Miles CMA Review - Class Notes to Wiley CMAexcel Learning System Part 2, Section D

Section D
Risk Management

D.1) Enterprise Risk

I) Risk and Expected Loss
II) Enterprise Risk Management

D-1
Miles CMA Review - Class Notes to Wiley CMAexcel Learning System Part 2, Section D

Section D: Risk Management

Risk management is a required component of decision making and pricing. The objective of risk
management is to reduce risk to an acceptable level. The management accountant is often involved in
the assessment and management of risk. In particular, management accountants help identify threats
to the organization and their probabilities, controls against the threats and their effectiveness, and the
losses incurred by not preventing or detecting threats prior to their occurrence.

This section features one topic:

Topic D1: Enterprise Risk

D.1) Enterprise Risk

This topic looks at:

I) Risk and Expected Loss
II) Enterprise Risk Management

D-2
 Miles CMA Review - Class Notes to Wiley CMAexcel Learning System Part 2, Section D

I) Risk and Expected Loss

 In a business context, risk is defined as the level of exposure to a chance of loss. For example, if a
company determines that a particular risk could result in a loss of up to $50,000, then the company
would be willing to spend up to $50,000 to mitigate the risk. The amount of the loss calculated by
the company represents the maximum possible loss (extreme or catastrophic loss). This loss is
often referred to as the value at risk (VaR)
 VaR includes:
 Cash flow at risk
 Earnings at risk
 Earnings per share (EPS) distributions (mean and variance)

 Value at Risk (VaR) is the maximum loss within a given period of time and given a specified
probability level (level of confidence). Unlike retrospective risk metrics that measure historical
volatility, VaR is prospective. It quantifies market risk while it is being taken. VaR is
characterized by:
 Application - Can be applied to any portfolio that can reasonably be marked to market
performance on a regular basis; is not applicable to real estate or other non-liquid assets
 Timeframe/Horizon - Evaluates a portfolio’s performance over a specific period of time such
as a trading day, week or a month
 Base Currency - Measures risk in currency; any currency can be used
 VaR Measurement - VaR measure summarizes a portfolio’s market risk with a single number

 VaR can be calculated using any of the following methods [Note: Note that Value at Risk
calculations are not required on the CMA exam]
 Historical Method - Re-organizes actual historical returns for a time period by putting them
in order from worst to best. A histogram plot correlates frequency of returns with losses.
Resulting level of confidence provides a percentage that a worst-case scenario for a daily
loss will not exceed
 Variance-Covariance Method: Assumes that stock returns are normally distributed.
Expected (or average) return and a standard deviation are estimated and a normal
distribution curve is plotted. Normal curve shows where the worst percentages lie on the
curve. The percentages looked at are a function of desired confidence and the standard
deviation
 Monte Carlo Simulation: Refers to any method that randomly generates trials; involves
developing a model for future returns and running multiple hypothetical trials through the
model

D-3
Miles CMA Review - Class Notes to Wiley CMAexcel Learning System Part 2, Section D

 Types of Risk - Risks can be any of the following types:

 Hazard - Related to natural disasters such as storms, floods, hurricanes, blizzards and
earthquakes
 Financial - Caused by debt/equity decisions related to financing the business. They include
liquidity (short-term bill paying) and solvency (long-term bill paying) risks usually controlled
through adequate financial and capital reserves
 Operational - Related to the relationship of fixed and variable costs in the organization’s cost
structure as well as to internal process failures, system failures, personnel, legal and
compliance
 Strategic - Related to the impact on earnings or capital coming from adverse business decisions,
improper implementation of decisions, or lack of responsiveness to industry changes

 Risks are a function of volatility (variability) and time

 Increased volatility, such as variability in expected returns, translates into increased risk
 The longer the time frame, the more the uncertainty, and consequently, the higher the risk.
Shorter time frames imply lower risk

D-4
 Miles CMA Review - Class Notes to Wiley CMAexcel Learning System Part 2, Section D

II) Enterprise Risk Management (ERM)

Overview of ERM
 COSO published the “Enterprise Risk Management - Integrated Framework” in 2004. In Sep 2017,
the framework was updated and now titled “Enterprise Risk Management - Integrating with
Strategy and Performance”. The framework: 2017 Framework
 Defines ERM as: “The culture, capabilities, and practices, integrated with strategy-setting and
its performance, that organizations rely on to manage risk in creating, preserving, and realizing
value”
 Provides a framework for boards and management in entities of all sizes, and builds on the
current level of risk management that exists in the normal course of business
 Highlights the importance of considering risk in both the strategy-setting process and in driving
performance
 Demonstrates how integrating ERM practices throughout an entity helps to accelerate
growth and enhance performance
 Also contains principles that can be applied - from strategic decision-making to performance

 Management’s Guide to ERM - Management holds overall responsibility for managing risk to the
entity, but it is important for management to go further: to enhance the conversation with the
board and stakeholders about using ERM to gain a competitive advantage. That starts by deploying
ERM capabilities as part of selecting and refining a strategy
 Through this process, management will gain a better understanding of how the explicit
consideration of risk may impact the choice of strategy
 ERM enriches management dialogue by adding perspective to the strengths and
weaknesses of a strategy as conditions change, and to how well a strategy fits with the
organization’s mission and vision
 ERM allows management to feel more confident that they’ve examined alternative
strategies and considered the input of those in their organization who will implement the
strategy selected
 Once strategy is set, ERM provides an effective way for management to fulfill its role, knowing
that the organization is attuned to risks that can impact strategy and is managing them well
 Applying ERM helps to create trust and instill confidence in stakeholders in the current
environment, which demands greater scrutiny than ever before about how risk is actively
addressing and managing these risks
 Questions for management - Can all of management - not just the chief risk officer - articulate
how risk is considered in the selection of strategy or business decisions? Can they clearly
articulate the entity’s risk appetite and how it might influence a specific decision?
 The resulting conversation may shed light on what the mindset for risk taking is really like in
the organization

D-5
Miles CMA Review - Class Notes to Wiley CMAexcel Learning System Part 2, Section D

 Board’s Guide to ERM - Every board has an oversight role, helping to support the creation of value
in an entity and prevent its decline. Traditionally, ERM has played a strong supporting role at the
board level. Now, boards are increasingly expected to provide oversight of ERM
 ERM framework supplies important considerations for boards in defining and addressing their
risk oversight responsibilities. These considerations include:
 Culture & Governance
 Risk Management leading to Performance
 Information, communications & reporting
 Monitoring (i.e., Review & Revision)
 Enterprise Strategy & Objective-setting
 The board’s risk oversight role may include, but is not limited to:
 Reviewing, challenging, and concurring with management on:
 Proposed strategy and risk appetite
 Alignment of strategy and business objectives with the entity’s stated mission, vision,
and core values
 Significant business decisions including M&A, capital allocations, funding, and dividend-
related decisions
 Response to significant fluctuations in entity performance or the portfolio view of risk
 Responses to instances of deviation from core values
 Approving management incentives and remuneration
 Participating in investor & stakeholder relations
 Over the longer term, ERM can also enhance enterprise resilience (i.e., the ability to anticipate
and respond to change)
 Helps organizations identify factors that represent not just risk, but change, and how that
change could impact performance and necessitate a shift in strategy
 Provides the right framework for boards to assess risk and embrace a mindset of resilience
 By seeing change more clearly, an organization can fashion its own plan; e.g., should it
defensively pull back or invest in a new business?

 Few facts relating to ERM (based on few misconceptions about ERM):

 ERM is not a function or department - It is the culture, capabilities, and practices that
organizations integrate with strategy-setting and apply when they carry out that strategy, with
a purpose of managing risk in creating, preserving, and realizing value
 ERM is more than a risk listing (i.e., taking an inventory of all the risks within the organization) -
It is broader and includes practices that management puts in place to actively manage risk
 ERM addresses more than I/C - It also addresses other topics such as strategy-setting,
governance, communicating with stakeholders, and measuring performance. Its principles
apply at all levels of the organization and across all functions
 ERM is not a checklist - It is a set of principles on which processes can be built or integrated for
a particular organization, and it is a system of monitoring, learning, and improving performance
 ERM can be used by organizations of any size - If an organization has a mission, a strategy, and
objectives - and the need to make decisions that fully consider risk - then ERM can be applied. It
can and should be used by all kinds of organizations, from small businesses to community-
based social enterprises to government agencies to Fortune 500 companies
D-6
 Miles CMA Review - Class Notes to Wiley CMAexcel Learning System Part 2, Section D

 Benefits of ERM - All organizations need to set strategy and periodically adjust it, always staying
aware of both ever-changing opportunities for creating value and the challenges that will occur in
pursuit of that value. To do that, they need the best possible framework for optimizing strategy and
performance. That’s where ERM comes into play.
Organizations that integrate ERM throughout the entity can realize many benefits (few of which are
listed below), which highlight the fact that risk should not be viewed solely as a potential constraint
or challenge to setting and carrying out a strategy. Rather, the change that underlies risk and the
organizational responses to risk give rise to strategic opportunities and key differentiating
capabilities. Benefits of ERM include, but are not limited to:
 Increasing the range of opportunities - By considering all possibilities (both positive and
negative aspects of risk), management can identify new opportunities and unique challenges
associated with current opportunities
 Identifying and managing risk entity-wide - Every entity faces myriad risks that can affect many
parts of the organization. Sometimes a risk can originate in one part of the entity but impact a
different part. Consequently, management identifies and manages these entity-wide risks to
sustain and improve performance
 Increasing positive outcomes and advantage while reducing negative surprises - ERM allows
entities to improve their ability to identify risks and establish appropriate responses, reducing
surprises and related costs or losses, while profiting from advantageous developments
 Reducing performance variability - For some, the challenge is less with surprises and losses and
more with variability in performance. Performing ahead of schedule or beyond expectations
may cause as much concern as performing short of scheduling and expectations. ERM allows
organizations to anticipate the risks that would affect performance and enable them to put in
place the actions needed to minimize disruption and maximize opportunity
 Improving resource deployment - Every risk could be considered a request for resources.
Obtaining robust information on risk allows management, in the face of finite resources, to
assess overall resource needs, prioritize resource deployment and enhance resource allocation
 Enhancing enterprise resilience - An entity’s medium- and long-term viability depends on its
ability to anticipate and respond to change, not only to survive but also to evolve and thrive.
This is, in part, enabled by effective ERM. It becomes increasingly important as the pace of
change accelerates and business complexity increases

D-7
Miles CMA Review - Class Notes to Wiley CMAexcel Learning System Part 2, Section D

 The Role of Risk in Strategy Selection

 Strategy selection is about making choices and accepting trade-offs. So it makes sense to apply
ERM to strategy as that is the best approach for making well-informed choices
 Risk is a consideration in many strategy-setting processes. But risk is often evaluated primarily
in relation to its potential effect on an already-determined strategy. In other words, the
discussions focus on risks to the existing strategy: We have a strategy in place, what could
affect the relevance and viability of our strategy?
 But there are other questions to ask about strategy, which organizations are getting better at
asking: Have we modeled customer demand accurately? Will our supply chain deliver on time
and on budget? Will new competitors emerge? Is our technology infrastructure up to the task?
These are the kinds of questions that executives grapple with every day, and responding to
them is fundamental to carrying out a strategy
 However, the risk to the chosen strategy is only one aspect to consider. Per ERM framework,
there are two additional aspects to ERM that can have far greater effect on an entity’s value:
 Possibility of strategy not aligning with an organization’s mission, vision, and core values
 Mission, vision, and core values have been demonstrated to matter - and they matter
most when it comes to managing risk and remaining resilient during periods of change
 A chosen strategy must support the organization’s mission and vision. A misaligned
strategy increases the possibility that the organization may not realize its mission and
vision, or may compromise its values, even if a strategy is successfully carried out.
Therefore, ERM considers the possibility of strategy not aligning with the mission and
vision of the organization
 Implications from the strategy chosen as each alternative strategy has its own risk profile
 The board of directors and management need to determine if the strategy works in
tandem with the organization’s risk appetite, and how it will help drive the organization
to set objectives and ultimately allocate resources efficiently
 ERM has typically helped many organizations identify, assess and manage risks to strategy. But
the most significant causes of value destruction are embedded in the possibility of the strategy
not supporting the entity’s mission and vision, and the implications from the strategy
 ERM enhances strategy selection. Choosing a strategy calls for structured decision-making
that analyzes risk and aligns resources with the mission and vision of the organization
 The figure below illustrates these considerations in the context of mission, vision, core
values, and as a driver of an entity’s overall direction and performance

D-8
 Miles CMA Review - Class Notes to Wiley CMAexcel Learning System Part 2, Section D

Components of ERM = {CRIME}

Under COSO’s ERM updated 2017 Framework, ERM consists of 5 components {CRIME}:
"C" is the foundation for CRIME
C

Culture & Governance

E R
Enterprise Strategy & Risk & Performance
Objective-setting

M I
Monitoring (i.e., Review & Information, Communication
Revision) & Reporting

The 5 inter-related components in the updated Framework are supported by a set of 20 principles.
These principles cover everything from governance to monitoring. They’re manageable in size, and
they describe practices that can be applied in different ways for different organizations regardless of
size, type, or sector. Adhering to these principles can provide management and the board with a
reasonable expectation that the organization understands and strives to manage the risks associated
with its strategy and business objectives. The 20 principles are:
Culture & Risk & Performance Information, Monitoring (i.e., Enterprise Strategy
Governance Communication & Review & Revision) & Objective-setting
Reporting
- Exercises Board - Identifies Risk - Leverages - Assesses - Analyzes Business
Risk Oversight Information and Substantial Change Context
- Assesses Severity
Technology
- Establishes of Risk - Reviews Risk and - Defines Risk
Operating - Communicates Performance Appetite
- Prioritizes Risks
Structures Risk Information
- Pursues - Evaluates
- Implements Risk
- Defines Desired - Reports on Risk, Improvement in Alternative
Responses
Culture Culture, and ERM Strategies
- Develops Portfolio Performance
- Demonstrates - Formulates
View
Commitment to Business Objectives
Core Values
- Attracts, Develops,
and Retains Capable
Individuals

D-9
Miles CMA Review - Class Notes to Wiley CMAexcel Learning System Part 2, Section D

CRIME
 Culture & Governance
 Together form the basis for all other ERM components
 Governance sets the organization’s tone, reinforcing the importance of, and establishing
oversight responsibilities for, ERM
 Culture is reflected in decision-making and pertains to ethical values, desired behaviors, and
understanding of risk in the entity
 Principles (as per the updated 2017 framework):
 Exercises Board Risk Oversight - The board of directors provides oversight of the strategy
and carries out governance responsibilities to support management in achieving strategy
and business objectives
 Establishes Operating Structures - The organization establishes operating structures in the
pursuit of strategy and business objectives. Operating structure is typically aligned with:
 Legal structure - influences how an entity operates, and
 Management structure - sets out the reporting lines, roles & responsibilities for ongoing
management & operation of the business
 Defines Desired Culture - The organization defines the desired behaviors that characterize
the entity’s desired culture
 Organization’s culture reflects its core values, behaviors, and decisions; and influences
how the organization applies the ERM framework: how it identifies risk, what types of
risk it accepts, and how it manages risk
 Many factors shape entity culture
(a) Internal factors - like level of judgment & autonomy provided to personnel, how
entity employees interact with each other and their managers, the standards and
rules, the physical layout of the workplace, reward system in place
(b) External factors - like regulatory requirements, expectations of customers, investors
 All these factors influence where the entity positions itself on the culture spectrum,
which ranges from risk averse to risk aggressive
Nuclear Private
power plant equity fund
(a) The closer an entity is to the risk aggressive end of the spectrum, the greater is its
propensity for and acceptance of the differing types and greater amount of risk to
achieve strategy and business objectives
 Changes within the organization and external influences may cause an entity’s culture to
shift (e.g., change in leadership, M&As, growth from start-up to mature organization)
 Demonstrates Commitment to Core Values - The organization demonstrates a commitment
to the entity’s core values; also, embraces a risk-aware culture, enforces accountability, and
keeps communication open (and free from retribution)
 E.g., Deviations to Core Values - For a pharmaceutical company, if R&D did not disclose
all potential side effects of a new drug to management (i.e., violates the core values),
and management launches the drug, it could lead to severe adverse effects to the entity
 Attracts, Develops, and Retains Capable Individuals - The organization is committed to
building human capital in alignment with the strategy and business objectives
 E.g., Aligning business objectives (e.g., quantity targets, quality, customer satisfaction)
with incentives & rewards may lead to greater employee accountability
D-10
 Miles CMA Review - Class Notes to Wiley CMAexcel Learning System Part 2, Section D

CRIME
 Risk & Performance
 Need to identify & assess risks that may impact the achievement of strategy and business
objectives. Risks are prioritized by severity in the context of risk appetite. The organization then
selects risk responses and takes a portfolio view of the amount of risk it has assumed. The
results of this process are reported to key risk stakeholders
 Principles (as per the updated 2017 framework):
 Identifies Risk - The organization identifies risk that impacts the performance of strategy
and business objectives
 E.g., Using a Risk Inventory whereby the below chart illustrates how risks that impact
different levels of the entity form part of the risk inventory:

(a) Risk 1 potentially impacts the strategy directly

(b) Risk 2 impacts the entity business objectives
(c) Risk 3 impacts multiple business objectives that then aggregate and impact entity
business objectives
(d) Risk 4 impacts a single business objective and that also impacts entity business
objectives
 Assesses Severity of Risk - The organization assesses the severity of risk
 E.g., Using a “heat map” to highlight the relative severity of the assessed risk (using a
likelihood/impact matrix). The various combinations of likelihood and impact (severity
measures), given the risk appetite, are color coded to reflect a particular level of severity
(i.e., darker the shade, higher the severity of risk)
Thus, Risk 1 is more severe than Risk 2 which is, in turn, more severe than Risks 3 & 4

4
Likelihood Rating

3
Risk 4 Risk 1
2
Risk 3 Risk 2
1
1 2 3 4
Impact Rating
D-11
Miles CMA Review - Class Notes to Wiley CMAexcel Learning System Part 2, Section D

 Prioritizes Risks - The organization prioritizes risks as a basis for selecting responses to risks
 Priorities are determined by applying agreed-upon criteria including:
(a) Adaptability - Capacity of an entity to adapt and respond to risks
(b) Complexity - Scope and nature of a risk to the entity’s success (e.g., risks of product
obsolescence to entity’s objective of being market leader in customer satisfaction)
(c) Velocity - Speed at which a risk impacts an entity (e.g., risk of disruptions due to
strikes by port & customs officers affecting the objective relating to efficient supply
chain management)
(d) Persistence - How long a risk impacts an entity (e.g., the persistence of adverse
media coverage and impact on sales objectives following the identification of
potential brake failures and subsequent global car recalls)
(e) Recovery - Capacity of an entity to return to tolerance (e.g., continuing to function
after a severe flood or other natural disaster). Recovery excludes the time taken to
return to tolerance, which is considered part of persistence, not recovery
 Prioritization takes into account the severity of the risk compared to risk appetite.
Greater priority may be given to those risks likely to approach or exceed risk appetite.
E.g., A utility company’s mission is to be the most reliable electricity provider in its
region. A recent increase in frequency & persistence of power outages indicates that the
entity is approaching its risk appetite and is less likely to achieve its business objectives
of providing reliable service. This situation triggers a heightened priority for the risk
 Implements Risk Responses - The organization identifies and selects risk responses. May:
 Accept - No action is taken to change the severity of the risk
(a) Esp. if the risk is already within risk appetite
(b) If risk is outside the entity’s risk appetite that management seeks to accept,
generally approval is required from the board or other oversight bodies
 Avoid - Action is taken to remove the risk
(a) E.g., Cease a product line, decline to expand to a new market, sell a division
(b) Suggests that the organization was not able to identify a response that would reduce
the risk to an acceptable level of severity
 Pursue - Action is taken that accepts increased risk to achieve improved performance
(a) E.g., Adopt more aggressive growth strategies, expand operations, develop new
products and services
(b) When choosing to pursue risk, management understands the nature & extent of any
changes required to achieve desired performance while not exceeding the
boundaries of acceptable tolerance
 Reduce - Action is taken to reduce the severity of the risk
(a) Involves any of myriad everyday business decisions that reduces risk to an amount
of severity aligned with the target residual risk profile and risk appetite
 Share / Transfer - Action is taken to reduce the severity of the risk by transferring or
otherwise sharing a portion of the risk
(a) E.g., Outsourcing, insurance, hedging
(b) As with the “reduce” response, sharing risk lowers residual risk in alignment with
risk appetite
D-12
 Miles CMA Review - Class Notes to Wiley CMAexcel Learning System Part 2, Section D

 Develops Portfolio View - The organization develops and evaluates a portfolio view of risk.
 E.g., Portico Co. organization develops the following portfolio view:

Few observations by Portico Co. based on the portfolio view:

(a) Severity of technology disruptions increases as risks are progressively aggregated,
recognizing the reliance that multiple businesses have on common operating
systems and technology
(b) Risk of counterparty defaults decrease in severity as the entity does not have a
single creditor considered large enough to impact the entity as a whole
(c) Risk of low sales from multiple operating units may act as a natural hedge where low
sales in one operating unit are offset by strong sales in another
(d) Risk of currency fluctuations may also act as a natural hedge where currency
changes in one country offset changes in another
(e) Strong positive correlation between risk of product recalls and the risk of compliance
breaches increases the priority of risk responses to both risks
(f) Strong positive correlation between the business objectives requires investing in
best-in-class technology solutions and minimizes losses and inefficiencies that are
taken into account when selecting associated risk responses

D-13
Miles CMA Review - Class Notes to Wiley CMAexcel Learning System Part 2, Section D

 Information, Communication & Reporting CRIME

 ERM requires a continual process of obtaining and sharing necessary information, from both
internal and external sources, which flows up, down, and across the organization
 Principles (as per the updated 2017 framework):
 Leverages Information Systems - The organization leverages the entity’s information and
technology systems to support ERM
 Using “relevant info” helps organizations be more agile in their decision-making, giving
them a competitive advantage. E.g., Info regarding other components of ERM
(a) For C - may need info on the standards of conduct & individual performance
(b) For R - may need info on competitors to assess changes in the amount of risk
(c) For M - may need info on emerging trends in ERM
(d) For E - may need info on stakeholder expectations of risk appetite
 Evolving Info - Data transformed into info may come from both:
(a) Structured sources - highly organized & readily searchable; e.g., database files,
public indexes, spreadsheets
(b) Unstructured sources - not organized & no predefined data pattern; e.g., emails,
photos, videos, word documents
 Using Technology - Data analytics historically relied on pre-defined patterns to convert
data to info. Now, advances in cognitive computing, such as artificial intelligence, data
mining, and machine learning can collect, convert & analyze large volumes of
unstructured data into info that helps organizations make better business decisions.
These advances, combined with human analysis, allow management greater insight
(a) E.g., Using unstructured info in decision-making via use of technology - A consumer
retailer uses artificial intelligence to gather insights about consumers through social
media (e.g., purchasing behavior including historical patterns & preferences). These
insights provide a better view to the right inventory levels - thus, reducing the risk of
over- or understocking inventory.
 E.g. of Data sources (structured as well as unstructured)
Sources Examples of Data Structured Unstructured
Board & management Meeting minutes and notes ✓
Customer satisfaction Feedback from priority customers ✓ ✓
survey
Email Information relating to decision- making ✓
and entity performance
Government-produced Population changes in emerging markets ✓
geopolitical reports
Manufacturer reports Emerging interest in products shipped ✓
from a competing manufacturer
Marketing reports from # of website visits, duration on a page, ✓
website tracking services conversions into customer purchases
Public indexes Data from water scarcity index for ✓ ✓
beverage manufacturer or agriculture
company considering new locations
Social media and blogs Feedback & count of negative & positive ✓ ✓
comments on a company’s new product
D-14
 Miles CMA Review - Class Notes to Wiley CMAexcel Learning System Part 2, Section D

 Communicates Risk Information - The organization uses communication channels to

support ERM
 Communicating with Stakeholders - E.g.,
(a) Holding quarterly analyst meetings to discuss performance
(b) Customers and suppliers can provide input on the design or quality of products or
services (incoming info provided entity has open communication channels)
(c) Communicating the entity’s strategy and business objectives clearly throughout the
organization so that all personnel at all levels understand their individual roles
 Communicating with the Board - Effective communication between the board of
directors and management is critical
 Reports on Risk, Culture, and Performance - The organization reports on risk, culture, and
performance at multiple levels and across the entity
 Identifying report users who may include
(a) Management and board of directors responsible for governance and oversight
(b) Risk owners accountable for the effective management of identified risks
(c) Assurance providers (like external auditors, internal auditors)
(d) External stakeholders (regulators, rating agencies, community groups, and others)
 Risk reporting may include any/all of the following:
(a) Portfolio view of risk - outlines the severity of the risks at the entity level that may
impact the achievement of strategy and business objectives. Typically found in
management and board reporting
(b) Profile view of risk - similar to the portfolio view, outlines the severity of risks, but
focuses on different levels within the entity (e.g., risk profile of a division)
(c) Analysis of root causes - helps understand assumptions & changes underpinning the
portfolio & profile views of risk
(d) Sensitivity analysis - measures sensitivity of changes in key assumptions embedded
in strategy and the potential effect on strategy and business objectives
(e) Analysis of new, emerging, and changing risks - provides forward-looking view to risk
(f) Key performance indicators & measures - outline the tolerance of the entity and
potential risk to a strategy or business objective
(g) Trend analysis - demonstrates movements and changes in the portfolio view of risk,
risk profile, and performance of the entity
(h) Disclosure of incidents, breaches, and losses - provides insight into effectiveness of
risk responses
(i) Tracking ERM plans & initiatives
 Key indicators - used to predict a risk manifesting. Can be reflected in the same measure
as key performance indicators
(a) E.g., In a manufacturing entity, production volumes and the thresholds around them
can be viewed through a risk lens. Production volumes above the target can be seen
as potential risks to quality, and production volumes below the target can suggest
potential risk such as supplier delays, labor shortages, or equipment downtime

D-15
Miles CMA Review - Class Notes to Wiley CMAexcel Learning System Part 2, Section D

CRIME
 Monitoring (i.e., Review & Revision)
 By reviewing entity performance, an organization can consider how well the ERM components
are functioning over time and in light of substantial changes, and what revisions are needed
 Principles (as per the updated 2017 framework) :
 Assesses Substantial Change - The organization identifies and assesses changes that may
substantially affect strategy and business objectives.
 E.g., Changes in:
(a) Internal Environment - rapid growth, innovation, substantial changes in leadership &
personnel
(b) External Environment - changing regulatory environment, changing economic
environment
 Reviews Risk and Performance - The organization reviews entity performance and
considers risk
 By reviewing performance, organizations seek answers to questions such as:
(a) Has the entity performed as expected and achieved its target?
(b) What risks are occurring that may be affecting performance?
(c) Was the entity taking enough risk to attain its target?
(d) Was the estimate of the amount of risk accurate?
 If an organization determines that performance does not fall within its acceptable
variation, or that the target performance results in a different risk profile than what was
expected, it may need to:
(a) Review business objectives
(b) Review strategy
(c) Review culture
(d) Revise target performance
(e) Reassess severity of risk results
(f) Review how risks are prioritized
(g) Revise risk responses
(h) Revise risk appetite
 Considering Entity Capabilities - Part of reviewing performance is considering the
organization’s capabilities and their effect on performance
(a) The organization must answer questions like:
(i) If performance targets are not being met, is it because of insufficient
capabilities?
(ii) If targets are being exceeded, is it because corrective action is required?
(b) Corrective action may include reallocating resources, revising business objectives, or
exploring alternative strategies
 Pursues Improvement in ERM - The organization pursues improvement of ERM
 Management should pursue improvement throughout the entity (functions, operating
units, divisions) to improve the efficiency and usefulness of ERM at all levels

D-16
 Miles CMA Review - Class Notes to Wiley CMAexcel Learning System Part 2, Section D

 Enterprise Strategy & Objective-setting

CRIME
 In the strategic planning process, ERM, strategy, and objective-setting work together
 A risk appetite is established and aligned with strategy;
 Business objectives put strategy into practice while serving as a basis for identifying,
assessing, and responding to risk
 Principles (as per the updated 2017 framework):
 Analyzes Business Context - The organization considers potential effects of business
context on risk profile
 Business context - trends, relationships, etc. that influence an organization’s current and
future strategy and business objectives. May be:
(a) Dynamic esp. with new emerging risks (e.g., a new competitor causing disruption)
(b) Complex (e.g., operating units in many countries with unique regulations & tax laws)
(c) Unpredictable (e.g., currency fluctuations and political forces)
 Defines Risk Appetite - The organization defines risk appetite in the context of creating,
preserving, and realizing value
 Many organizations develop strategy and risk appetite in parallel, refining each
throughout strategy-setting
 Some entities consider risk appetite in qualitative terms while others prefer to use
quantitative terms, often focusing on balancing growth, return, and risk
 On any depiction of risk profile, organizations may also plot risk capacity which is the
maximum amount of risk an entity is able to absorb in the pursuit of strategy and
business objectives. Typically, risk appetite is equal to or less than the risk capacity
 E.g. of Risk Appetite Expressions:
(a) Target: A credit union with a low risk appetite for loan losses cascades this message
into the business by setting a loan loss target of 0.50% of overall loan portfolio
(b) Range: A medical supply company operates within a low overall risk range. Its lowest
risk appetite relates to safety & compliance objectives (e.g., employee health &
safety), with a marginally higher risk appetite for its strategic, reporting, and
operations objectives. This means reducing risks originating from various medical
systems, products, equipment, and the work environment, and meeting legal
obligations that take priority over other business objectives
(c) Ceiling: A university accepts a moderate risk appetite as it seeks to expand the scope
of its offerings and will favor new programs where it has or can readily attain the
capabilities to deliver them. However, the university will not accept programs that
present severe risk to the university mission and vision, forming a ceiling on
acceptable decisions
(d) Floor: A technology company has aggressive goals for growth in its sector and
recognizes that such growth requires significant capital investment. While it does
not accept investing capital unwisely, management is of the view that, as a
minimum, 25% (i.e., the floor) of the operating budget should be allocated to the
pursuit of technology innovation

D-17
Miles CMA Review - Class Notes to Wiley CMAexcel Learning System Part 2, Section D

 Evaluates Alternative Strategies - The organization evaluates alternative strategies and

potential impact on risk profile
 Assess the risk & opportunities of each alternative strategy
 Assess alternative strategies in the context of the organization’s resources & capabilities
to create, preserve & realize value. Evaluate strategies from two different perspectives:
(a) Possibility that the strategy does not align with entity’s mission, vision & core values,
(b) Implications from the chosen strategy
 E.g., A global camera manufacturer used to sell film cameras, but as digital cameras
became more popular, the company started to experience lower sales. In response, it
has modified its strategy by adapting to a changing consumer need and new technology.
It now develops digital cameras and mitigates the risk that its products may become
obsolete
 Formulates Business Objectives - The organization considers risk while establishing the
business objectives at various levels that align and support strategy
 E.g., Business objectives may relate to:
(a) Financial performance - Maintain profitable operations for all businesses.
(b) Customer aspirations - Establish customer care centers in convenient locations
(c) Operational excellence - Pay attractive salaries to retain employees
(d) Compliance obligations - Comply with applicable health & safety laws
(e) Efficiency gains - Operate in an energy-efficient environment
(f) Innovation leadership - Lead innovation with frequent new product launches
 Individual objectives are aligned with strategy regardless of how the objective is
structured and where it is applied. The alignment of business objectives to strategy
supports the entity in achieving its mission and vision
(a) Business objectives that do not align, or only partially align, to the strategy will not
support the achievement of the mission and vision and may introduce unnecessary
risk to the risk profile of the entity.
(b) Business objectives should also align with the entity’s risk appetite. If they do not,
the organization may be accepting either too much or too little risk
 Set targets & tolerances
(a) Targets - Enable monitoring of the entity’s performance and support the
achievement of business objectives
(b) Tolerances - Acceptable variation in performance; describes the range of acceptable
outcomes related to achieving a business objective within the risk appetite
(c) E.g.,
Entity type Business Objective Target Tolerance
Asset Return on investment Target 5% annual 3% to 7% annual
Management Co. (ROI) return on its portfolio return
Restaurant On-line home delivery Target delivery within 30- to 50-minute
orders 40 minutes delivery time
Call center Minimize missed calls Target 2% of overall 1% to 5% of overall
calls calls

D-18
 Miles CMA Review - Class Notes to Wiley CMAexcel Learning System Part 2, Section D

Assessing ERM

 An organization should have a means to reliably provide to the entity’s stakeholders with a
reasonable expectation that it is able to manage risk to an acceptable amount. It does this by
assessing the ERM practices that are in place. Such assessment is voluntary, unless required
otherwise by legislation or regulation

 ERM framework provides criteria for conducting an assessment and determining whether the ERM
culture, capabilities, and practices collectively manage the risk of not achieving the entity’s strategy
and supporting business objectives
 During an assessment, the organization considers whether:
 The components and principles relating to ERM are present and functioning
 The components relating to ERM are operating together in an integrated manner
 The controls necessary to put into effect relevant principles are present and functioning
 In these three considerations, being "present" means the components, principles, and controls
exist in the design and implementation of ERM to achieve strategy and business objectives.
Being "functioning" means they continue to operate to achieve strategy and business
objectives. And "operating together" refers to the interdependencies of components and how
they function cohesively.
 Organizations may place different emphasis on specific principles and apply them differently,
depending on the benefits an organization seeks to attain through ERM. When these
components, principles, and supporting controls are present and functioning, the organization
can reasonably expect that ERM is helping the entity create, preserve, and realize value.

 Different approaches are available for assessing ERM

 When the assessment is performed to communicate to external stakeholders, it would be
conducted considering the principles set out in the framework
 When assessing ERM for internal purposes, some organizations may choose to use some form
of maturity model in completing this evaluation, recognizing that the model must be tailored to
address the complexity of the business
 Factors that add complexity may include, among other things, the entity’s geography,
industry, nature, extent and frequency of change within the entity, historical performance
and variation in performance, reliance on technology, and the extent of regulatory
oversight

 During an assessment, management may also review the suitability of those capabilities and
practices, keeping in mind the entity’s complexity and the benefits the organization seeks to attain
through ERM

D-19
Miles CMA Review - Class Notes to Wiley CMAexcel Learning System Part 2, Section D

ERM - Looking into the future

 There is no doubt that organizations will continue to face a future full of volatility, complexity, and
ambiguity. ERM will be an important part of how an organization manages and prospers through
these times. Regardless of the type and size of an entity, strategies need to stay true to their
mission. And all entities need to exhibit traits that drive an effective response to change, including
agile decision-making, the ability to respond in a cohesive manner, and the adaptive capacity to
pivot and reposition while maintaining high levels of trust among stakeholders.

 As we look into the future, there are several trends that will have an effect on ERM. Just four of
these are:
 Dealing with the proliferation of data - As more and more data becomes available and the
speed at which new data can be analyzed increases, ERM will need to adapt. The data will come
from both inside and outside the entity, and it will be structured in new ways. Advanced
analytics and data visualization tools will evolve and be very helpful in understanding risk and
its impact—both positive and negative
 Leveraging artificial intelligence and automation - Many people feel that we have entered the
era of automated processes and artificial intelligence. Regardless of individual beliefs, it is
important for ERM practices to consider the impact of these and future technologies, and
leverage their capabilities. Previously unrecognizable relationships, trends and patterns can be
uncovered, providing a rich source of information critical to managing risk
 Managing the cost of risk management - A frequent concern expressed by many business
executives is the cost of risk management, compliance processes, and control activities in
comparison to the value gained. As ERM practices evolve, it will become important that
activities spanning risk, compliance, control, and even governance be efficiently coordinated to
provide maximum benefit to the organization. This may represent one of the best opportunities
for ERM to redefine its importance to the organization
 Building stronger organizations - As organizations become better at integrating ERM with
strategy and performance, an opportunity to strengthen resilience will present itself. By
knowing the risks that will have the greatest impact on the entity, organizations can use ERM to
help put in place capabilities that allow them to act early. This will open up new opportunities.

 In summary, ERM will need to change and adapt to the future to consistently provide the benefits
outlined in the Framework. With the right focus, the benefits derived from ERM will far outweigh
the investments and provide organizations with confidence in their ability to handle the future

D-20
 Miles CMA Review - Class Notes to Wiley CMAexcel Learning System Part 2, Section D

Summary of COSO Framework Components

Internal Control Framework - 2013 ERM Framework - 2017

C Control Environment C Culture & Governance

R Risk Assessment R Risk & Performance

I Information & Communication I Information, Communication & Reporting

M Monitoring M Monitoring (Review & Revision)

E Existing Control Activities E Enterprise Strategy & Objective-setting

D-21
Miles CMA Review - Class Notes to Wiley CMAexcel Learning System Part 2, Section D

(This page is left blank for any reference notes on

Section D, Topic 1 – Enterprise Risk)

D-22