When I am preparing an executive team or board for an enterprise risk workshop, I say to them, there are three types of enterprise risks. Individual risks. A risk within a division or business unit that is of such significance that it deserves the attention of the executive and board. Enterprise systemic risks. That is,
I have seen many, many corporate policies and frameworks in my time. The one great tendency of the authors of policies and frameworks is to put way too much information into them and not focus enough on their main purpose – influencing decisions of staff. Nobel Prize winner Herbert A. Simon authored Administrative Behaviour first published
Before you cook a meal you should consider who is dining with you and how much food will be sufficient. Some people have a higher capacity to eat than others, and sometimes one or more will be hungry – will have a higher appetite. It’s the same in business. Before determining your appetite for risk,
Another topic request from a reader: What impact does the risk maturity level have on the effectiveness of risk management? Like so many things in life, it depends. Start with your definition of risk maturity. When I run the RMIA’s Flagship ERM course, I run an exercise on how you evaluate your framework. There are
Last week I blogged about Overstepping the 3 Lines, where I highlight the biggest criticism of the Three Lines Model, (my opinion and that of many practitioners), it does nothing to build TRUST between the Risk Team as advisers to the business and those making the decisions to take risk. Unfortunately, it is the model