Managing Opportunities and Risks - Chartered Institute of ...

1 MANAGEMENT. S T R AT E G Y. MEASUREMENT. M A N AG E M E N T AC C O U N T I N G G U I D E L I N E. Managing Opportunities and Risks By Tamara Bekefi, Marc J. Epstein and Kristi Yuthas Published by The Society of Management Accountants of Canada, the American Institute of Certified Public Accountants and The Chartered Institute of Management Accountants. N OT I C E TO R E A D E R S. The material contained in the Management Accounting Guideline Managing Opportunities and Risks is designed to provide illustrative information with respect to the subject matter covered. It does not establish standards or preferred material has not been considered or acted upon by any senior or technical committees or the board of directors of either the AICPA, CIMA or The Society of Management Accountants of Canada and does not represent an official opinion or position of either the AICPA, CIMA or The Society of Management Accountants of Canada.

2 Copyright 2008 by The Society of Management Accountants of Canada (CMA Canada), the American Institute of Certified Public Accountants, Inc. (AICPA) and The Chartered Institute of Management Accountants (CIMA). All Rights Reserved. No part of this publication may be reproduced, stored in a retrieval system or transmitted, in any form or by any means, without the prior written consent of the publisher or a licence from The Canadian Copyright Licensing Agency (Access Copyright). For an Access Copyright Licence, visit or call toll free to 1 800 893 5777. ISBN: 1-55302-212-2. MANAGEMENT. M A N AG I N G O P P O RT U N I T I E S A N D R I S K S. introduction disaster of Katrina in 2005. CMA Canada, the AICPA, and CIMA have responded Risk taking, the engine driving business, with four Guidelines that address this is vital to companies seeking market issue: success. Risks are, however, often thought of only as hazards, despite the fact that a) Identifying, Measuring, and Managing they can present significant Opportunities Organizational Risks for Improved and possibilities for organizational Performance.

3 Innovation and new competitive advantage b) The Reporting of Organizational leading to short- and long-term profita- Risks for Internal and External bility. In fact, risk and opportunity are a Decision Making ;. duality like two sides to the same coin. c) Integrating Social and Political Risk Managing hazardous risk has been into Management Decision Making ;. increasingly recognized as a critical and business issue prompted by events as d) Business Continuity Management . diverse as the financial debacles of companies like Enron,Worldcom, and Though these four Management Parmalat, the terrorist events of Accounting Guidelines on risk provide September 11, 2001, and the hurricane excellent coverage of many of the most CONTENTS EXECUTIVE SUMMARY. Page introduction 3 Recent corporate financial debacles, the threat of THE ROLE OF global terrorism, and other social, political and FINANCIAL PROFESSIONALS 5 environmental issues have prompted an increased BACKGROUND 5 recognition of hazardous risk as a critical business MODEL FOR RISK & OPPORTUNITY the awareness of risk as a threat is MANAGEMENT 7 imperative, so too is the recognition that Risks can 1.

4 IDENTIFYING Risks & Opportunities 9 provide Opportunities for innovation leading to 2. Managing Risks & Opportunities 17 new competitive advantage. 3. EVALUATING RISK & OPPORTUNITY. THROUGH ROI AND OTHER This Guideline builds on previous Guidelines on METHODS 29 risk, but focuses on the Opportunities created CONCLUSION 33 by organizational Risks . It provides insights into ENDNOTES 34 the positive aspects of risk and views the risk BIBLIOGRAPHY 36 management process as a way to exploit Opportunities and drive new organizational innovation. It also provides tools and recommen- dations to financial professionals on how to develop a risk and opportunity management framework, measures, and management process to drive innovation and win in the marketplace. 3. MANAGEMENT. S T R AT E G Y critical issues in risk management, they conceptua- In essence, this piece gives guidance on how to lize risk as it is typically defined as a potential develop the capacity to minimize unrewarded MEASUREMENT examine how organizations can risk1 Risks that have no upside even when protect themselves against various Risks by handled perfectly, and maximize rewarded risk.

5 Preparing for, mitigating, and responding to them. Risks that present Opportunities for success, to These Guidelines do not, however, elaborate on develop an ambidextrous organization. Some the fact that Risks are not only hazards that should companies with superior organizational knowledge be avoided but are also Opportunities that propel and capabilities can accept Risks and mitigate them business growth. By focusing on the downside of effectively while their competitors may choose risk, companies can sometimes forego opportuni- to avoid potential investments due to a low risk ties that might initially appear too risky, but which appetite or a narrow assessment of Risks . In have never been formally analyzed. addition, organizations may be able to identify voids in the marketplace that provide This Guideline builds on the previous guidelines Opportunities for innovation others may not see. by focusing on the importance of risk and opportunity management and the value-creation This guideline articulates the positive aspects of Opportunities often hidden in Risks .

6 It aims to risk management and how to capture opportunity help create a more rigorous understanding of the through innovation. It views the process and Risks that organizations take and provide tools to output of risk and opportunity management as better evaluate and manage Opportunities related a source of competitive advantage and a way to to taking Guideline suggests a method successfully navigate charted and uncharted for avoiding hazardous Risks or minimizing their waters to drive new organizational innovation. impacts while proactively seeking Opportunities It also provides recommendations to financial and Risks that can reward the organization. It professionals on how they can expand the risk touches on three different, yet related, pursuits: management framework, measures, and manage- ment processes to capture Opportunities and gain 1) Identifying and Managing Risks discussed as competitive advantage.

7 Financial professionals have traditional risk management in other a critical role in risk and opportunity management Management Accounting Guidelines, as the creators and designers of systems that 2) Identifying and Managing Opportunities , often establish key performance indicators and measure related to innovation, and Managing related performance against them. Risks , and Managing Risks and Opportunities is, in many ways, 3) Identifying and Managing Opportunities where separate from the daily toils of business, and others see only unmanageable risk. Exhibit 1: Risk & Opportunity Management Continuum2. Greater Sophistication Enhancement {. Shareholder Value Improved returns through improved risk & opportunity management Operating Performance { Enhancing capital allocation Protecting corporate relations Achieving global best practices {. Understanding and evaluating business strategy Risks & Opportunities Understanding the full range of Risks & Opportunities facing business Compliance Avoiding personal liability failure (the personal fear factor).}}}

8 And Prevention Compliance with corporate governance standards (fiduciary responsibility). Other company crises Own company crises 4. M A N A G I N G O P P O RT U N I T I E S A N D R I S K S. therefore necessitates an explicit effort to step BACKGROUND. back and see the full risk and opportunity picture. In Identifying, Measuring, and Managing Organiza- Managing risk and opportunity is a continuum, tional Risks for Improved Performance , Marc J. illustrated in Exhibit 1, which is increasingly Epstein and Adriana Rejc-Buhovac present a related to strategy, operating performance, and model and measures for enhancing the identifica- shareholder value enhancement, in addition to tion and measurement of Risks for improved compliance and Management management decisions. Stemming from the risk Accounting Guideline describes a best practice assessment requirements of the 2002 Sarbanes- and we acknowledge that risk and opportunity Oxley Act in the , and similar new regulations management described here is a journey.

9 Not in other countries, it also builds on the Treadway all organizations will be able to undertake the Commission's Committee of Sponsoring practice as described. But even those who cannot, Organizations (COSO) Internal Control may still use this piece to help sensitize their Integrated Framework , and its more recently management to begin broadening the approach issued Enterprise Risk Management Integrated to risk rather than focusing exclusively on risk Framework . Epstein and Rejc-Buhovac's work as a threat. further specifies the tools necessary for organi- zations to identify and measure a broad set of THE ROLE OF FINANCIAL Risks . More significantly, however, it concentrates PROFESSIONALS on improving the quality and effectiveness of both The role of financial professionals in capturing operational and capital investment decisions, and capitalizing on Opportunities related to risk through more effective management of organi- cannot be overstated.

10 The corporate finance and zational risk. accounting functions may not have full ownership Epstein and Rejc-Buhovac demonstrated that of the risk and opportunity management process increased measurement of a broader set of Risks but they do possess the strategic vision, risk is necessary, both to meet recent regulatory management expertise, financial management requirements and to improve managerial discipline, project management skills, and performance and stakeholder comprehensive perspective essential to improving provided a six-step risk assessment model, the effectiveness and efficiency of risk and illustrated in Exhibit 2, which builds on the 2004. opportunity management. Management of these COSO Enterprise Risk Management Integrated issues is heavily grounded in the role of financial Framework, and includes: professionals because of their contribution to 1) designing, implementing and overseeing the 1) Event Identification technical aspects of the process described in this 2) Risk Assessment Guideline, and 2) informing the Board of this 3) Risk Response process and its outcome.