Enterprise Risk Management (ERM) ��The Human Resource Management Association of Jamaica (HRMAJ) Conference31:�"Innovating Through the Downturn…Creating Value for the Upturn” ��Presenter: �Bruce L Scott, FCA, FCCA, CISA, MBA, CISM, CBCP, CPA, CIA, CFE, CRISC�Partner – Risk & Internal Audit Services�PwC Jamaica�
16 – 18 November 2011
www.pwc.com
ERM
Contents
PwC
2
Risk Management in the News
UBS trader Kweku Adoboli 'sorry' for bank's $2.3B loss, lawyer says
New York Post – 22 September 2011��
PwC
3
Risk Management in the News
The Event:
The Telegraph – September 2011
PwC
4
Risk Management in the News
The Impact
The Telegraph – September 2011
PwC
5
Risk Management in the News
Root Cause:
Mr Adoboli’s potential involvement revived memories of rogue trader Jérôme Kerviel, who lost £4bn for French bank Société Générale in 2008. Like Mr Kerviel, the UBS trader started out in back office operations, building an understanding of trading systems ..SEGREGATION OF DUTIES / FAMILIARITY
Duration:
The prosecution said some of the unauthorized trades dated back to 2008.
The Telegraph – September 2011
��
PwC
6
Are you exposed?
Could your department or entity be losing millions over the last few years (similar to UBS) – which later crystallises into a newspapers headline?
PwC
7
Are you exposed?
Question:
Can anything be done to prevent or mitigate these types of massive operational exposures?
Answer:
Yes / Maybe / No
PwC
8
What is Risk?
“Risk is anything that could thwart the accomplishment of desired objectives.” (PwC)
PwC
9
What is Operational Risk?
“Risk of loss resulting from inadequate or failed internal processes, people and systems or from external events".
Basel Committee
PwC
10
Other Key Risk Concepts - Risk as Opportunity
Hazard
Compliance
& Prevention
Operating
Performance
Strategic
Initiatives
Opportunity
Uncertainty /
Variance
A
B
C
Risk as: 1)Hazard, 2)Uncertainty and 3)Opportunity
PwC
11
CEO Survey Overview
PwC
12
The key driver of risk management is value creation : THE DNA OF BUSINESS SUCCESS
When ERM is integrated in strategic planning
Percentage reporting strong or considerable positive impact
23%
22%
22%
38%
33%
32%
21%
42%
38%
37%
35%
43%
45%
51%
51%
55%
56%
59%
59%
62%
66%
68%
0%
20%
40%
60%
80%
100%
Profitability
Meeting strategic goals
CEO's ability to think entrepreneurially and innovatively
Reporting to regulators
Communicating to stakeholders/shareholders
Reputation
Clarity of organisation-wide decision making and chain of command
Creating smooth governance procedures
Monitoring performance
CEO confidence in business operations
CEO's ability to take appropriate risks to help �create value
All others
ERM is a priority
Source: EXHIBIT 22 – BENEFITS OF ERM
PwC
13
What Then is Enterprise Risk Management?
Enterprise Risk Management is a process that includes:
PwC
14
ERM Around the World
When would you expect your organisation to have effective and efficient ERM in place?
7th Annual Global CEO Survey • US Findings
PwC
15
ERM in the Region
PwC
16
ERM in the Region
PwC
17
How to Embed ERM as a Process in Your Company: Summary
PwC
18
How to ERM as a Process in Your Company
PwC
19
How to Embed ERM as a Process in Your Company
PwC
20
How to Embed ERM as a Process in Your Company
Executive Risk Management Committee
Department Heads / Risk Owners
Internal Audit
Board Gets Key Risk Reports/Updates
Risk Manager
Risk Champions
VP / Risk Manager
Establish a Risk Management Governance Structure:
PwC
21
How to Embed ERM as a Process in Your Company
PwC
22
How to Embed ERM as a Process in Your Company
PwC
23
How to Embed ERM as a Process in Your Company�
Risk Assessment
High
LIKELIHOOD
Moderate
Low
IMPACT
High Priority
Moderate Priority
Low Priority
High
Moderate
Low
PwC
24
How to Embed ERM as a Process in Your Company
PwC
25
How to Embed ERM as a Process in Your Company
PwC
26
Summary : COSO ERM Integrated Framework
The 8 steps above can be summarised using the COSO cube
PwC
27
This Process of Embedding Risk Management seems Long and Expensive – Any Short Cuts?
�
PwC
28
How to Embed ERM as a Process in Your Company: Summary
PwC
29
Top Ten HR Risk from a Recent Study of Two Large Jamaican Companies
No. | Risks / Treatments | Type of Risk |
1 | Risk: Poor work/life balance among staff | Operational/ Strategic |
| Treatment: Flexitime and telecommuting. Telecommuting requires a greater investment in technology and triggers its own administrative requirements and may not suit all industries. | |
2 | Risk: Absence of “issue intake and escalation procedures” for situations where staff notice suspicious activities such as fraud or sexual harassment | Fraud |
| Treatment: Develop an independent hotline and a clear fraud policy. Fraud prevention is better (fire safety expert) than fraud investigation (fire fighter) | |
PwC
30
Top Ten HR Risk from a Recent Study of Two Large Jamaican Companies
No. | Risks | Type of Risk |
3 | Risk: Absence of a Code of Ethics and company leadership that “walk the walk” Treatment: Implement Code of Ethics and apply sanctions where breaches occur. Companies with Code of Ethics that works, experience less fraud (PWC 2007 Economic Crime survey) | People |
4 | Risk: Absence of an IT disaster recovery plan for recovering critical personnel information or recovering personnel information that are kept in hard copies in the event of data loss Treatment: Work with IT to develop IT disaster recovery plan and a document management system | Technology |
PwC
31
Top Ten HR Risk from a Recent Study of Two Large Jamaican Companies
No. | Risks | Type of Risk |
5 | Risk: Risk of unauthorised changes to payroll rates on the IT systems (fraud). Also inaccurate calculations of incentive payment, redundancies, net pay. The foregoing can be embarrassing Treatment: Strong password controls and a system of independent review of other people’s work. Work with internal audit to assist with the monitoring of these issues | Fraud / Operational |
6 | Risk: Fraudulent expense claims and overtime being charged to the company. Also the risk of fraudulent credentials being submitted Treatment: Do a fraud risk assessment and develop antifraud controls. Work with internal audit to assist with the monitoring of these fraud risks | Fraud / People |
PwC
32
Top Ten HR Risk from a Recent Study of Two Large Jamaican Companies
No. | Risks | Type of Risk |
7 | Risk: Screening of new staff not being done or HR not asking specifically if new entrants have a history of fraud. Be careful of new rules about privacy and what can be said about a staff who has left your company Treatment: Do proper fraud screening of new staff and check privacy rules with your attorney | Recruiting / Fraud |
8 | Risk: Fire related hazards and controls not functioning properly. Also staff not trained to challenge strangers and suspicious persons Treatment: Train staff in physical security awareness and implement emergency response planning | Occupational Safety |
PwC
33
Top Ten HR Risk from a Recent Study of Two Large Jamaican Companies
No. | Risks | Type of Risk |
9 | Risk: Staff members are sometimes under a false impression that their compensation is not competitive Treatment: Educate your staff by “showing off” all that your company is doing and let them see the total value. Do this for the monetary and non monetary things your company is doing. Also “show off” the accomplishments of your co.’s alumni. | People / Financial |
PwC
34
Top Ten HR Risk from a Recent Study of Two Large Jamaican Companies
No. | Risks | Type of Risk |
10 | Risk: Poor succession planning and pre mature lost of talented staff Treatment: Greater investment in recruiting and early communication to staff who have executive level potential about their future prospects in the company | People |
PwC
35
Conclusion & Questions
PwC
36
Presenter Profile : Bruce Scott, FCA, FCCA, CISA, MBA, CISM, CBCP, CPA, CIA, CFE, CRISC
Bruce L. Scott is the Partner, responsible for Risk and Internal Audit Services at PwC Jamaica. He has many years of internal audit and operational risk management experience within the firm. He spent six months in the Risk and Controls practice of PwC office in Toronto Canada. ��Bruce is Certified in Risk and Information System Control (CRISC) among several other certifications and holds a MBA degree from Manchester Business School. He has extensive experience in helping companies build out their enterprise and operational risk management infrastructures. He is the regional ERM subject matter expert in PwC Caribbean Region.� �
PwC
37