases may include risk registers, results of work- ate risk for the organization in the future.
shops and risk interviews, key risk indicators, recent
events analysis, and relevant records. How to design 3.3.1. Risk attitude/risk appetite
and conduct risk profiles is described in detail by As mentioned, the mass confusion generated by
Fraser (2010). COSO in its definitions of risk appetite and risk
tolerance has been one of the great inhibitors of
3.2.24. Reporting to leadership successful implementation of ERM. This confusion
Many firms implement ERM to ensure that members was recognized by ISO, which decided not to use
of the leadership team share an understanding of either term in the ISO 31000 (Purdy, 2011). Instead,
the risks that may affect company objectives. The it used the term ‘risk attitude,’ which we illustrate
first step in reporting to leadership entails composi- in this section.
tion of an initial risk profile. In smaller organiza- ISO 31000 only mentions risk attitude twice, once
tions, ERM may be launched with risk workshops being in its definition. Hydro One has explored this
where executive team members brainstorm the concept in order to gauge and provide feedback on
risks and subsequently prioritize them for any addi- whether its employees’ views of risk attitude are
tional actions required. those intended by executive management and the
board. As shown in Figure 1, Hydro One uses a spider
3.2.25. Reporting to the audit (or other diagram graphic and associated ranking criteria,
board) committee first to establish the executive team’s attitude to-
When accountability for risk oversight has been ward each major strategic objective (i.e., the tar-
delegated by the board to a committee, that get attitude). Then, at the beginning of every risk
committee periodically should ask for risk profiles workshop, staff members are surveyed to gauge
from management. These profiles typically con- their perception of the organization’s attitude
tain the aforementioned risk maps, lists of top ten and behaviors toward the strategic objectives.
risks, and heat maps, all supplemented with Rob Quail (2012), Vice President — Customer Service
accompanying narratives explaining the sources at Hydro One, describes this process in more detail.
of risks, objectives impacted, and actions in In testing this methodology, Hydro One discov-
place/proposed. Frequent updates may also be ered somewhat diverse views to risk attitude
required upon major changes in circumstances throughout the company. This is important feedback
that could affect the accomplishment of business regarding communication in the organization and
objectives. whether the attitude needs to change or the com-
munications efforts need to be enhanced. As with all
3.2.26. Reporting to the board its initiatives, Hydro One seeks here to create struc-
As previously described, there is debate as to what tured conversations so that optimal prioritizations
level of detail and effort the full board should focus can be made. This feedback will also influence the
on regarding risk. If no board committee performs impact and tolerance criteria.
BUSHOR-1317; No. of Pages 10

8 J.R.S. Fraser, B.J. Simkins

Figure 1. Risk attitude*

*This diagram shows a comparison of opinions by staff across work units. This input is obtained by use of voting technology during risk
workshops throughout the company. This is a model only.

3.3.2. Risk criteria: The essence of identifies and assesses risks. Given that they all use
prioritization the same criteria and methodology, this also edu-
ISO 31000 defines risk criteria as the ‘‘terms of cates and embeds the understanding of risks and
reference against which the significance of a risk attitude. Risk workshops and how to design and
risk


is evaluated’’ (International Standards Orga- facilitate them are described in hard-hitting detail
nization, 2009). Some examples provided include: by Quail (2010).
‘‘the nature and types of causes and consequences Measurement of risk impact and risk tolerance as
that can occur and how they will be measured; how applied by Hydro One was designed such that a
likelihood will be defined; the timeframe(s) of the rating of 1 or 2 (minor or moderate, respectively)
likelihood and/or consequence(s); the level at is considered a tolerable impact. A rating of 3, 4, or
which risk becomes acceptable or tolerable’’ (Inter- 5 (major, severe, or worst-case, respectively) is
national Standards Organization, 2009). considered an intolerable impact, and the sources
Risk criteria drive much of the ERM process. For of these risks must be addressed and prioritized for
example, risk criteria include the use of scales for treatment.2
impact, probability, control, etc. The benefit comes
from (1) the conversations and agreement as to 3.3.3. Risk criteria: Black swans
appropriate scales and (2) the ability to prioritize Popularized by Nassim Taleb (2007), the term ‘black
risks and treatments. Risk workshops should be swan’ describes an event that comes as a surprise,
facilitated for all major projects; for major types has a major impact, and–—after the fact–—is recog-
of risks; by business units through business plan- nized as something that should have been foreseen.
ning; and for the executive team and–—where ap- Nowadays, the term is often used to describe a high-
propriate–—the board of directors, both to obtain impact but low-probability potential event. Several
their input and to demonstrate how management years ago, Hydro One realized that it did not always
create explicit conversations around these types of
Table 1. Velocity* risks. As a result, the firm re-evaluated its approach
5 Instantaneous Less than one day and recognized that different criteria would be
4 Immediate One day to one month required for assessing and prioritizing these risks.
3 Rapid One month to one year It determined that the key consideration factors for
2 Gradual One to five years
these types of risks were speed/velocity of impact
(see Table 1) and preparedness of the firm
1 Slow More than five years
*
Velocity is the interval between the initiating event and its
peak impact on the organization’s business objectives. 2
See page 539 of Fraser and Simkins (2010) for an example.
BUSHOR-1317; No. of Pages 10

The challenges of and solutions for implementing enterprise risk management 9

Table 2. Resilience*
5 Immediate Appropriate resources and plans accessible or in place; are regularly tested and could be
deployed immediately.
4 Full Resources accessible or in place; could be deployed with some effort. Responsibility for
development of plans is clear.
3 Substantial Resources are accessible for large aspects of the risk and its impact, but there are significant
gaps; would require organization, procurement of resources, and development and
deployment ‘on-the-fly’.
2 Partial No resources exist for significant aspects of the risk or its impact; coping with the risk would
take years of planning and resource redeployment.
1 Minimal Plans and resources unavailable.
*
Resilience is the ability to detect and deploy (plans, organizations, and structures), and the availability of resources (people,
knowledge, liquidity, equipment, etc.).

Table 3. Risk calendar*

Strategic Objectives 2016 2017 2018 2019 2020
Customers Major new Government
computer elections
system
Regulatory New regulations
take effect
Human Union CEO has announced
Resources agreements retirement for
to renew June 2018
Other Lease on Major competitor Patents for major
warehouse announced opening product due to
due to expire here expire in 2020
*
The risk calendar keeps track of important future risk events that could affect the organization in a material way. In discussing
these, each should be evaluated as to the possible benefits, opportunities, and impacts that might occur and how these can best be
addressed.

(see Table 2). As a result, Hydro One structured decisions and solve problems. For example, as part
scales to allow the company to have meaningful of a planned initiative, 20% of Hydro One’s work-
discussions about such risks (e.g., computer failures force took early retirement in 2000. This changed
in which the back-up also fails; massive, but unlike- staffing scenario left the company with a dramati-
ly, regulatory or government decisions). Hydro One cally different risk profile. Hydro One applied the
now maps results onto a velocity x resilience chart aforementioned techniques using risk criteria,
to help ensure that its contingency plans and re- workshops, etc. to show how areas of greatest
source allocations for resilience match the potential residual risk could be identified and treatments
speed of the impacts (e.g., having a ‘hot’ back-up prioritized (Aabo et al., 2005). Hydro One’s ERM
site for an event that will not provide the firm with team was thereafter constantly requested to facili-
adequate warning). tate risk workshops and advise on risk issues.

3.3.4. Making decisions and solving problems 3.3.5. The risk calendar
First and foremost, ERM must be viewed as providing While not all events will necessarily experience
important information that aids in decision making, difficulties, future events can create risks due to
thereby helping to solve managers’ problems. This the uncertainty of whether or not they will actually
does not mean that ERM team members will them- occur and what the impacts–—good or bad–—may be.
selves possess the requisite expertise in particular Accordingly, it is a good idea that someone (e.g., the
areas, but it does mean using methodologies CRO or his/her staff) maintain a calendar recording
that facilitate sound decision making and optimal major upcoming events (e.g., government elec-
outcomes for managers. Hydro One’s ERM team tions, union negotiations, lease renewals) several
members earned their stripes early in the imple- years into the future so that these can be moni-
mentation phase by helping managers make tored, planned for, and leveraged whenever
BUSHOR-1317; No. of Pages 10

10 J.R.S. Fraser, B.J. Simkins

possible (see Table 3). In discussing these events, Fraser, J. R. (2010). How to prepare a risk profile. In J. Fraser & B.
each should be evaluated regarding the possible Simkins (Eds.), Enterprise risk management: Today’s leading
research and best practices for tomorrow’s executives (pp.
benefits, opportunities, and impacts that might 171—188). Hoboken, NJ: John Wiley & Sons.
occur and how these can best be addressed. Fraser, J. R. (2014). Building enterprise risk management into
agency processes and culture. In T. Stanton & D. W. Webster
(Eds.), Managing risk and performance: A guide for govern-
ment decision makers (pp. 175—196). Hoboken, NJ: John
4. Conclusion Wiley & Sons.
Fraser, J. R. (2016). The role of the board in risk management
In this article, we presented explanations from our oversight. In R. Leblanc (Ed.), Handbook of corporate gover-
research as to the challenges faced by implementers nance. Hoboken, NJ: John Wiley & Sons.
of ERM. We provided a summary of the basic tech- Fraser, J. R., & Simkins, B. J. (2007). Ten common misconceptions
about enterprise risk management. Journal of Applied Corpo-
niques for implementing ERM and included some rate Finance, 19(4), 75—81.
additional techniques that may be used when ap- Fraser, J. R., & Simkins, B. J. (Eds.). (2010). Enterprise risk
propriate. Numerous surveys (Beasley et al., 2015) management: Today’s leading research and best practices
show that the successful implementation of ERM for tomorrow’s executives. Hoboken, NJ: John Wiley & Sons.
trails the expectations of senior management, Fraser, J. R., Simkins, B. J., & Narvaez, K. (Eds.). (2014). Imple-
menting enterprise risk management: Case studies and best
boards, and regulators. This article provided specif- practices. Hoboken, NJ: John Wiley & Sons.
ic practical explanations of the reasons for frequent Grose, V. L. (1986). Managing risk: Systematic loss prevention for
failures, as well as simple, effective techniques and executives. Atlanta: Omega Systems Group.
guidance on how to improve the chances of success Hargreaves, J. (2010). Quantitative risk assessment in ERM. In J.
Fraser & B. Simkins (Eds.), Enterprise risk management:
in implementing ERM. References to additional guid-
Today’s leading research and best practices for tomorrow’s
ance materials on each critical aspect were prof- executives (pp. 219—235). Hoboken, NJ: John Wiley & Sons.
fered. Hwang, S. (2010). Identifying and communication key risk indi-
It is our belief that in any organization that has cators. In J. Fraser & B. Simkins (Eds.), Enterprise risk man-
successfully implemented ERM, the management agement: Today’s leading research and best practices for
team will deem it essential for continued good tomorrow’s executives (pp. 125—140). Hoboken, NJ: John
Wiley & Sons.
management and governance. This article should International Standards Organization. (2009). ISO 31000 risk man-
be of interest to organizations implementing ERM, agement: Principles and guidelines. Available at http://www.
to academics teaching ERM, and to risk professionals iso.org/iso/catalogue_detail?csnumber=43170
desiring to learn more on this evolving process. International Standards Organization. (2015). ISO 31000 risk man-
agement: A practical guide for SMEs. Available at http://
www.iso.org/iso/iso_31000_for_smes.pdf
Kloman, F. (2010). A brief history of risk management. In J. Fraser
References & B. Simkins (Eds.), Enterprise risk management: Today’s
leading research and best practices for tomorrow’s executives
Aabo, T., Fraser, J. R. S., & Simkins, B. J. (2005). The rise and (pp. 9—29). Hoboken, NJ: John Wiley & Sons.
evolution of the chief risk officer: Enterprise risk management Mikes, A. (2010). Enterprise risk management at Hydro One (Case
at Hydro One. Journal of Applied Corporate Finance, 17(3), 9-110-707). Boston: Harvard Business School Publishing.
18—31. Purdy, G. (2011 September). Risk appetite: Is using this concept
Beasley, M. S., & Frigo, M. L. (2010). ERM and its role in strategic worth the risk? Wellington, New Zealand: NZ Society for Risk
planning and strategy execution. In J. Fraser & B. Simkins Management.
(Eds.), Enterprise risk management: Today’s leading research Quail, R. (2010). How to plan and run a risk management work-
and best practices for tomorrow’s executives (pp. 31—50). shop. In J. Fraser & B. Simkins (Eds.), Enterprise risk manage-
Hoboken, NJ: John Wiley & Sons. ment: Today’s leading research and best practices for
Beasley, M. S., Branson, B. C., & Hancock, M. S. (2015). Report on tomorrow’s executives (pp. 155—170). Hoboken, NJ: John
the current state of enterprise risk oversight: Update on Wiley & Sons.
trends and opportunities. Durham, NC: AICPA. Quail, R. (2012). Defining your taste for risk. Corporate Risk
Canadian Standards Association. (1997). Risk management: Canada, Spring, 24—30.
Guideline for decision-makers (CAN/CSA-Q850-97). Missis- Standards Australia/Standards New Zealand. (1999). Risk man-
sauga, Canada: CSA. agement (AS/NSZ 4360). Sydney: Standards Australia.
Deloitte. (2007). In the dark II: What many boards and executives Taleb, N. N. (2007). The black swan: The impact of the highly
still don’t know about the health of their businesses. New improbable. New York: Random House.
York: Deloitte Touche Tohmatsu. Toneguzzo, J. (2010). How to allocate resources based on risk. In
Deloitte/Economist Intelligence Unit. (2004). In the dark: What J. Fraser & B. Simkins (Eds.), Enterprise risk management:
many boards and executives don’t know about the health of Today’s leading research and best practices for tomorrow’s
their businesses. New York: Deloitte Touche Tohmatsu. executives (pp. 189—216). Hoboken, NJ: John Wiley & Sons.