Running head: ENTERPRISE RISK MANAGEMENT 1
Enterprise Risk Management
Student’s Name
Institutional Affiliation
ENTERPRISE RISK MANAGEMENT 2
Enterprise Risk Management
The rationale for the Technique
Enterprise risk management is a tool that is employed by companies and organizations in
an effort of controlling or preventing any incident. The framework deals with possible risks and
opportunities that can affect a company. The framework enables mutual understanding, efficient
communication and agreement of different levels of the staff. Company managers will be able to
gauge risks the company can face while simultaneously noting steps the company can implement
to move the firm towards attaining set goals (Committee of Sponsoring Organizations, 2004).
The management technique is preferred by organizations due to its ability to foresee future
challenges. Firms can use the framework to prepare for any future emergency. The framework is
also important as it can highlight paths to attaining a company’s goals and objectives. The
management technique is continuously being adapted as a security measure to unplanned events.
In-depth Analysis of the Technique
The first step of the process is aligning the enterprise risk management process to the
company goals. The purpose of the framework is to cushion the company and enable it to attain
most of its goals and objectives. The first phase is accomplished through thoroughly examining
how risk or an opportunity can affect the company in the future (United States Government
Accountability Office; GOA, 2016). An organization starts the enterprise risk management
process by first analyzing threats to the company under different circumstances in the future. The
company then analyzes the company goals and how the framework can be used to attain them
regardless of the situation or challenges that might face the company. The assessment of the
company risks and possible opportunities is often done by the high ranking staff such as the
managers or department heads.
ENTERPRISE RISK MANAGEMENT 3
An informed company staff brings confidence to clients and investors. The enterprise risk
management process aids companies attain their goals and objectives and in the process increase
the worth of the company to the investors and owners. Aligning company goals and objectives,
managers can detect the possible risks in any part of the company, a much more convenient
strategy as opposed to dealing with individual department risks. Through a proper understanding
of the risks, managers and company owners can make more informed decisions while also
allocating the necessary resources to better prepare and counter the risks (GAO, 2016). The top
management of a company has the responsibility of steering a company towards its goal. The
task is bound to bring one across challenges. However, with proper risk analysis, a feat possible
through aligning the enterprise risks management process with the company vision.
The second part of the framework is risk identification. A company faces risk from
various factors as competition, the economy, and politics. The step involves the combination of
possible threats and opportunities that might affect the company and its goals. A part of risk
identification is the identification of the source of the risk. Risk assessment is conducted by
examining internal and external factors. Internal risks can best be detected by the staff of the
company and categorized under different titles as; operational, technological and strategic (GAO,
2016). Employees can be encouraged to identify possible threats and opportunities for the
company. The company can assign the task to the specialist of an area or a department. When a
risk is identified by a specialist by first identifying its source, they can develop the best strategy
to counter the risk and meet company objectives.
The third step of enterprise risk management is to assess the risk. The phase entails
examining the risk and analyzing the possible effects the risk will have on the company. The
phase involves the participation of managers, the experts who identified the risk and the experts
ENTERPRISE RISK MANAGEMENT 4
in the particular area of risk. The three different groups each assess the risk and the possibility of
its occurrence in the company and its possible effects (GAO, 2016). Risks are prone to happen in
any situation. The first to detect the risk is often the risk expert or head of a department in the
company. Once identified, an expert in the type of risk is sought after and tasked with analyzing
the risk. The managers or those who run the company also assess the risk as they have a better
understanding of the company and the possible effects of the risk to the company.
Once the risk is identified, it is categorized into the company's goals. The risk master; the staff
running a department under risk categorizes the risk per their understanding of the department's
strengths. Once the risk master assesses the risk, they categorize the risk as high or low.
Managers who also assess the risk analyze if the risk is strong enough to be a challenge or not.
Once determined, they will either counter the risk or ignore it altogether (GAO, 2016). Different
individuals within the company have different responsibilities towards the identified risk. The
risk master is tasked with analyzing the effects of the risk to their department. The manager also
plays a role in determining if the risk is negligible or if the risk could pose a threat to the
company's goals and objectives.
The fourth step in the enterprise risk management framework is to select a risk response
for the organization. The step of risk response is determined by factors like risk appetite. The
role of deciding on the step to take is often given to the managers. Apart from company
managers, investors are also involved in risk management. Once the proper team is put in place,
they initiate the process by first considering the costs and potential advantages of countering the
risk (GOA, 2016). Some company risks are often negligible, however, should the risk be severe,
the managers and department heads often come together and develop a solution. The solution
ENTERPRISE RISK MANAGEMENT 5
should fit into the company culture and practices. The solution to the risk should also yield
positive results for the company.
Step five is monitoring the risk for any possible changes. Once a risk is identified, the
logical step is developing a solution. The company then monitors the effectiveness of the
solution in an effort of ensuring the process is going as planned. The role of analyzing the
implemented remedies is often taken up by management and department representatives. They
are also responsible for implementing changes if necessary. The leaders of the organization can
utilize the results to follow up on the success of the intervention and the likely outcome (GAO,
2016). Once a solution has been generated and implemented, responsible individuals often
follow up to analyze if the solution is effective. Through monitoring the process, the company
can identify any errors and correct them while simultaneously learn how to handle such risks.
The final step is the communication and reporting of the risk. A company is answerable
to its investors, such a duty requires the company to communicate on discovered risks, the
solutions implemented and the progress of the implemented solutions in solving the risk. The act
of reporting the situation builds confidence in the investors, they are assured of the effectiveness
and dedication of the company directors in solving company challenges and developing solutions
(GAO, 2016). Transparency in a company helps build confidence with the clients and their
investors. Communication with stakeholders and clients on the different risks and solutions can
be done on annual general meetings or stakeholder board meetings. Communication, however,
does not mean the company should reveal sensitive information to the public. Some parts of
company information are confidential, revealing them might result in company ruin from the
competition.
Implementation Process
ENTERPRISE RISK MANAGEMENT 6
Several steps can be taken in the implementation of the enterprise risk management
framework. The first step is to resolve to proactively resolve risks. Implementing enterprise risk
management requires the commitment of different levels of company staff. The next step is the
clarification of the company's risk philosophy. Through the clarification, companies will have a
clear understanding of their risk appetite and capability (Walker and Shenkir, 2008). The act of
implementing enterprise risk management following company goals is a heavy and draining task,
a task that needs dedication. The senior staff or management will have to show dedication to the
implementation that can be emulated by junior staff. A company has a certain limit of handling
risk. Each company has its limit. When a company recognizes its limits and possible risks it is
willing to take, then they are in a better position of implementing the changes.
A company needs to develop a strategy as a step towards implementing an enterprise risk
management framework. The development of a strategy requires one to have a clear
understanding of company goals and vision. Developing a strategy also requires the effort of
different company departments. Apart from developing a strategy, companies should also think
broadly and examine every possible event that may affect company goals and vision (Walker and
Shenkir, 2008). The company through the collaboration of different staff across different levels
needs to come together and develop a strategy that has the company's goals in mind. The activity
is beneficial in developing a clear understanding of the strategy while also bringing the staff
together and creating a stronger bond. The company should also examine possible barriers to its
goals through methods as questionnaires, interviews, and internal self-assessment. The
assessment aims to ensure the company has a full understanding of the results of risks.
Implementing the enterprise risk management framework requires one to assess risk, come up
with an action plan and delegate duties and finally maintain the flexibility to handle new risks.
ENTERPRISE RISK MANAGEMENT 7
Risk assessment involves analyzing the impact of the risk and the probability of the risk
occurring. Developing an action plan and delegating duties is done by top management. Those
who understand the risk more are assigned responsibility. The company should also maintain the
flexibility of acting on unexpected risks by implementing a foreseen action plan (Walker and
Shenkir, 2008). Risk assessment is essential in the implementation process. Through the
assessment, a firm can develop tools that would predict the effect a risk would have on its goals.
The development of an action plan by the department heads will enable the company to manages
serious and minor risks. Flexibility also matters in the implementation process. A company's
flexibility in handling unexpected risks is a bonus in the implementation process.
The final processes of implementing an effective enterprise risk management framework
include; monitoring effectiveness, communicating critical risks and finally making enterprise
risk management part of the company tradition. The company can develop different measuring
tools to assess the effectiveness of the framework. The company also has the responsibility of
alerting different individuals as top management and investors of serious risks that might affect
the company’s goals and objectives. Turning the framework into a company tradition is essential
in equipping the company staff with the necessary skills and knowledge of threats (Walker and
Shenkir, 2008). Implementation of the enterprise risk management framework is a long and
tedious process. However, once implemented, the framework will aid in preventing damage to
the company caused by internal or external risks.
Enterprise Risk Management Application by other Organization
The enterprise risk management framework is an effective tool that has attracted the
curiosity and involvement of major organizations such as the Johnson and Johnson Company.
The Johnson and Johnson company utilizes the enterprise risk management framework in a way
ENTERPRISE RISK MANAGEMENT 8
meant to improve the company. Johnson and Johnson are using the framework in the
identification of risk. They engage in activities as analyzing external factors as trends in health
and law changes (Johnson and Johnson, 2018). The company also adapted risk response as a
means of countering the identified risk. Johnson and Johnson implement control activities as a
way of ensuring the risk response designed is followed by the staff. The control activities also
aid the staff to understand the necessary steps needed to prepare for risk and how best to counter
the risk.
Johnson and Johnson also apply information and communication while also
implementing oversight and monitoring as a way of adapting to the enterprise risk management
framework. According to the Jonson and Johnson framework, the information and
communication segment was implemented as a way of bringing company leaders to date on the
ongoing risks and possible effects. Regular meetings are also implemented in the company as a
way of ensuring the relevant parties are to date on risks plaguing the company. The company’s
oversight and monitoring duties are conducted by outside agents (Johnson and Johnson, 2018).
The company is just one of the companies that are moving with the changing trend. Due to the
researched and proven effectiveness of the enterprise risk management framework, several
companies as Johnson and Johnson are accepting the model and utilizing it to protect the
company from future threats.
Applicability to Amazon
Amazon as a globally established company can utilize the enterprise risk management
framework to its advantage. Risks that Amazon Company faces include cyber attacks, supply
chain, strategic risks, branding among other factors. The company deals with many business
operations that must be kept smooth to avoid delays in service.
ENTERPRISE RISK MANAGEMENT 9
Most of its products are shipped internationally with moist of its consumers expecting the
products and service to be of high quality. Amazon has set up the ERMC (Enterprise Risk
Management and Compliance) team that makes sure that the top risks in the company are
identified and validated while also putting in place the compliance mechanisms(Moeller, 2007).
The team complements other compliance groups that have been embedded within the business to
tackle the risks from the enterprise perspective. Some of the team members have been selected
from many departments and include the compliance specialists, project managers, auditors and
software experts, business intelligence experts and compliance audit team (Cenowski & Mair,
2013). They work together in ensuring that the compliance programs are monitored and tested.
They also implement the mitigation and compliance programs using different management and
leveraging technology solutions to meet the expected compliance requirements. Investigations
are also done to assess how the compliance programs and formulating policies to respond to the
risk factors. Frameworks are developed by the company based on the magnitude of the risks
encountered or the anticipated level of impacts to the company.
The first step of the framework is the alignment of the framework processes to company
goals. Amazon has clearly defined goals set by senior officials which are made public for all
staff of the company. The step involves the participation of senior leaders in making decisions, a
step Amazon founder titled type two decisions. These types of decisions require specialists who
understand the risks and possible effects hence the involvement of senior leaders and department
heads. The framework also calls out for risk identification and preparation (Mullaney, 2017).
Amazon can use the enterprise risk framework in its type one and type two decision-making
ENTERPRISE RISK MANAGEMENT
10
process. Amazon can also apply the framework to analyze the needs of the clients and possible
risks brought about by competitors.
Amazon has used a unique technique in risk assessment that can be utilized by other
firms using the enterprise risk management framework. Risk assessment involves trying to
predict the possibility of the risk and its effect on the company. Risk assessment in Amazon is
achieved by making the employee the boss (Mullaney, 2018). Amazon has a policy that gives
employees the ability to choose stock as a way of compensating them for their determination at
the company. Once a staff member receives the option of owning part of the company, they are
bound to be more dedicated in the workplace and detect possible threats to the company. Part of
the increased working determination is the assessment or company risk and possible effects.
Employees are bound to work harder and avoid activities that might lower the price of the stock,
a situation that might lead to lower profits on their end.
The enterprise risk management framework focuses on selecting risk response and
monitoring risks. Amazon adopted a framework that saw it gain low profits as a technique
against external risk from the competition. Amazon is a cost-conscious and effective company
that manages risks through being pocket-friendly to its clients. Though risky, the company has
managed to outdo competitors who previously posed a threat to the company’s survival
Mullaney, 2018). Amazon is dealing with external risk through having low prices and in the
process eliminating competition that cannot keep up. Amazon also continuously manages risk
by seeking employees who will analyze internal risks and take action in boosting the firm.
Amazon conducts an annual report on its progress, challenges, solutions, and plans. The annual
reports are a form of communication to the public and shareholders on the risks that the company
has encountered and the steps they implemented to benefit from the challenges. Amazon has also
ENTERPRISE RISK MANAGEMENT
11
built several cultures for its staff, cultures that have been accepted and aided in adapting a risk
analysis and solution framework (Mullaney, 2018). Amazon is the leading online marketplace in
the world, a feat that requires extraordinary dedication and hard work. The company was bound
to face challenges along the way, challenges that in most part might have been unforeseen.
However, with a proper enterprise risk management framework, Amazon can adapt to these
challenges and grow to a bigger company.
Plan for Implementation
Enterprise risk management framework implementation is a process through which
tedious is beneficial to a company Amazon included. The implementation process requires the
collaboration of the entire staff team, a feat that requires persistence and training. Amazon can
plan and implement the enterprise risk management framework in steps. The process can start by
educating the staff of the company goals and vision. The next step would be to increase
accountability and train on risk identification, particularly for department heads and senior
managers. Once knowledge of company goals and threat training has been implemented, the
company can initiate the implementation process discussed earlier. The implementation process
might take a while, however, once implemented the results would boost the performance of the
company, a process that would boost public and investor confidence.
ENTERPRISE RISK MANAGEMENT
12
References
Cenowski, H., & Mair, W. C. (2013).CEnterprise risk management and cost: A guide for
directors, executives, and practitioners. Hoboken, N.J: Wiley.Retrieved
from:http://rbdigital.oneclickdigital.com.
Committee of Sponsoring Organizations (2004). Enterprise risk management integrated
framework executive summary. Retrieved from https://www.coso.org/Documents/COSO-
ERM-Executive-Summary.pdf
Johnson and Johnson (2018). Enterprise risk management framework. Retrieved from
https://www.jnj.com/application/pdf:%2092/01/4efd5ba54bc09c6eb227db00da8a/jnj-
erm-framework-2018-update.pdf
Moeller, R. R. (2007).CCOSO enterprise risk management: Understanding the new integrated
ERM framework. Hoboken, N.J: John Wiley & Sons. Retrieved from:
http://www.books24x7.com/marc.asp?bookid=20408.
Mullaney, T. (2017). 5 key business lessons from Amazon’s Jeff Bezos. CNBC. Retrieved from
https://www.cnbc.com/2016/05/13/5-key-business-lessons-from-amazons-jeff-bezos.html
United States Government Accountability Office (2016). Enterprise risk management: selected
agencies’ experiences illustrate good practices in managing risk. Retrieved from
https://www.gao.gov/assets/690/681342.pdf
Walker, P. and Shenkir, G. W. (2008). Implementing enterprise risk management. Journal of
Accountancy. Retrieved from
https://www.journalofaccountancy.com/issues/2008/mar/implementingenterpriseriskman
agement.html
ENTERPRISE RISK MANAGEMENT
13
