Achieving strategic objectives through key risk indicator integration in corporate performance management

¶ … achieve the strategic Objectives by integrating Key Risk Indicators in Corporate Performance Management?

The objective of this study is to assist management in the development of effective key risk indicators (KRIs) to heighten board and management enterprise risk awareness in order to increase the effectiveness of an ERM process and improve execution of an organization's strategy through the corporate performance management. This study will attempt to find gaps in the literature review in this topic and fill it with critical and unique ideas. The target area in this study is the government sector.

Difference in KPIs and KRIs

The work of Beasley, Branson, and Hancock (2010) notes that it has come to the attention of Boards of Directors that they have a great responsibility in regards to overseeing the execution of management of a risk management process across the organization and that this can be accredited to pressure that arise external to the organization. The example stated is the adoption of governance rules by the New York Stock Exchange in 2004 that make a requirement of "audit committees of NYSE-listed firms to oversee management's risk oversight processes." (p.III) Organizational-wide risk-management approaches are being adopted by many organizations in what is known as "enterprise-wide approach to management " or 'ERM'. (Beasley, Branson, and Hancock, 2010, p. III) the ERM process makes provision of "rich information about potential events that may affect the entity" to the board of directors and this is reported as specifically the top risk exposures which can be monitored continuously. May organizations are known to monitor various 'key performance indicators' or "KPIs) which provide the organization with "insights about risk events that have already affected the organization." (Beasley, Branson, and Hancock. 2010, p. III) Key performance indicators (KPIs) must be distinguished from Key Risk Indicators (KRIs). Key Risk Indicators are stated to be critical to the management of an organization that is successful through identification of "underperforming aspects of the enterprise as well as those aspects of the business that merit increased resources and energy" (Beasley, Branson, and Hancock, 2010, p. III) Key risk indicators make provision of "timely leading-indicator information about emerging risks." (Beasley, Branson, and Hancock, 2010, p.III) Key Risk Indicators are predictive in nature about potential risk events that are futuristic for the organization while key performance indicators report, that which has already been experienced by the organization. Key Risk Indicators are useful for assisting the organization in avoiding potential future risk events.

II. Development of Key Risk Indicators in the Organization

The goal or the organization in developing Key Risk Indicators that are effective is the identification of "relevant metrics that provide useful insights about potential risks that may have an impact on the achievement of the organization's objectives." (Beasley, Branson, and Hancock, 2010, p. 2) Because of this selecting and designing KRIs that are effective are stated to start "with a firm grasp of the organizational objectives and risk-related events that might affect the achievement of those objectives." (Beasley, Branson, and Hancock, 2010, p.2)

Linking major risks to the core strategies of the organization assists in gaining the information that is most important and that will best "serves as an effective leading indicator of an emerging risk." (Beasley, Branson, and Hancock, 2010, p.2)

III. Risk Classification Systems

A critical aspect of analyzing risks to determination of the "nature, source, or type of impact of the risk." (a structured approach to Enterprise Risk Management (ERM) and the requirements of ISO 31000, 2010, p.5) Risk classification systems are critically important in enabling the organization to make identification of the "accumulations or similar risks" and as well enable the organization to make identification of the "strategies, tactics, and operations" that are the most vulnerable to those risks. (a structured approach to Enterprise Risk Management (ERM) and the requirements of ISO 31000, 2010,p.3) a detailed risk description would include the following: (1) Name of the risk which uniquely identifies the risk or the risk index; (2) the scope of the risk which includes details of potential events along with a description of those events, the size and the type and number of the events; (3) nature of the risk which is a classification of risks and the timescale and anticipated impact as well as describing the hazard, opportunity or uncertainty of the risk; (4) the stakeholders both internally and externally along with the expectations of each; (5) risk evaluation; (6) loss experience; (7) Risk tolerance, appetite, or attitude; (8) Risk response, treatment, and controls -- existing control mechanisms and activities and what procedures will be used for monitoring the risk; (9) Potential for risk improvement -- Potential for cost-effective risk improvement or modification. Recommendations and deadlines for implementation. Responsibility for implementing any improvements; (10) Strategy and policy developments -- responsibility for developing strategy related to the risk. Responsibility for auditing compliance with controls. (a structured approach to Enterprise Risk Management (ERM) and the requirements of ISO 31000, 2010, p.5)

IV. Risk Management Process

The risk management process is one that should be ongoing and that supports the "development and implementation of the strategy of an organization." (a structured approach to Enterprise Risk Management (ERM) and the requirements of ISO 31000, 2010, p.6) the Risk Management process includes the following: (1) Recognition or identification of risks; (2) Ranking or evaluation or risks; (3) Responding to significant thoughts through: (a) Toleration; (b) Treatment; (c) Transfer; or (d) Termination; (4) Resourcing controls; (5) Reaction planning; (6) Reporting and monitoring risk performance; and (7) Reviewing the risk management framework. (a structured approach to Enterprise Risk Management (ERM) and the requirements of ISO 31000, 2010, p.6)

V. Core Elements of Well-Designed KRIs

The core elements of well-designed KRIs are stated to be inclusive of the following: (1) Based on established practices or benchmarks; (2) Developed consistently across the organization; (3) provide an ambiguous and intuitive view of the highlighted risk; (4) allow for measurable comparisons across time and business units; (5) Provide opportunities to assess the performance or risk owners on a timely basis; and (6) Consume resources efficiently. (Beasley, Branson and Hancock, 2010, p. 6)

VII. Benefits to the Organization

There are stated to be examples of benefits in using KRI development, which includes the following stated benefits: (1) Performance improvement -- KRIs can be used to predictive risks and shifts that emerge over time and which have the potential to bring about a reduction in losses and that make identification of opportunities for exploitation on a strategic level and finally that may bring about a reduction in capital costs through mitigation of view of risk carried by providers of capital; (2) Processes improvements -- KRIs can potentially assist in the reduction of disruptions to service, supply chain management disruptions, and serve to enhance the customer's experience through avoidance of decisions that result in increased risks in these processes; (3) Workplace environment improvements -- KRIs serve to lead to less events in crisis management which results in daily tasks being shoved to the side when full-time attention is needed in such issues and ultimately in the better operation and functioning of the organization. (Beasley, Branson, and Hancock, 2010, paraphrased)

Srimai, Radford and Wright (2010) report that management needs "arriving from the evolving business ecology and focused on creating and sustaining competitive advantage, drive the destiny of PM systems during their evolutionary progression." (p.662) Management tools that presently exist are reported to be reflective of the "result of prior choices in the search for distinct performance measurement capabilities. Their evolution embodies trends in the development and use of performance measurement systems over long periods, and also points the way for future performance measurement to develop and evolve." (Srimai, Radford and Wright, 2010, p.676)

Gordon, Loeb, and Tseng (2009) write that enterprise risk management (ERM) is a holistic approach to risk management and state that the "relation between ERM and firm performance is contingent upon the appropriate match between ERM and five factors which include those which affect a firm: (1) environmental uncertainty; (2) industry competition; (3) firm size; (4) firm complexity; and (5) monitoring by the board of directors. (p.301) Specific business risk considerations are reported in the work of Kendrick (2004) to include: (1) business risks or risks in the business environment that could place barriers in front of the objectives of the corporation; (2) financial risks or the risks to realization of profit; (3) project nd operational risks which means risks to implementation of corporate strategy; (4) reputation risks; and (5) compliance risks. (p.70) Cultural prototypes in the organization effect how risk is addressed and those prototypes are reported to include: (1) entrepreneur: the market rules; (2) egalitarian: cooperation and equality; (3) bureaucrat: reliant on rules and procedures; (4) atomized/stratified: a belief in hierarchy; and (5) autonomous individuals: risks are acceptable as long as they are not derived from coercion. (Aven and Kristensen, 2004, p. 5) Stated as important lessons are: (1) expected values cannot be the only basis of risk acceptance; (2) uncertainty is poorly assessed by people; (3) various factors serve to influence probability assignments; (4) various factors influence the "perception, acceptance and tolerability of risk"; (5) significant differences exist between individuals and groups in the perception and acceptance of risk; and (6) risk perception and acceptance of risk "are fundamentally related to social judgments of things such as responsibility, blame and trust in risk management and managers. (Aven and Kristensen, 2004, p.5)

Summary and Conclusion

It is clear that the benefits of the development of Key Risk Indicators (KRIs) in the organization are such that serve to benefit the organization and on many levels in avoiding future potential risks. It can be said that the foresight of KRIs are much better than the hindsight views of KPIs. It is not easy to ensure that risk, performance and other factors are aligned in the organization but the approach of the use of KRIs in the organization which are founded on principles that identify risk and ultimately the performance management of the organization is clearly a method that will serve to enable the organization in all aspects of the organizational performance and functioning. Key Risk Indicators (KRIs) serve to assist the organization in many areas of their functioning through pinpointing and predicting the possible problems that can arise in many areas of the organizational operations. This enables the organization in answering to its stakeholders on all levels of the organization.