ERM and Performance Measurement

Enterprise risk management (ERM) and performance management (PM) are two essential processes for the management of an organization. Both are designed to support the organizations’ efforts in making decisions and meeting its goals—ERM through the identification and management of those risks that could affect business objectives, and performance management through the identification and measurement of the drivers needed to achieve results and provide value.  Yet despite having mutually consistent objectives, ERM and PM process are not integrated and only recently are senior managers seeing the synergies in integrating the two processes.  In a survey by The Conference Board of 97 senior executives, only 57 percent of the responding organizations have both a formal ERM program and a PM program. Of this group, only 43 percent said that integration would be “extremely” or “very” valuable.

Given that the two processes are mutually supportive and have common goals, why are they not better integrated?  Part of the answer lies in both the genesis and the maturity of the two processes.  Historically private sector risk was managed by buying insurance and, more recently, through diversity to help manage the ups and downs of commodity prices, currencies, interest rates and such.  Early performance measurement models were also based on mainly financial measures and considered a component of the planning and control cycle.

When ERM was introduced, it challenged companies to go beyond mathematical, easy to measure risks focused on financial controls and consider crucial risks related to reputation, operations, legal, human resources and IT. Today organizations are also being asked to develop organizational performance measures that have a more holistic view based on multiple nonfinancial measures.

ERM encourages companies to perform ongoing assessment of risks at every organizational level; and to aggregate results at the corporate level.  However, ERM processes are often not considered effective at the both the corporate and business unit levels.  The result is that the risk associated with individual business units or organizational entities may be less visible when examined from an enterprise perspective.  In the IBM CFO Study 2008 of over 1,200 CFOs and senior Finance professionals, almost two out of three (62 percent) enterprises with revenues over US$5 billion encountered material risk events in the last three years.  Of those, nearly half (42 percent) admitted to not being well prepared for it.  The most frequently mentioned risks were not financial but strategic risks involving decisions about markets, customers, products, merger and acquisition activity, and other top-line business decisions. (IBM; Balancing risk and performance with an integrated finance organization: The 2008 CFO Study; http://www-05.ibm.com/services/se/cio/pdf/CFO_Study.pdf)

While some of these inherent problems have been addressed by the introduction of Enterprise Risk Management (ERM) and improvements to performance measurement processes, more work needs to be done.  Risk assessments are typically limited since they often do not illuminate how the risks will affect the critical success factors of specific strategic goals measures (e.g., development of a new or elimination of an existing program) which are stated in performance management frameworks.  In addition, organizations are not always successful at developing and implementing adequate performance measures for strategic initiatives.  Current literature suggests 70% of initiatives fail at implementing performance measurement strategies.

ERM involves the use of aggregated results to inform decision-making and business practices and to identify and manage risks specific to the achievement of objectives.  However, there is often no explicit link between the results of the ongoing assessment of risk and performance management; and the impact of risk on the continued validity of performance measures tied to strategic objectives is not addressed – particularly for emerging risk.

Barriers to Integration

One issue that affects the integration of risk and the performance management processes is the fact that performance metrics are often not sophisticated enough to reflect the level of risk inherent to organization activities.   Performance measurement may only be seen as a way to align individual objectives with business objectives and used as an element in the evaluations of individual managers and as a guide for setting compensation.  As a result, the individual performance measures are often based on pro forma assumptions about internal performance and external events; and do not factor the impact of risks on performance.

The integration of ERM and performance management is also hindered by the view that risk and performance address diametrically opposed concepts.  Key performance indicators (KPIs) are seen to be focused on ensuring positive things occur as planned; and key risk indicators (KRIs) focused on ensuring negative things do not happen.  These are perceived as opposite measures: one defining success, the other potential adverse events.  In reality, a KRI can be developed from a KPI or a component of it.  For example, employee turnover can be seen as an operational risk whose performance measure would be “increased employee retention”.  Combining ERM with performance measurement would ensure that business goals include a probability component of its realization, in other words, a risk component.

Benefits of Integrating Risk and PM

Performance management typically involves establishing goals for activities and projects, monitoring progress with specific measures and adjusting along the way to improve performance and more effectively and efficiently achieve strategic goals. However, the implementation of performance measures without the use of risk-adjusted metrics also presents a danger that executives will be encouraged to take excessive risks to boost the results of the performance metrics used to evaluate them as individuals. As the ongoing financial crisis has made clear, many financial executives pursued strategies using derivatives and structured products without sufficient regard to the corporate risks involved. They were often amply rewarded based on short-term returns that masked excessive longer-term risks.

In most cases, while both performance measurement and ERM are linked to the achievement of strategic objectives, tools such as the balanced scorecard only provide a holistic view of the performance of the organization across multiple perspectives.  It does not identify and assess emerging or changing levels of risk.  Likewise, ERM, with its focus on risk identification and management, is not explicitly linked to the measurement of performance.

The IBM CFO Study 2008 findings suggest that organizations need to develop a more holistic view of risk. Facing a wide range of risks requires enterprises to broaden their risk apertures and focus on those risks with the greatest potential impact and occurrence.  In addition, performance measurement needs to consider ongoing and emerging risks not just historical risk.  The IBM study also encourages CFOs to integrate risk into planning, budgeting, reporting, and forecasting. Factoring risk into these four main areas of performance management better positions the organization to limit surprises and capitalize on upside opportunities.   Discussions with senior executives have also suggested that information from ERM would be more credible and that ERM would be a more effective management process if ERM frameworks were shown to produce credible and useful risk-adjusted performance measures.

As a result, a disconnect exists and the processes remain independent.  The solution lies in a push to improve the maturity and functionality of the two processes; and to integrate the ERM and performance measurement processes at both the strategic and business unit levels.

Expanding the focus and methodological approaches of the risk and performance management processes will bring them into closer alignment.  The performance management focus on measuring progress toward achieving strategic objectives and ERM’s emphasis on addressing positive and negative factors potentially affecting the accomplishment of those objectives make their combination a natural fit for success. However, the integration of ERM and performance measurement must occur early in the strategic planning process and be an ongoing activity.  At a high-level, the integrated process would include steps to identify and assess risks related to corporate goals and objectives to be pursued, to implement risk mitigation strategies, to establish associated risk and performance indicators and measure current levels, and to monitor both the risk and performance indicators.

ERM seeks to identify, assess, and manage risks so that organizations can meet their objectives. Effective ERM builds risk awareness into decision making throughout the organization.  Performance management, on the other hand, monitors a company, its activities, processes, and employees to see if they are on track to meet stated goals.  The integration of risk assessment data and performance management will provide the analytical framework for evaluating activities and opportunities to maximize value to the public.

While key performance indicators (KPIs) can identify underperforming aspects of the organization, key risk indicators (KRIs) provide timely leading-indicator information about emerging risks.  KRIs are measures of events or trigger points that might signal issues developing internally within the operations of the organization or potential risks emerging from external events, such as macroeconomic shifts that affect the public’s demand for products or services.

KRIs will provide an early signal of increasing risk exposures affecting the strategic initiative and ultimately the associated strategic goal. In some instances, they may represent key indicators of evolving risks which signal the need for actions that need to be taken. Others may be more elaborate and involve the aggregation of several individual risk indicators into a multi-dimensional score about emerging events that may lead to new risks.  This can provide rich information for management to consider as they execute strategies related to strategic initiatives.  However, to be effective ERM needs to provide management with more information than an annual heat map.  The discussion around risks must not only be an integral part of strategic planning and mid-year performance assessment but also an ongoing focus of management.

During the strategic planning process senior managers propose goals and objectives for the coming year. ERM should evaluate objectives to ensure that risks have been considered and the chosen objectives are consistent with the entity’s mission. The risks should be analyzed and prioritized and mitigated by an appropriate response that considers the entity’s risk tolerance and risk appetite. The risk appetite will vary depending on the organizational activity e.g. air traffic safety and a job creation program will have very different levels of risk tolerance and allowable variance from target levels. This may lead to a revision of the objectives. Once the objectives have been selected, strategic initiatives are established, and key performance indicators (KPIs) developed, and baseline performance measures calculated for each strategic initiative to translate the organization’s overall mission and strategy into specific measurable operational and performance metrics. The objective of performance management is to provide metrics that organizations can use to measure progress toward achieving their corporate goals; not simply to assess what has been achieved, but also to assist executives when they plan corporate strategy and to help track execution.  At this time, key risk indicators (KRIs) should also be established, and baseline measures calculated. In addition, controls, policies, procedures, etc. should be established to assess the implementation and effectiveness of the risk responses. Finally, risk information should be captured and communicated across the entity, and the enterprise risk management process used to monitor and assess the risk on a continual basis to ensure that management attentions continue to focus on the right areas.

While ERM typically provides an enterprise view of risk, the risks are identified at the operational level (bottom up) and thus can continue to be associated with specific strategic initiatives. Maintaining this view on an ongoing basis allows the organization to understand the relationship between risks to the achievement of strategic objectives, and to the associated performance measures. In addition, it means that sub-activity performance measures can be updated based on changing risks levels – providing managers with reasons to track not only performance but also to identify and assess risk on a regular basis. The integration should exist both at the high-level strategic planning and at the strategic initiative level. Thus, ERM identifies and manages risks to the achievement of the strategic initiatives and performance measurement tracks progress towards the achievement of these strategic initiatives.

Example – management has an objective to improve health care (see diagram).  Three critical strategic initiatives to accomplishing those objectives have been identified; and several potential risks have been identified that may have an impact on one or more of the key strategic initiatives. Mapping key risks to core strategic initiatives puts management in a position to begin identifying the most critical metrics that can serve as leading key risk indicators to help them oversee the execution of core strategic initiatives. Identifying and mapping KRIs to critical risks and core strategies reduces the likelihood that management becomes distracted by other information that may be less relevant to the achievement of these objectives. The next step is to develop and map key performance indicators (KRIs) to each of the strategic initiatives. Once this has been done, baseline measures should be calculated for the KRIs and KPIs and ongoing monitoring of the indicators performed.

During the strategic planning process risks are initially assessed for their impacts on organizational goals and objectives, but as management examines strategic alternatives, their impact on the total risk profile should also be evaluated. For new strategic goals, performance measures and risk responses, accountabilities and monitoring systems should be established. Thus, ERM would feed the strategic planning process and the establishment of performance measures; and there would also be a feedback loop from these processes to the ERM process.

Identifying KPIs and KRIs is only the first step. Risk indicators should be continually assessed after decisions have been made, in addition to the ongoing monitoring of performance. While performance measurement focuses on actual performance, the ongoing assessment of risk can highlight emerging risks that may impact future performance. Since KRIs are typically derived from specific events or root causes, they can identify internal or external factors that can prevent achievement of strategic objectives.  For example, budget reduction programs, health crises such as H1N1, or the political environment’s effect on major acquisitions are all events that might influence the accomplishment of the organization’s objectives.

The ongoing examination of the KRIs is necessary for management to be able to assess and revise their strategies to mitigate new or emerging risks and, at the same time, adjust KPIs accordingly.

The integrated approach should not be static and the development of data-driven indicators of risk is critical to its success. Integrated scorecards should be used in ongoing management of the organization. A well-designed and integrated ERM and performance measurement system provides information that allows management to understand whether key strategic objectives are being met and to identify opportunities to adjust strategies and tactics to take advantage of shifts in the environment that might be exploited for the benefit of the organization and its stakeholders. Management selects initial strategies at a point in time. As time goes by, the range of uncertainty begins to increase, threatening the successful execution of those strategies. This should trigger a review of the strategies and the associated risk indicators and performance measures.

The benefits of combining ERM and performance management are significant and affect every business unit. ERM is forward-looking and can help organizations anticipate internal and external risks and understand the risk and reward trade-offs of their business decisions. The use of KRIs to anticipate emerging risks and shifts in risks over time can decrease losses, identify opportunities for strategic exploitation, and potentially reduce the cost of capital by mitigating perceptions of risk borne by capital providers. In the public sector KRIs can identify emerging risks and help reduce service disruptions and enhancing public sector value by potentially avoiding certain decisions that unexpectedly create risks associated with these processes.

Another advantage of linking ERM and performance measurement to strategic planning and review is that managers can be held accountable for both the risk mitigation activities and performance measures associated with a strategic initiative. This will encourage ownership of both the ERM and performance measurement processes. ERM will become more than an annual ‘heat map’ generation activity; and performance measurement will become more than an HR performance evaluation tool.

In addition, the use of KRIs can lead to fewer episodes of crisis management, where normal tasks must be set aside for full-time devotion to a developing issue. This allows for a more stable and smoothly functioning organization. By providing executives with a better understanding of the risks inherent in their strategic plans and better tools to identify performance drivers, public and private sector organizations will become more flexible and nimbler in responding to changes in the external environment.