Difference between traditional and enterprise risk management
In the previous article we explored the pivotal role ERM plays in reinforcing the integrity and efficacy of corporate governance. We concluded that understanding risk and how it is managed is vital to the success of any organisation.
Advertisement
It is, however, important to note that over the years, two distinct approaches to risk management have emerged:
Traditional Risk
Management (TRM) and Enterprise Risk Management (ERM). Although they share the same fundamental goal of minimising risk, they approach this goal in different ways. This article will explore the differences between these two approaches.
Understanding Traditional Risk Management
Traditional Risk Management (TRM) emerged in the mid-20th century as a way for organisations to deal with specific, often insurable risks such as accidents, theft and property damage.
The process typically involves identifying, assessing and mitigating risks that could harm an organisation's assets or hinder its operations.
The TRM approach tends to be compartmentalised and often handled in silos within an organisation. Each department or function typically manages its own risks independently,
leading to a somewhat disjointed approach. While this can be effective for managing simple, standalone risks, it is often inadequate for complex, interconnected risks.
Introducing Enterprise Risk Management
The concept of Enterprise Risk Management (ERM) emerged in the late 20th century in response to the increasing complexity and interconnectedness of the business environment.
ERM takes a holistic view of risk, aiming to manage all forms of risk across the entire organisation.
Instead of managing risk in silos, ERM seeks to integrate risk management into all aspects of the organisation, from strategic planning to day-to-day operations.
This allows for a more coordinated and effective response to risk, as well as the opportunity to identify and manage risks that may not be apparent when viewed in isolation.
The Key Differences
The differences between Traditional Risk Management and Enterprise Risk Management can be distilled into the following key points:
1. Scope of Risks Managed
TRM typically focuses on insurable, hazard risks. ERM, on the other hand, takes a broader view, considering all forms of risk, including financial, operational, strategic and reputational risks.
2. Approach to Risk Management
TRM tends to manage risks in silos, with each department handling its own risks. ERM integrates risk management across the organisation, promoting coordination and shared understanding of risks.
3. Relationship with Strategy
In TRM, risk management is often seen as a separate function, with little connection to the organisation's strategy. In contrast, ERM is closely tied to strategy, with risks being identified, assessed, and managed in the context of the organisation's strategic objectives.
4. Risk Appetite and Tolerance
TRM typically focuses on minimising risk as much as possible. ERM, however, recognises that some level of risk is necessary and desirable in the pursuit of strategic objectives.
Therefore, it involves defining the organisation's risk appetite and tolerance – that is, the amount and type of risk it is willing to accept in pursuit of its goals.
Conclusion
Traditional Risk Management and Enterprise Risk Management represent two different approaches to managing risk.
While TRM can be effective for managing simple, standalone risks, ERM's integrated and strategic approach makes it better suited to managing the complex, interconnected risks that organisations face in today's business environment.
Understanding the differences between these two approaches can help organisations to choose the right approach for their needs, and to manage risk more effectively.
The writer is a Chief Operating Officer at Redric Consulting.