In today's business environment, the effective management of cross-enterprise risk is a key factor in planning for any organization's long-term viability. While there has always been a conceptual link between risk management and financial viability, today's economic volatility is impelling the move from concept to practice. As a result, enterprise risk management (ERM) has shifted from a "good business" discussion to a "mission critical" means of addressing volatility.

For some businesses, even today, such volatility continues to be the domain of the risk manager, who buys insurance and informally partners with management to address uninsurable risks. Indeed, it has taken the ongoing economic crisis to highlight the need for a more formal, strategic, and proactive means of managing risk.

Whatever the driver, one thing is clear: every business must more comprehensively balance the different methods used to address risk and volatility. If such a balance is not achieved, the result may be negative media coverage, financial instability, and the general perception that management is not in control — which would not be well received by any engaged board member, key stakeholder, rating agency, or customer.

What Will You Say When They Ask What Happened?
Given how demands, audiences, and stakes have changed, when considering the nature of the ERM program to be implemented, reviewed, or improved in your organization, you should first ask yourself the following:

• Am I able to identify the key material risks across my entire organization and effectively mitigate and manage them?
• What does my organization do to monitor and address material risks? Are these processes documented?
• Does my organization’s senior leadership agree on the critical risks?
• Has my company established a risk tolerance, risk appetite, and governance structure?
• Does risk management play a pivotal role in strategic decision making?
• What metrics has my organization identified to monitor key risks and has it evaluated those metrics relative to the potential impact on liquidity?
• Am I able to meaningfully outline the processes and drivers for improving over-or-under-managed risks?
• What were the largest sources of budget overruns last year? How effectively are the risks associated with those overruns managed?

Our Enterprise Risk Services & Solutions (ERSS) Practice provides clients with a range of services to help them balance the most critical components of volatility and risk. The group deploys services that address ERM in whole and in part, based upon client need. We deliver a comprehensive ERM solution as well as offer stand-alone services that allow our clients to take a methodical, or compartmentalized, approach to ERM. In practice, we identify, define, and quantify the universe of risks that our clients face, and we provide the policies, processes, and infrastructure required to proactively treat those risks.

We approach engagements from a practical perspective, focusing on delivering operational-ready solutions designed to balance the alternative methods used to address risk. These solutions are delivered via:

• Risk Identification & Analysis (RIA)
• Risk Management Optimization (RMO)
• Enterprise Risk Management (ERM)

Risk Identification and Assessment (RIA)
The RIA practice provides diagnostic services that are designed to efficiently and cost-effectively help our clients to quickly understand and prioritize critical, enterprise-wide risks. RIA services are typically deployed in advance of comprehensive ERM solutions and provide our clients with a more meaningful understanding of the scope of risk topics that need to be addressed. Generally speaking, RIA services are aligned with our clients' risk control environment and serve to consolidate both the insurable and uninsurable business risk management concepts. The cornerstone service of RIA is Risk Focus, which provides:

• A five-step process that includes interviews and a facilitated workshop with top decision makers;
• A list of the organization's top 20 risks;
• A review of existing management controls and potential insurance options;
• Business risk benchmark data on the relative position of the organization against others in its sector; and
• A risk action plan.

Risk Management Optimization (RMO)
The RMO practice helps our clients critically evaluate and optimize the effectiveness of the dedicated risk management function. RMO offerings are designed to address both traditional risks and the traditional means and methods of existing risk management tasks, processes, and applications. Our services focus on:

• RMO Function Review — The RMO Function Review is designed and executed with the primary objective of helping our clients improve performance and the results provided by the risk management function. We provide a proven, structured approach to assessing and developing an effective risk management framework and a detailed report on what the client should be doing and why, who should be doing it, where coverage gaps exist, and how to cover the gaps.
• Risk Management Outsourcing — In-line with our clients’ need for efficiency-oriented solutions, we offer a range of different risk management outsourcing services. As the economy continues to contract and cost control efforts accelerate, we can help address both the immediate need for senior risk management professionals and the needs associated with the wholesale outsourcing of the risk management function. The deliverables associated with outsourcing engagements vary widely based on client need, but are largely defined based on the scope of functional support provided.

Enterprise Risk Management (ERM)
The ERM practice represents the strategic aggregation point for the wide range of risk management services provided to our clients. Where many of the ERSS services are intended to support single client needs, ERM acts as the logical center point in the delivery of broader, more strategic, risk management solutions. In practice, the ERM offerings encompass the needs of multiple parties, functions, efforts, and budgets. Services include:

• Assessment of current state ERM initiatives — including review and analysis of an organization's risk tolerance, current exposures, and management practices, resulting in the prioritization of key risks and an understanding of the risk infrastructure;
• Design for a "future state" of ERM — including how to respond to material risks, a review of key opportunities for program improvement, and the development of mitigation strategies to improve the risk and reward trade-off along the risk response path of retention, avoidance, mitigation, and/or transfer; and
• Implementation of the ERM infrastructure — including building communication protocols, enhancing governance frameworks, developing material risk scorecards and tracking systems, and establishing business requirements and recommendations relative to possible technology solutions.

The breadth and depth of services provided by each of the ERSS practices allow our clients to drive better resource allocation decisions, assist in increasing operational efficiency and effectiveness, support governance requirements, improve company controls, control environments and compliance adherence, and create a holistic, enterprise-wide risk aware culture.