Enterprise Risk Management at Wells Fargo During COVID-19

Introduction

As Beasley (2020) points out, enterprise risk management (ERM) is especially needed during the COVID-19 pandemic because of the "number of different, but interrelated risks spread all across most organizations" (p. 2). COVID-19 is not just a factor that has impacted one business or industry — it has impacted all businesses and all industries in different ways. Grocery chains like Kroger, for instance, have seen increased demand, while restaurants have seen business dry up due to mandated quarantine orders. Small business owners and large corporations alike have filed for bankruptcy. All of this impacts the banking sector and Wells Fargo specifically, given its role in managing loan products, using interest rates to attract savers, and offering investment advice.

"No single risk associated with the COVID-19 pandemic crisis can be managed in isolation," as Beasley (2020) points out (p. 2). This means that from an ERM perspective, the problem must be approached comprehensively, with risk understood at the macro level. This paper provides: (1) a critical analysis, including a comparison and contrast of ERM versus traditional risk management; (2) a discussion of hazard, financial, operational, and strategic risks; (3) a SWOT analysis of Wells Fargo; (4) an examination of the relationship between organizational culture and ERM; (5) a discussion of risk in terms of current and potential profit opportunities; (6) two specific ways in which auditors can incorporate ERM into the company's audits; (7) a discussion of the role of financial derivatives as both a risk management and a speculative tool; and (8) a discussion of how three leading companies — one domestic and two international — implement enterprise risk management.

ERM vs. Traditional Risk Management

ERM is a plan-based business strategy whose purpose is to identify, evaluate, and reduce the impact of potential dangers, threats, and challenges that could be catastrophic or damaging for the organization. ERM allows the firm to reduce exposure to these risks by preparing for them through safety mechanisms, altering strategy to avoid them, or developing a plan to meet these challenges directly. The aim of ERM is to address risk holistically, comprehensively, and from the macro perspective, enabling the firm to pursue its goals and objectives without unnecessary constraint (Sweeting, 2017). Managing risk effectively depends upon an organization's ability to identify and deal with relevant risks while simultaneously understanding and preparing for accepted risks that cannot be avoided if the organization is going to implement its business plan. From this perspective, strategic risk is accepted risk that comes with the opportunity to do business (Kaplan & Mikes, 2012).

ERM is essentially an extension of traditional risk management. In traditional risk management, risk is analyzed and monitored departmentally within an organization. With ERM, risk is analyzed and monitored from an organizational standpoint, and all the risk factors an organization faces are interpreted from this comprehensive macro viewpoint. In traditional risk management, the focus is on pure risk and every risk is viewed as its own separate and distinct problem. With ERM, risk is more comprehensively addressed as part of an overall strategy (Ogutu, Bennett & Olawoyin, 2018).

Traditional risk management looks at the micro; ERM looks at the macro. Traditional risk management issues might include missed opportunities with service partners or lack of innovation. ERM focuses more on linking operational risk with strategic risk management and must emphasize transparency, communication among departmental heads, and collaboration. This is one reason why organizational silos are so damaging from an ERM perspective: they create walls and barriers, foster distinct subcultures, and generate a spirit of contention and distrust where collaboration and communication are needed (Lundqvist, 2014).

As Kaplan and Mikes (2012) point out, ERM examines the mission, values, and boundaries of the organization in order to assess and manage risk. It is not simply a matter of the shipping department looking at suppliers or the accounting department reviewing the audit board. It requires the various departments to work together, discussing plans and assisting organizational leaders in identifying strengths and weaknesses and in determining how best to utilize resources. In the case of Wells Fargo, there have been many occasions when the company should have taken a macro view of risk before initiating a strategy. Its attempt to collect commission fees from customers without their knowledge was a quick way to enhance revenue, but an ERM manager would have quickly recognized this as short-sighted, unethical, and highly risky. Once customers realized how they were being taken advantage of, the company faced severe liability. Its brand appeal was damaged, and the firm's future guidance, share price, and reputation declined. ERM looks beyond the risks a single department faces and considers the organization as a whole.

With traditional risk management, risk is not the driver of decision-making at the executive and strategic levels. Instead, other inputs are analyzed to create strategy, which is then passed down to lower-level department heads who must tailor their operations accordingly. Risk management in this case is reactionary rather than proactive. In ERM, risk management is proactive and used to drive strategy development at the upper levels of organizational management.

ERM therefore adopts a more comprehensive view of risk. Instead of treating each risk as separate and distinct, it examines the interconnected nature of risk and considers how one response impacts other parts of the organization. Traditional risk management adapts risk mitigation plans to the strategy; ERM adapts the strategy to risk mitigation plans. The scope of ERM is larger and more holistic.