Like serving any multi-course meal, enterprise-risk-managementprojects can be large, intimidating, tough to coordinate anddifficult to digest.

In tackling an ERM rollout, breaking down the project isessential for success. Here are the basic steps of a five-coursemenu or project plan.

The Starter: ID EMERGING RISKS

Appetizers excite the taste buds and prepare guests for thecoming feast—a fundamental first step to introduce a “theme” forthe full culinary presentation.

In ERM terms, the first course isidentifying current and emerging risks. Theidentification process often starts on a small scale, withface-to-face interviews. Groups of key managers and staff are askedabout root causes and drivers of risks in their particularareas.

Next, the ERM team will look at any connected risks that mightaffect multiple departments. The review may increase in complexity.The company can conduct surveys, review news, and retain expertsand consultants. A harvest of potential risks will be gathered,sliced and diced, and main groups of risk bucketed and blended.Even the smallest tidbits of information gleaned here can revealpatterns and trends of loss not previously appreciated.

This is a fundamental step, designed to form the basis for theentire ERM plan, and can whet the appetite for future ERM work.Often, participants get their first real taste of the magnitude andfinancial impact of risk in such interviews. As new ideas and riskscome to light, participants may begin to realize how vulnerabilityin their areas of responsibility can impact the company on agreater scale. New, interesting flavors are added toresponsibilities already on their plates.

The identification course also can introduce a “theme” for theoverall ERM project. The company begins to educate all staff aboutERM principles early in the process. The instructions given, thequestions and answers elicited, and the information gathered canleave an impression. With care, that impression will be that thecompany is serious about risk management, sees ERM as acollaborative effort, and is committed to developing a sustainable,long-term approach. ERM is not fast food.

Salad: Metrics Assess Frequency/ Severity

The salad adds something the main entrée itself may lack—flavor,texture, color, or nutritional base. Salads complement the diningexperience.

Metrics could be considered the “salad” ofERM—something that complements and completes the risk-analysisprocess. A company that has catalogued its risks and establishedsome controls to manage them has accomplished a major step towardmitigating future losses. But it is not quiteenough.

Adding the step of developing metrics allows a company torank risks and prioritize resources andactivities around the most dangerous risks and most beneficialcontrols. It provides objective, quantitative measurements ofspecific risks against an organization's risk appetite—thestatement of a company's willingness to assume a degree of risk inpursuing opportunities.

In this phase, companies assess the frequency of a potentialrisk—how often could an event happen? They also measureseverity—how bad could it be? Other metrics can also be used, suchas the duration of an event or loss and the development time forthat risk or loss.

A key feature of any ERM program is to set standardscales/metrics for evaluation of different kinds of risk acrossdifferent business divisions so they can be compared on an“apples-to-apples” basis.

The Sorbet: REPORTING & MONITORING

Serving sorbet between courses cleanses the palate and freshensa taster's perspective. ERM programs must also have planned pausesfor participants to evaluate prior work.

The world of risk is constantly changing. In ERM, riskreporting and monitoring will be scheduled on a regularbasis, so that risks can be reviewed, re-ranked and controlstested. Risks become more or less significant to a company overtime, while others are newly identified. Building time into theoverall process to appreciate what has passed, address neededchanges and prepare for the next course refreshes perspective onrisk.

The Main Course: Setting Effective Controls

A well-planned main dish is the heartiest course and thehighlight of a meal. ERM's main course is effectivecontrols. It is the ultimate goal of an ERM program toestablish a suite of specific techniques, policies and proceduresto reduce or mitigate identified risks as much as possible. Whilethey won't operate to eliminate 100 percent of all risk,well-developed, sustainable controls will have a direct financialimpact on a company.

Controls can make or break a company, as is being recognized bysuch industry gourmet critics as regulators and shareholders.

Dessert: Strategic Analysis

From a chef's perspective, dessert can revive the palate orfacilitate digestion. For the diner, dessert is pure pleasure. Ineither case, a superb dessert can make the entire meal trulymemorable.

Strategic analysis is the icing on the cake formany ERM programs. Strategic analysis is the process of weighingwhether potential gains will outbalance losses in a proposed courseof action. Once main controls are established and operatingsmoothly to mitigate the “downside” of risk, a company can push itsanalyses to a new level, allowing it to more fully address the“upside” of risk: opportunities.