3/7/2012
To access today’s materials, please visit:
www.experis.us/materials
Risk Velocity:
y
Staying Ahead
in a Volatile
Business Environment
Alec Arons – Director, Risk Advisory
Timothy Lietz – Director, Risk Advisory
Wednesday, March 7, 2012
Risk Velocity
General Information
• Share the webinar
• Ask a question
• Votes (polling questions)
• Rate (before you leave)
To access today’s materials, please visit:
www.experis.us/materials
Experis | Wednesday, March 7, 2012
2
1
3/7/2012
Risk Velocity
Earning CPE Credit
 To receive 1 CPE credit for this Webinar, participants must:
− Attend the Webinar for at least 50 minutes on individual computers
(one person per computer)
− Answer polling questions asked throughout the Webinar
To access today’s materials, please visit:
www.experis.us/materials
i
/ t i l
Experis | Wednesday, March 7, 2012
3
Risk Velocity
Agenda
• Define Risk Velocity
• Identify certain factors impacting risk velocity
• Describe the interaction between likelihood,
impact and velocity as key risk factors
• Describe the role of internal audit in assessing
and monitoring risk velocity
• Apply a practical, phased approach to assessing
risk velocity
To access today’s materials, please visit:
www.experis.us/materials
Experis | Wednesday, March 7, 2012
4
2
3/7/2012
Risk Velocity
Moving beyond the 2x2 Risk Framework
• Traditional risk assessment frameworks have been focused primarily
on the factors of:
– Likelihood
– Impact
• Utilizing a rating scale of:
– Low
– High
• Resulting in the traditional 2x2 framework
Experis | Wednesday, March 7, 2012
5
Risk Velocity
2 x 2 Risk Framework
High
High
High
Low
L
Low
Hi h
High
Low
Impact
Low
High
Low
Low
Experis | Wednesday, March 7, 2012
Likelihood
High
6
3
3/7/2012
Risk Velocity
Moving beyond the 2x2 Risk Framework
• The challenge of this model is that the focus is too narrow to
effectively assess constantly changing risk environments
• When looking at Impact we often equate this with financial statement
impact related to the single risk being evaluated
• When looking at Likelihood we also have the tendency to look
at discrete events
• The lesson learned in the wake of the financial crisis and the resulting
economic downturn is that risk cannot be looked at in a vacuum
• It is critical that any assessment of risk include a way to look to
address the “perfect storm”, the Black Swan effect and any
risk events that could be fatal to the organization
Experis | Wednesday, March 7, 2012
7
Risk Velocity
Risk Velocity – a third dimension
• Recently, organizations have added a third dimension to the
discussion of risk - Velocity
• Risk Velocity can be defined as the speed of occurrence of a
particular risk impacting the organization
• The Speed of Occurrence can in turn be impacted by:
– Speed of Onset
– Speed of Impact
– Speed of Reaction
Source: “Graduate-Level Risk Assessment” , Paul Sobel, CIA, Internal Auditor Magazine, June 2010
Experis | Wednesday, March 7, 2012
8
4
3/7/2012
Risk Velocity
Polling Question #1
Do you currently use Risk Velocity as a risk factor during your
annual risk assessment process?
A. Yes
B. No
Experis | Wednesday, March 7, 2012
9
Risk Velocity
Importance and Use of Risk Velocity
in Risk Assessments
Source: Corporate Executive Board –
Navigating the Global Financial Reform,
2009 Financial Institution Forum,
November 10, 2009
While 70 percent of finance executives agree that risk velocity is a core
consideration, only 11 percent have introduced it into their risk assessments
Experis | Wednesday, March 7, 2012
10
5
3/7/2012
Risk Velocity
Risk Velocity – Factors impacting velocity
• Speed of Onset – requires that organizations consider how quickly
a risk might occur and how much warning will an organization have
to prepare
• Speed of Impact – relates to how quickly and in what manner
an organization will be impacted by the onset
• Speed of Reaction – relates to an organization’s ability or agility
to see the risk coming and react in a timely manner
Source: “Graduate-Level Risk Assessment” , Paul Sobel, CIA, Internal Auditor Magazine, June 2010
Experis | Wednesday, March 7, 2012
11
Risk Velocity
Risk Velocity – Impact on Risk Assessment
• The concept of Risk Velocity can have a powerful impact on a
discussion of risk
• In most instances companies believe that risks are managed well,
especially those that could have a large impact on financial results
• Tendency to think in silos and not see the interdependencies
• It is not uncommon for organizations to take the view that the
likelihood of an event is low because a number of factors need
to occur for the worst to happen
• A dialogue around Risk Velocity together with a discussion of
interdependencies can begin with a simple question
Experis | Wednesday, March 7, 2012
12
6
3/7/2012
Risk Velocity
Risk Velocity – The Critical Question
What if …
• housing prices begin to fall?
• we fail to maintain our safety policies and procedures?
• our vendors and contractors fail to adequately perform?
• an earthquake disrupts our global supply chain?
• customer data is compromised?
• sensitive information is stolen and posted on line?
• commodity prices shift rapidly?
Experis | Wednesday, March 7, 2012
13
Risk Velocity
Risk Velocity – The Other Critical Questions
• Where do we fall along the Risk Maturity Model?
–
–
–
–
What is our risk culture and appetite for risk?
Do we have an existing risk assessment process and framework?
Is the framework built on a common set of principles and definitions?
Are senior management, the Board and other key stakeholders
engaged in the process?
• Do we possess the knowledge, skills and tools to:
–
–
–
–
–
Watch for and assess new risks on the horizon?
Have th
H
the capabilities
biliti to
t assess the
th interdependencies?
i t d
d
i ?
Determine the impact of events on our organization?
Assess our ability to respond to risk in a timely and effective manner?
Possess the mechanisms to share insights and enhance risk
management processes?
Experis | Wednesday, March 7, 2012
14
7
3/7/2012
Risk Velocity
Polling Question #2
Where is your organization along the Risk Maturity Model?
A.
Not yet started
B.
Early stages
C.
Sustainable
D.
Mature
Experis | Wednesday, March 7, 2012
15
Risk Velocity
Risk Maturity Model
• Perform GAP
analysis
• Develop
Governance
structure
• D
Develop
l
internal buy-in
and benefits
awareness
• Develop Risk
Universe and
language
• Execute a Risk
Assessment
Experis | Wednesday, March 7, 2012
• Assign
responsibility
for respective
risks
• Integrate into
strategic
initiatives
• Align with senior
leadership on
the key risks
• Initiate risk
reporting and
monitoring
Timeline
• Leverage Risk
Committee to
review
i
risks
i k and
d
the
effectiveness of
risk mitigation
• Evaluate risk
tolerances
and policies /
authorities
• Expand risk
reporting
• Integrate risk
based decisions
into mgmt’s daily
operations
• Integrate
Internal Audit
with ERM
assessment and
monitoring
• Adjust from
“cost/benefit”
cost/benefit to
“risk/reward”
decision process
• Leverage risk
management
to competitive
advantages in
the market
• Integrate
continuous
monitoring of
key risk
indicators into
risk reporting
16
8
3/7/2012
Risk Velocity
Integration of Impact, Likelihood and Velocity
• Begin by performing the traditional assessment of likelihood and impact
• Identify
Id if interdependencies
i
d
d
i between
b
kkey risks
i k
• Begin to ask the “What if” Scenarios to identify events that could impact
Velocity
• Identify the individuals and processes in place within the organization
responsible for detecting, monitoring and mitigating risks
• Consider the dimensions of Velocity relating to Onset, Monitoring and
g the effectiveness of these controls
Reaction in assessing
• Re-evaluate 2x2 rating based upon the assessment of Velocity
• Risk Velocity Sensing - Consider the speed at which risks will impact the
organization when prioritizing and escalating risks
Experis | Wednesday, March 7, 2012
17
Risk Velocity
Top Ten Risks – Likelihood, Impact & Velocity
Increased
Competitive
Pressure
Commodity Prices
High
Cost Reduction Pressure
Continued Recessionary Pressure
Strategic
Change
Management
Risk Velocity
Very Rapid
Likelihood
Impact of the risk would
be evident in a month
Rapid
Lack of Investment in Product Innovation
Impact of the risk would
be evident in a quarter
Business Continuity
Political Trends
Slow
Impact of the risk would
be evident in a year
Talent Risks
Regulatory Environment
Low
Impact
High
Methodology
The top 10 risks were identified based on how frequently and on what
priority executives marked these risks in their list of 5 top risks
Experis | Wednesday, March 7, 2012
Source: Corporate Executive Board Top
Ten Risks Likelihood, Impact Velocity,
Emerging Risk Update, June 2011
18
4
9
3/7/2012
Risk Velocity
Examples of Risk Velocity
• Sony – PlayStation Data Compromised
• Financial Institutions – Rogue Traders
• TJ Maxx – Credit Card data hacked
• Bank of America – Customers pushing back on newly announced fees
• Wikileaks – Rumors of reported data leaks
• Commodities – Gas, oil, food, cotton, etc.
(e g rapid price fluctuations )
(e.g.,
Experis | Wednesday, March 7, 2012
19
Risk Velocity
Risk Independencies
• Consider Velocity and Duration
– High Velocity but Short Duration
– High Velocity but a Longer Duration
• Incorporate velocity of competitor response into risk sensitivity
screening criteria for future projects
Experis | Wednesday, March 7, 2012
20
10
3/7/2012
Risk Velocity
Risk Velocity and the Role of Internal Audit
•
Risk Velocity Prioritization - Evaluate the speed of risks to appropriately prioritize
the audit schedule
•
Risk Velocity Mitigation - Review mitigation plans through a risk velocity lens
to ensure mitigation plans are aligned against timely and high-impact risks
•
Responsibility and Accountability Framework - Clearly assign responsibilities
and develop a system of checks and balances to ensure the validity of risk data
•
Assess the effectiveness of key processes and KPIs to serve as a
monitoring system
•
p
risk velocity
y into risk p
prioritization criteria
Incorporate
•
Misguided focus on risk detection rather than risk agility
•
Spend less time on risk assessment and more time on building effective
risk response capabilities
•
Educate and share insights with others in the organization
Experis | Wednesday, March 7, 2012
21
Risk Velocity
Polling Question #3
When considering Risk Velocity it is important to consider which of the
following factors?
A. Maturity of the organization in assessing and monitoring risks
B. Quality and effectiveness of businesses processes and
performance data
C. Ability of the organization to respond to rapidly changing risks
D. All of the above
Experis | Wednesday, March 7, 2012
22
11
3/7/2012
Risk Velocity
Questions
Experis | Wednesday, March 7, 2012
23
Risk Velocity
For more information
Alec Arons, Director of Risk Advisory Services
Experis Finance – Philadelphia Office
[email protected]
(267) 765-2677
Timothy Lietz, Director of Risk Advisory Services
E
Experis
i Finance
Fi
– Raleigh
R l i h Offi
Office
[email protected]
(336) 706-2030
Experis | Wednesday, March 7, 2012
24
12
3/7/2012
Risk Velocity
About Experis Finance
Experis™ Finance delivers innovative project solutions and
professional resourcing services in the areas of risk advisory,
tax and finance & accounting – enabling organizations
to accelerate their business performance
Experis | Wednesday, March 7, 2012
25
13