This book provides a practical step by step guidance towards enterprise risk management (ERM) implementation process by firms. In an ever expanding collection of literature available on risk management, this book stands out by its particular focus on the implementation process and simplicity in presentation. Therefore, this work can cater for a wide range of audience with different levels of background and expertise looking for instructions on ERM implementation. ERM learners and practitioners can use this as a reference on ERM implementation.
The book commences by persuading a business case for implementing ERM. It argues that ERM has emerged and developed over the years dynamically from the lessons learnt from past business disasters, subsequent regulatory changes, recurring industry initiatives for improving governance and risk standards, and updated expectations from the rating agencies and investors. For firms, the ultimate incentive nevertheless is the value harnessed by adopting good ERM practices. Therefore firms should align operations, risk management and business strategies as part of ERM implementation for balancing risk/reward within a firm. This book guides a risk professional to achieve this.
Contrary to his first book (Lam, Reference Lam2003) which discusses “what are” items of ERM – its components, best practices, risks and key industry requirements, this book is set on answering the “how to implement” questions. The book is arranged in the following way:
∙ In part 1, the author introduces and explains the concepts of risk and ERM and their various stakeholders. Up to date ERM failure case studies, and particularly, the “wheel of misfortune” is a very good addition to the literature on understanding the plethora of reasons behind ERM failures.
∙ Part 2 goes straightaway into planning the ERM implementation process. This is a useful section where the risk managers can readily understand what is required for planning the ERM implementation process. The author then highlights the barriers and challenges to the implementation process within a firm, describes how this resource intensive exercise should be handled in a structured fashion and how it should be embedded in the firm’s culture and operations over time. This last section, though brief, is useful to set up the scope. Detailed corporate governance and frameworks related topics, if needed, can be found in Chapman (Reference Chapman2011).
∙ Part 3 is based on to how to set up the governance structure and policies, in particular, how to frame the risk-appetite statement, and define responsibilities of various stakeholders within the firm, – for example “Chief Risk Officer” or the board.
∙ Part 4 outlines a phased approach for risk assessment and an introduction to the risk quantification models. The risk assessment part is very short. For an exhaustive theoretical discussion on tools and techniques for risk assessment and management, readers can consult (Chapman, Reference Chapman2011). For the quantification part, the book only provides a high level review of market risk, credit risk and operational risk. This part is pretty brief and readers should follow further references, say Sweeting (Reference Sweeting2017), for advanced knowledge on the subject. For a detailed mathematical treatment of the risk quantification models, readers can refer to McNeil et al. (Reference McNeil, Frey and Embrechts2015). However, it is clear that a conscious effort was made to exclude these details in order to keep the flow unabated.
∙ In addition to traditional risks, this book also introduces strategic risks (related to climate change, rapid technology change etc.), which can affect the firm in the long term. Part 5 discusses how these risks can be managed by incorporating them in strategic business planning. This idea is quite novel, and thus is a useful addition to the ERM literature.
∙ Part 6 proposes how to define risk metrics, lay down monitoring process, design performance indicators and use feedback loops for further risk control. The approach described is very pragmatic and handy.
∙ Further to that, Part 7 offers a collection of risk management related document templates which can be easily followed and pursued.
Experience speaks, and is evident from the presentation of the book. Narration in the book is very fluid and feels very comforting. Even though a multitude of ideas are introduced throughout the book, the readers can follow the flow without losing interest. The level of information seems to be correct for the purpose and audience concerned. There are many case study examples which the reader can readily relate to. Simple descriptions of technicalities enable the reader to appreciate the main points quickly. Analogies with practical things (e.g. comparing human immunity system with the “three lines of defense” system of risk control) lead to quick visualisation of the fundamentals. There are references at the end of each chapter for further readings on each topic. The project planning and document templates provided can be used directly in practice.
With a strict focus on implementation, the book sometimes overlooks the different possible expectations from the audience. A bit more content on risk assessment and quantification would have been more satisfying and complete. However, given the objective of this book and the number of books available with concentration on those areas, this approach is understandable. The author clearly makes a distinction between the implementation of ERM process and implementation of models. Moreover, a major portion of ERM implementation is qualitative and therefore the author focuses on getting the underlying principles right so that the key messages do not become blurred by unnecessary mathematical details or overload of information. Finally, the book is targeted across various business sectors interested in ERM implementation, so the proposals are quite generic. For a more finance sector targeted audience (e.g. actuaries) Sweeting (Reference Sweeting2017) can be useful.
The actuarial profession is slowly developing itself as a risk function across the (non)-financial business units. In this context, a knowledge of this book can be useful in contributing to the firm’s risk related objectives, and producing relevant documents. Considering the professional exams, this book can be a good supplement for the ST9 subject where practical application based questions are asked. In addition, it is a good source of information for actuaries to understand what can go wrong in the business world as a whole, and where we all fit in.
Overall, this book is easy to read and grasp, with no pre-requisite, targeted at a wide range of audience, and a very handy reference covering to the point implementation guidelines. The book is quite successful in achieving its objectives.
