Question

1 - A case about enterprise risk management (ERM) is part of a course on corporate governance and sustainability as a sufficient ERM can help a company to successfully run its business. Part of sustainability is to be aware of the impact of the companys operations on people (employees, consumers, other stakeholders), deal with the impacts of the company regarding the environment as well as also to see the striving for profit as part of creating social & economical welfare. Thus ERM can promote companies that they are not taking to much risk, may it be a financial, operational, strategic risk etc. Managing risk carefully leads to improved long term value of a company for its stakeholders. Regarding corporate governance one can mention that publically traded companies have to have a risk assessment system. Also rating agencies include in their analysis whether an ERM is in place or not. Thus to sum up one can say that ERM plays a major role in corporate governance as well as companies sustainability approaches. Question 2 - A risk is a possible incident that may occur due to any reason (which could be dependent on your own action, or dependent on external ones, e.g. bad weather conditions) and which could lead to negative impacts on the company, regarding future operations, but also staff safety, corporate governance, sustainability etc. Relevant risks are those risks that have a strong impact on the strategic objectives of a company, and thus have to be handled carefully. Even if this risk can come up due to external factors, a company has to have a clear understanding of the most relevant ones, in order to cope with them when they might arise. An example of a relevant risk for Hidro One could be bad weather conditions that might harm the distribution system. Even if this event is unforeseeable Hidro One has to have a clear emergency plan of what to do then. The magnitude of risk shows how likely an event will occur, and what is the magnitude of its impact on the company. So Hidro One is spending money in projects to move risks below

the prudent residual risk target band so that their arising is less likely, but also their impact is decreased. Question 3 - Risk incubation means that is risk is getting bigger because it is not identified, or at least not reported. So e.g. there might be a small problem related to the condition of a plant. If this risk is identified quickly, it can be fixed easily without investing too much. But if the field worker is not identifying and reporting the risk, the problem can get worse until management identifies it. This could lead to a much higher needed investment to fix that problem. So ERM can help that risks are identified quickly, and risk incubation is minimized. Question 4 - By voting in the ERM management decides about which are the really critical risks that they should focus on, so be able to narrow down the original 60-70 risks to the 6-8 main ones. If the votes are clearly showing in one direction there is no need for long discussion. If there is a wide spread between the votes, management can discuss, and thus understand, why some people are thinking in different ways about that risk. This could lead to an even higher understanding of possible threats, but also opportunities. Question 5 - The purpose of the workshops is to include all levels of employee before defining the critical risks and allocate the resources on them. Within the workshop, not just managers, but also field worker together can develop a collective understanding of what the key strategic objects are. Then they can define the major risks that might threaten the reaching of these objectives. Thus the workshop clearly help to structure the risk assessment process, which is decreasing the risk to miss a possible risk. Question 6 - One of the risks Hidro One is facing is regulatory uncertainty. This means that new regulations like laws could lead to high investments in upgrading plants (e.g. due to new pollution limitation numbers etc.). This risk can e.g. harm the strategic

objective of an A rating, as such an unexpected investment could lead to financial problems (when Hidro One does not have a planned budget for such events). Another risk are employee accidents, so the number, but also the seriousness of accidents. The goal is to have the best safety record, which would be harm with a lot of serious accidents, so safety issue problems. Also top quartile employee productivity is a strategic goal, and would be harmed. Also the electricity supply is a risk, so not be able to supply electricity to customers at every time. Customers expect to have electricity all the time, so a problem here would lead to decreased customer satisfaction, which would harm the goal of having 90% customer satisfaction. The goal of operating efficiency could be harmed by IT system risks, so a non working IT system. Without a working system, the whole transmission could stop, which would also have an impact on customer satisfaction. Of course there is also a financial risk, so e.g. decreased profit due to decreased demand of electricity. Also overinvesting in too many projects, and therefore maybe taking to much loans could have a negative impact. So without a sufficient financial planning the A rating could be in danger. Environmental issues are of course a risk Hidro One is facing, so e.g. pollution of water due to a problem at a reservoir dam. A problem like this would highly have a negative impact on the vision to be the best transmission business in North America. Finally the condition of the network is a major risk, so whether the network has more defects because it is not in good shape. Without a good condition of the network Hidro One is not able to reach the strategic goal to have a top quartile transmission & distribution reliability, so this could be a major issue. Question 7 -The risk map is a very good tool to clearly show senior management that risks will occur at which probability, and whether they will have a high impact on reaching the strategic goals of Hidro One. Furthermore the size of the bubble shows if at

present Hidro One has control over this risk. This means whether there are emergency plans established, SOPs available, whether every step that has to be done when the risk arises is clearly defined etc. Exhibit 5 supports the analysis of whether Hidro One has more or less control over a problem, as it divides the level of control into different stages. So bubble C government policy uncertainty for example is a risk where senior management should highly focus on, as the magnitude is very high, the probability is quite high, but at present Hidro One has very few control mechanism in place to deal with this problem. So the finished map can be directly used by management to define which are the most critical risks, thus where they have to concentrate their resources one. Exhibit 3 can further help management, as it shows in detail the different risks in the different areas. Furthermore it offers different impact levels, in order to be able to clearly measure a possible output when a risk might arise. Question 8 - The three stages of Hidro Ones enterprise risk management process surely is helping senior management a lot to really be able to allocated its limited resource to that areas which are most critical to reach the companies strategic goals. A big strength e.g. of the workshop at stage one is that people from all different levels of the company are discussing the different risks that they may face in their department / daily work / etc. Without these workshops there might be the risk not to identify all the risks. Especially not just to include management, but also field workers for example, is a big strength of that system. These field workers for example have to really implement lots of the project. And if they understand why changing is important, they will be motivated to do so. Also the voting is a big strength of the ERM of Hidro One. Due to the voting process, one can really see whether there is a clear common agreement on which are the most critical risks, and can focus on them. Even if there is not a common sense at least senior management knows that in this particular case there is maybe more than one

option of how to think about that risk. So after the workshop it should be clear for senior management on which projects they should allocate their resource, namely on those that could most harm the reaching of the overall strategic goals. The regular updates in the one to one interviews twice a year of the CRO with senior management also is a strength as it can be shortly identified whether something is going in the wrong direction. If this is the case, senior management rapidly can realign the projects. However, there are some weaknesses as well. As before the workshop there are 60-70 possible risks pre- defined, which will be discussed within the workshop and narrowed down to the most critical ones, this can lead to missing an important risk. Of course participants in the workshop can tell the group if they had identified another risk that should be included. But due to the fact that there are some people more introverted than others, they maybe to shy to express themselves publically. Within the inner year regular updates there might also be a weakness. As only senior management is included, it might be the case that the manager is not informed in detail about possible problems (as his daily duty is to manage lots of different things). Thus also at least to include the direct responsible middle management might be a good way not loose the advantage of an early warning system. Question 9 -I think Hidro Ones ERM is very efficient, in order to target the major risks that are important to reach its strategic goals and thus to sustain their business also in future. As they were able with its ERM to change the corporate culture, people are now really able to assess that even if they think their particular risk might be the most important one, there are maybe other risks in other departments of the company that are even more important. The only thing that they may change is during the inner year risk assessment they should also try to include middle management, to be sure not to oversee any early warning if something is not in line.