Enterprise Risk Management Tools Techniques January 12 2011

Enterprise Risk Management Tools & Techniques January 12, 2011 Cathy Taylor, ADP Emerissa Babin, OPG Michelle Reid, TSSA

Today’s Objectives 1. Share 2. Enable 2

Agenda l Establish context l Risk identification l Risk analysis and evaluation l Risk treatment l Monitoring and review l Communication and reporting 3

Establish Context l Define environment within which risk will be managed l Ensures risk management approach is appropriate l Considerations include: ¡Public or private ¡Publicly traded or nonprofit ¡Organizational structure ¡Tone at the top ¡Organizational culture ¡How are decisions made? 4

Establish Context President & CEO Chief Financial Officer Corporate Risk Management (CRM) Organization Chief Risk Officer & SVP Corporate Bus Development Director Project Risk Management Director ERM & CPRM Enterprise Risk Management (ERM) Corporate Portfolio Risk Management Oversight of Strategic, Financial, Operational & Transactional Risks • Risk Reports to Board Committees • Risks to Business Plan Objectives (BURSA) • MD&A Risk Management , AIF Risk Factors 5

Establish Context BOARD / EXECUTIVE Set Policy Support & Set the Tone RISK MANAGEMENT TEAM Set Risk Appetite ALL Monitor Risk Reporting Build RM Capability, DEPARTMENTS Process Risk Ownership & (identification, assessment, Tools Monitor & report program treatment, monitoring & reporting) Set Assurance Agenda Framework Performance Management Advice, Coaching & Support Assure Stakeholders Define ERM & Governance Expectations 6

Establish Context 7

Risk Identification l Gather and document risks that could impact achievement of objectives l Common techniques include: ¡Surveys ¡Workshops ¡Management interviews ¡Environment scans ¡SWOT analysis ¡Results of audits 8

Risk Identification 9

Risk Identification 10

Risk Identification Significant RISKS & OPPORTUNITIES impacting achievement of initiatives Key Initiatives to Achieve Objectives + Risk Mitigation & Opportunity Optimization Activities Targets KPI’s KRI’s infor m Corporate Objectives/ Priorities Significant RISKS & OPPORTUNITIES impacting achievement of objectives e s p ha Assess & Report Performance Against Targets 11

Risk Identification 12

Risk Analysis and Evaluation l Understand the risk, its causes, the likelihood of occurrence, potential impact, and the organization’s appetite and/or tolerance for the risk l Common tools include: ¡Root cause analysis ¡Risk assessment criteria ¡Risk appetite matrix ¡Risk tolerance 13

Risk Analysis and Evaluation Risk Statements: l Important to express a risk in such a way that it can be effectively understood and addressed l Components ¡ Event, Cause & Effect l Example: ¡ Financial loss due to default by Clients in funding of processed payroll. ¡ Inability to obtain adequate (quality/quantity) expat labour supply due to negative perceptions about project location results in increased construction costs l Bad Risk Statements: ¡ Budget cuts ¡ Company delays all IT investments ¡ Fires 14

Risk Analysis and Evaluation Quantitative assessment l Probability l Financial Impact ¡ Improbable (<10%) ¡ Minimal (<$5 M) ¡ Unlikely (10% - 30%) ¡ Minor ($5 M - $50 M) ¡ Possible (30% - 70%) ¡ Notable ($50 M - $200 M) ¡ Likely (70% - 90%) ¡ Substantial ($200 M - $500 M) ¡ Probable (>90%) ¡ Major (>$500 M) 15

Risk Analysis and Evaluation Qualitative Assessment l Manageability ¡ The degree to which the outcome of a risk is controllable through the risk treatment/mitigation actions. l Stakeholder Sensitivity ¡ The extent of the reaction of external stakeholders (public, shareholder, regulator, etc. ) to the risk or how tolerant the stakeholders are of the risk; and ¡ What their expectations are for managing the risk. l Urgency ¡ The promptness needed to implement mitigation for a risk in order for it to be effective. This criterion refers to how pressing the need is for mitigation as opposed to the imminence of the risk itself. 16

Risk Analysis and Evaluation 17

Risk Analysis and Evaluation 18

Risk Analysis and Evaluation 19

Risk Analysis and Evaluation 20

Break Please be back in 10 minutes 21

Risk Treatment l Select and implement options to modify risk l Typical risk treatment concepts include: ¡Avoid risk (cancel product line, sell business unit) ¡Transfer risk (out-source function or enter contract to transfer risk) ¡Control risk (change process, training, etc) ¡Fund risk (insurance) 22

Risk Treatment 23

Risk Treatment TOO MUCH CONTROL so: A - removing procedure B - reduce insurance costs/increase insurance deductible LIKELIHOOD RATING RISK MATRIX E L M H H H D L M M Risk 1 H (Inherent) H C L L XM H H L M M H 2 3 4 5 B A A L Risk 1 (Residual) L 1 B SEVERITY RATING 24

Risk Treatment 25

Risk Treatment 26

Monitor and Review l Periodic monitoring of risk treatment plans and influence on risks ¡Ensure treatment plans exist ¡Ensure they are effective ¡Obtain additional info for further assessment ¡Identify emerging risks l Most common tool or technique is audit 27

Monitor and Review 28

Monitor and Review Risk based Audit program – which risk to audit? LIKELIHOOD RATING E D C B A RISK MATRIX L M L L H Risk 1 M (Inherent) H H H Risk 2 H (Inherent) M H H M M H L Risk 2 (Residual) L M M H 1 2 3 4 5 Risk 1 (Residual) SEVERITY RATING 29

Communication and Reporting l Create awareness, facilitate understanding, foster adoption / engagement l Governance or legislative requirements 30

Communication and Reporting Rank the Relative Risk of 30 Activities / Technologies with "1" being the highest risk & "30" being the lowest risk Me Public* Experts* Alcoholic Beverages Bicycles Me Public* Experts* Mountain Climbing Nuclear Power Commercial Aviation Pesticides Contraceptives Electrical Power (non-nuclear) Police Work Power Mowers Firefighting Prescription Antibiotics Food Colouring Private Aviation Food Preservatives Railroads Handguns Skiing Highschool/College Football Smoking Home Appliances Spray Cans Hunting Surgery Large Construction Swimming Motor Vehicles Vaccinations Motorcycles X-rays * source - study by Dr. Paul Slovic, Decision Research, Eugene Oregon 31

Communication and Reporting 32

Questions?

Announcements l CE Certificates l RIMS ERM Centre of Excellence l New RIMS logo l Curling bonspeil – February 8, 2011 l One-day Conference – March 9, 2011 l Volunteer 34

Thank you!