10 slide - Aligning Enterprise risk management: the bank of tokyo approach

enterpriserisk-banktokyo.pdf

Home >Business & Finance homework help >Operations Management homework help >10 slide - Aligning Enterprise risk management: the bank of tokyo approach

Aligning Enterprise Risk Management with Strategy Through the BSC: The Bank

of Tokyo-Mitsubishi Approach By Takehiko Nagumo

Article Reprint No. B0509D

HARVARD BUSINESS SCHOOL PUBLISHING

I N S I G H T, E X P E R I E N C E & I D E A S F O R S T R AT E G Y - F O C U S E D O R G A N I Z AT I O N S

Balanced Scorecard REPORT Do

N ot

C op

y o r P

os t

This document is authorized for educator review use only by MUHAMMAD ATHER ELAHI, Institute of Business Administration until Sep 2021. Copying or posting is an infringement of copyright. [email protected] or 617.783.7860

For a complete list of Harvard Business School Publishing newsletters: http://newsletters.harvardbusinessonline.org

For reprint and subscription information for Balanced Scorecard Report: Call 800-988-0866 or 617-783-7500 http://bsr.harvardbusinessonline.org

For customized and quantity orders of reprints: Call 617-783-7626 Fax 617-783-7658

For permission to copy or republish: Call 617-783-7587

Do N

ot C

op y o

r P os

When BTM adopted the BSC developed by its regional head- quarters, it first had to modify the tool make it more suitable for global use. For example, Corporate Social Responsibility (CSR), a tenet that most corpora- tions are obligated to embrace, is now incorporated in one of the strategic themes. In addition, the Plan-Do-Check-Act cycle, an enterprisewide initiative, has been integrated into each of the customer, internal process, and learning and growth perspectives to promote a customer-focused mindset.

But the most important addition BTM has made to the design originally developed at its Americas headquarters is a link between risk management and strategy. BTM incorporates in its internal perspective a risk man- agement process similar to the Six Sigma linkage in many organiza- tions’ scorecards. This linkage is a result of BTM’s goal to enhance its corporate governance, the achievement of which requires both superior strategy execution and robust risk management capa- bilities. Since the idea of linking

risk management and strategy was first conceived, it has been improved many times conceptual- ly and in practice. Today, this approach has become the enter- prisewide standard.

TThhee CCOOSSOO EEnntteerrpprriissee RRiisskk MMaannaaggeemmeenntt AApppprrooaacchh

The key concept that links strategy and risk management is the COSO 1

Enterprise Risk Management (ERM) system, a model developed last year by the North American consortium of accounting and finance professionals’ associations. The previous version, known as the COSO Internal Control Framework, standardized the concept of internal control in the following categories:

• Effectiveness and efficiency of operations

• Reliability of financial reporting

• Compliance with applicable laws and regulations

The new COSO ERM system, building on the internal control framework, encompasses the concept of broader, enterprisewide risk management—extending its

coverage to risks that relate to strategies. COSO defines ERM as a process, put in place by an organization’s board of directors, management, and others, designed to identify and manage the spectrum of risks an organization faces so that it can be reasonably assured of achieving its objectives.2

Interestingly, COSO created its Internal Control Framework in 1992, the same year that Robert Kaplan and David Norton intro- duced the Balanced Scorecard. Like the BSC, the COSO framework has evolved over time. The most critical aspect of its evolution is the new ERM model’s emphasis on the importance of aligning strategy and risk management.

In an official publication about its ERM model, COSO claims “every entity exists to provide value,” and that value “is maximized when management sets strategy and objectives to strike an optimal balance between return goals and related risks, and efficiently and effectively deploys resources in pursuit of the entity’s objectives.”3

Graphically, the concept is depicted as the “COSO cube,” familiar to the senior executives of publicly held U.S. companies, since COSO is essentially mandatory for compliance with the Sarbanes- Oxley Act. (See Figure 1.) Four categories of objective appear in the vertical columns: strategic, operations, reporting, and compli- ance. Eight components of risk management and internal controls are indicated in the horizontal rows: internal environment, objective setting, event identifica- tion, risk assessment, risk response, control activities, information and communication, and monitoring. In the third dimension are the organization’s units.

In the banking industry, the COSO ERM model is a common risk management framework that is generally accepted by regulators, external and internal auditors,

M A

N A

G E

M E

N T

Y N

E R

G I

E S AAlliiggnniinngg EEnntteerrpprriissee RRiisskk

MMaannaaggeemmeenntt wwiitthh SSttrraatteeggyy TThhrroouugghh tthhee BBSSCC:: TThhee BBaannkk ooff TTookkyyoo--MMiittssuubbiisshhii AApppprrooaacchh By Takehiko Nagumo, Senior Manager, Corporate Planning Office, Bank of Tokyo-Mitsubishi ( Tokyo)

FFoolllloowwiinngg tthhee wwiiddee--ssccaallee ssuucccceessss ooff iittss AAmmeerriiccaass hheeaaddqquuaarrtteerrss’’ BBSSCC iimmpplleemmeennttaattiioonn ((BSR NNoovveemmbbeerr––DDeecceemmbbeerr 22000022)),, iinntteerrnnaattiioonnaall bbaannkkiinngg ggiiaanntt BBaannkk ooff TTookkyyoo--MMiittssuubbiisshhii ((BBTTMM)) llaauunncchheedd aa gglloobbaall BBSSCC iimmpplleemmeennttaattiioonn ffrroomm iittss TTookkyyoo hheeaaddqquuaarrtteerrss.. LLeedd bbyy PPrreessiiddeenntt aanndd CCEEOO NNoobbuuoo KKuurrooyyaannaaggii,, BBTTMM hhaass tthhuuss eemmbbaarrkkeedd oonn aa jjoouurrnneeyy ttoo uussee BBSSCC aass aann eenntteerrpprriisseewwiiddee ssttrraatteeggiicc mmaannaaggeemmeenntt ttooooll.. IInn tthhee pprroocceessss,, BBTTMM iiss uunnddeerrttaakkiinngg aa ggrroouunnddbbrreeaakkiinngg aapppplliiccaattiioonn ooff tthhee BBSSCC:: iinntteeggrraattiinngg iitt wwiitthh eenntteerrpprriissee rriisskk mmaannaaggeemmeenntt.. AAss aa ccoorrppoorraattee ggoovveerrnnaannccee iinnssttrruummeenntt,, tthhiiss iinntteeggrraatteedd mmooddeell—— aanndd BBTTMM’’ss aapppplliiccaattiioonn ooff iitt——iiss ssuurree ttoo ccaappttuurree aatttteennttiioonn..

Do N

ot C

op y o

r P os

and banking executives. As a result, regulatory supervision policies in many advanced countries such as the U.S. and Japan are fundamentally based on the COSO framework. Supranational regulatory bodies such as the Bank for International Settlements have also adopted the concept. Hence, particularly for large complex global banks, implementing the COSO ERM system within the organization is a de facto requirement for what regulators refer to as “safe and sound banking.”

But the COSO ERM concept had never been tied explicitly to the BSC methodology. Scorecard literature typically highlights value-creation strategies such as growth and efficiency. But value loss prevention—the risk manage- ment aspect of these strategies— is rarely mentioned. Similarly, risk management literature tends to focus on risk measurement and assessment, seldom discussing the importance of how these risks align to strategic objectives.

For BTM, a strategy that lacks alignment to risk management is not only insufficient but down- right dangerous. As the series of

recent corporate failures indicates, the aggressive execution of a strategy that lacks appropriate checks and balances can result in disaster. Furthermore, BTM recognizes that risk management is pointless unless it is closely tied to the company’s strategic objectives. After all, risks include all sorts of things—marketplace obstacles, legal hazards, inade- quate or inefficient processes, and fraudulent activities—that might hinder an entity from achieving its objectives. How significant a risk is depends on the relative importance of the objectives it could affect. In short, strategy and risk management are two sides of the same coin; they must be considered in tandem. BTM’s BSC reflects this notion.

MMaappppiinngg tthhee CCOOSSOO EERRMM aanndd tthhee BBSSCC

The BSC and the COSO ERM are largely complementary. For example, the BSC makes strategy everyone’s job via cascading. Similarly, the COSO ERM model suggests that everyone in an entity has some responsibility for enterprise risk management. Given this commonality—that both strategy and risk manage-

ment are everyone’s job—the COSO ERM model can be mapped to the BSC according to its eight components of risk management and internal control (shown by the front face of the COSO ERM cube in Figure 1). In fact, this mapping is the key to integrating the two concepts virtually into one (see Figure 2 on p. 14). Let’s consider each COSO ERM component and how it can be linked to the BSC.

Internal Environment. This refers to top management’s commitment to risk management. In the context of the BSC-COSO linkage, it is about management’s determination to use the BSC with the COSO ERM system to enhance the organization’s safety and soundness. This is akin to the best-practice concept of “Top leadership committed” in Strategy- Focused Organization Principle #1, “Mobilize Change Through Executive Leadership.”

Objective Setting. COSO requires setting four categories of objectives—strategic, operations, reporting, and compliance. From the BSC viewpoint, strategic objectives are those closely associated with achieving the mission and vision of the organi- zation, generally implemented via high-priority projects. Once they are cascaded down to the operational levels, they are trans- lated into “operations” objectives. “Reporting” and “compliance” objectives fit well with social and regulatory strategic themes and objectives in the BSC, which generally show up in the internal and customer perspectives. CSR- related objectives also fit well in these categories.

The benefit of using the COSO ERM model in concert with the BSC is that it helps ensure that all the strategically important objectives of these four categories are included in the BSC, while

Balanced Scorecard Report September–October 2005

Bank of Tokyo-Mitsubishi Aligns Risk Management with Strategy (continued)

Figure 1. The COSO Enterprise Risk Management Cube

The COSO cube depicts how four categories of objective—strategic, operations, reporting, and compliance—overlay the eight components of risk management and

internal controls across all units of an enterprise.

Do N

ot C

op y o

r P os

keeping the organization strategy- focused.

Event Identification, Risk Assessment, Risk Response, and Control Activities. These four components comprise the heart of risk management.4

• Event Identification: Identifying the internal and external events that affect an organization’s abil- ity to achieve its objectives. In the banking industry, risk is typ- ically classified into three cate- gories: market, credit, and oper- ational. All organizational units are responsible for identifying and managing operational risk, which includes legal and regu- latory compliance risk. The trea- sury function is responsible for market risk. All lending-related areas are responsible for credit risk.

• Risk Assessment: Developing scenarios and calculating the likelihood, consequences, and potential costs (tangible and intangible) of each potential risk event. These scenarios are the basis on which the organization determines how it should man- age risks.

• Risk Response: Having in place a plan to address risks either by avoiding, accepting, reducing, or sharing them. This involves aligning risks with the organiza-

tion’s risk tolerance and risk appetite.

• Control Activities: Establishing policies and procedures that help an organization efficiently and effectively carry out risk responses.

An organization is ready to execute these processes for proactive risk management once the four types of COSO objectives have been set. To make everyone more accountable for risk management performance, an organization would simply add objectives requiring these steps in every unit’s BSC. This is the most significant benefit BSC brings to the COSO ERM model. For example, by setting a bankwide objective of implementing control self-assessment in every unit’s BSC, everyone is required to go through these steps in the potential risk areas BTM faces.

Information and Communi- cation. The COSO ERM model requires that relevant information be communicated vertically and horizontally within the organization to help people enact their risk management responsibilities. The BSC ensures that strategic infor- mation is cascaded down from the top down. Also, as indicated in the third dimension of the COSO ERM cube, the information

flow applies across organizational levels. Additionally, the BSC/ COSO-based double-feedback loop covers not only strategy- related information flows, but also those related to risk management. This accelerates organizational learning and alignment between strategy and risk management.

Monitoring. Monitoring is typically conducted by two parties: management and internal auditors. Management monitors performance of the organizational units using the BSC. Internal auditors, besides monitoring risk management within each organi- zational unit, validate whether the entire architecture of the strategy- risk linkage is working efficiently and effectively.

AA PPaacckkaaggee DDeeaall ffoorr GGoovveerrnnaannccee aanndd GGooaall AAcchhiieevveemmeenntt

The COSO ERM model expands the use of the BSC to cover the management of risks that might arise in the course of executing strategy. Therefore, when they are used properly together, manage- ment enhances the potential for achieving the organization’s goals and objectives. In addition, by using BSC and the COSO ERM model as a “package” rather than separately, the organization achieves simplicity in governance while minimizing confusion. Although BTM’s linkage is unique, it should be applicable to any organization that seeks to align strategy and risk management.

Moreover, just as the BSC has evolved over time, so we expect the BSC–COSO ERM linkage to do so at BTM. For the sake of the wider application of this linkage model, we expect, and hope, to see further study of it by strategists and risk managers. ■

1 COSO stands for the Committee of Sponsoring Organizations of the Treadway Commission. It was established by five

Balanced Scorecard Report September–October 2005

Bank of Tokyo-Mitsubishi Aligns Risk Management with Strategy (continued)

Figure 2. BSC–COSO ERM Mapping Chart

The elements of risk management defined by the COSO ERM model correspond to the three strategy-related processes defined by the BSC and to the BSC’s feedback properties.Do

N ot

C op

y o r P

os t

accounting and finance professional associations—the American Accounting Association, the American Institute of Certified Public Accountants, Financial Executives International, the Institute of Management Accountants, and the Institute of Internal Auditors—to develop standards for internal controls. For more information, see http://www.coso.org.

2 The COSO Enterprise Risk Management– Integrated Framework, Executive Summary, September 2004, p. 2.

3 Ibid., p.1.

4 For a more exact definition of the four components, refer to http://www.coso.org.

Balanced Scorecard Report September–October 2005

Bank of Tokyo-Mitsubishi Aligns Risk Management with Strategy (continued) Do

N ot

C op

y o r P

os t