Integrating Risk Into Your Balanced Scorecard

1. Integrating Risk Into Your Balanced Scorecard Prepared for: StratexSystems Webinar Series 27 September 2012 4 October 2012

2. Content • Recapping on the Balanced Scorecard • Recapping on Risk Management • Integrating Risk into your Balanced Scorecard • Use of Business Drivers to define levels of Appetite & Exposure • Use of Risk taxonomy to identify Risks per Objective

3. The Balanced Scorecard was introduced in 1992 “What you measure is what you get” Raison d'être for Balanced Scorecard was to provide a ‘balanced’ set of performance measurements.

4. The Balanced Scorecard was followed by the Strategy Map in 2000 Strategy Map is a powerful tool for visualising Strategy, showing the cause & effect relationships and tensions within the strategy.

5. Over the last 20 years, the Balanced Scorecard has continued to evolve… Performance Measurement Performance Management Strategy Execution • Raison d'être for Balanced Scorecard was to provide a ‘balanced’ set of performance measurements. • “What you measure is what you get” • - Kaplan & Norton, 1992 With adoption, the Balanced Scorecard evolved to become more focused on strategy. Introduced the 5 principles Translate the Strategy into operational terms Mobilise change through executive leadership Make Strategy a continual process Make Strategy everyone’s everyday job Align the organisation to the Strategy The Balanced Scorecard is now positioned as a framework for enhancing strategic execution. A closed loop system of strategic execution Develop the Strategy Plan the Strategy Align the organisation Plan operations Monitor and Learn Test and Adapt the Strategy

6. The credit crunch and subsequent fall-out is rewriting the rules on strategy execution (and risk management)

7. Kaplan & Norton on Risk and the Balanced ScorecardHBR June 2012 • Three categories of Risk • Preventable Risks • Strategy Risks • External Risks Managing Risk is very different from managing Strategy

8. Kaplan & Norton on Risk and the Balanced Scorecard- What we think… • The 3 categories are just a relatively simple risk taxonomy • Managing Risk is not different to, but a fundamental part of, managing strategy From the father of BSC, no direction on how to integrate Risk in the BSC.

9. So what do we mean when we say “Risk”? • No organisation can create value without taking risk. • “ You have to speculate to accumulate” The possibility that an event will occur and adversely affect the achievement of objectives. COSOIntegrated Risk Management Framework the effect of uncertainty on objectives, whether positive or negative. ISO31000 The uncertainty of future events that will impact on the achievement of objectives, either positively (opportunities) or negatively (threats).Andrew Smart The uncertainty of future events, incorporating both lost opportunities as well as threats materialising, which will impact our ability to achieve business objectives. Client

10. What is Risk Management As much about exploiting opportunities as preventing potential problems. Risk Management is an essential part of good management “coordinated activities to direct and control and organization with regard to risk” risk management framework; “set of components that provide the foundations and organizational arrangements for designing, implementing, monitoring, reviewing and continually improving risk management processes throughout the organization” risk management process; “systematic application of management policies, procedures and practices to the tasks of communication, consultation, establishing the context, identifying, analysing, evaluating, treating, monitoring and reviewing risk” ISO31000

11. There are two major risk management standards which have influenced our thinking… COSO 1994 & 2004 The Risk Standard 2002 • BS31100 • 2008 AS/NZS 4360 2009 ISO31000 2009

12. Over the last 20 or so years Strategy & Risk Management frameworks have evolved largely in isolation Balanced Scorecard 1992 COSO Internal Controls Framework 1994 • Strategy Maps • 2000 ISO31000 2009

13. So to the question…. How to integrate Risk into the Balanced Scorecard? • Use Business Drivers to define levels of risk appetite and risk-taking • Links risk management in the strategic process • Shapes the conversation about risk • Enables the monitoring of the alignment of risk-taking to strategy • Enables us to answer the question: Are we operating within Appetite? • Use your Risk taxonomy to enable the Risk Identification process per objective

14. Risk Appetite has a central role to play in the integration of strategy and risk management • The COSO definition provides ‘What, Who, When and Why’ of risk appetite • What: the amount and type of risk • Who: an organisational entity  • When: over a defined time horizon   • Why: to achieve the objectives of the entity Risk appetite is the amount and type of risk that is acceptable to be taken by an organisational entity over a defined time period, to achieve the objectives of that entity – COSO Enterprise Risk Management Risk appetite sets the boundaries within which strategy is executed – StratexSystems

15. Risk Appetite should be integrated into your organisational strategic framework Identify strengths & weaknesses Business Goals Identify threats & opportunities Internal Analysis External Analysis Is our business model fit for purpose? Is our business model fit for purpose? • Formulation • Development of high-level strategies and allocation of scarce resources, including capital • Given our business context, what is our appetite for risk? • Given our appetite, have we got the right business model? • Are we comfortable with the assumptions we have made? Business Model Formulation Appetite Business Drivers • Setting • From high-level strategies to specific business objectives • Define specific business objectives and appetite for specific entity’s • Allocation of scarce resources by entity, risk category, product lines Business Objectives Setting Appetite Strategy Are we on-track to deliver? Are we operating within appetite? • Execution • Are we on-track to achieve our business objectives • Are we operating within appetite (are we taking too much, or not enough risk?) • Do we have the right level of controls in place to meet internal and external compliance drivers? • Are we aligning our change agenda to our strategic agenda? Execution Performance Management Appetite Risk Management Manage strengths & weaknesses Manage threats & opportunities Appetite Alignment

16. Risk Appetite is the ‘glue’ that brings together Strategy & Risk Strategy Management What are we trying to achieve? What is our Risk Appetite? Performance Management Risk Management Are we on track? Are we operating within appetite? Appetite Governance & Communications Culture

17. We use ‘key’ Drivers to define levels of risk appetite and shape the conversation around risk (and strategy) Business drivers Shareholder value Strategy Capital Share price Manage Performance Appetite Manage Risk Income Economic value add Reputation Profit Align Risk-taking to Strategy Communication Governance Culture

18. Using drivers to frame appetite setting enables the Board to set clear operating boundaries Business Drivers Low Moderate High Extreme Capacity Limit Income X% Capital @Risk X% Capital @Risk X% Capital @Risk X% Capital @Risk Capital Up to X £M X £M to Y £M X £M to Y £M X £M to Y £M Above X £M Reputation Up to X vol. Bad coverage Up to X vol. Bad coverage Up to X vol. Bad coverage Up to X vol. Bad coverage

19. Appetite Alignment Matrix is a key tool for monitoring the alignment of Risk-taking to Strategy • Enabling monitoring of risks which are outside of Appetite • Shows where we are taking to much and not enough risk • Changes the risk conversation • Answers the question: • Are we operating with in Appetite?

20. So to the question…. How to integrate Risk into the Balanced Scorecard? • Use Business Drivers to define levels of risk appetite and risk-taking • Links risk management in the strategic process • Shapes the conversation about risk • Enables the monitoring of the alignment of risk-taking to strategy • Enables us to answer the question: Are we operating within Appetite? • Use your Risk taxonomy to enable the Risk Identification process per objective

21. Common categorisation of risk Risk uncertainty of future events that will impact on the achievement of objectives Strategic Risk uncertainty related to strategic choices Execution Risk uncertainty related to execution of the chosen strategy Operational Risk uncertainty related to processes, people, technology, change etc Credit Risk uncertainty related to a counterparty's ability to meet their obligations Market Credit uncertainty related to the market value of a portfolio

22. The Strategy Map articulates how an organisation creates value Financial Increase Investment Returns by 25% Increase Retention of competent staff by 10% Increase Shareholder value Customer Objective Statement of what strategy must achieve and what’s critical to its success KPIs How success in achieving the strategy will be measured and tracked Targets The level of performance or rate of improvement needed Initiatives Key action programs required to achieve Priorities Internal Process Sustainable Growth Objective KPIs Targets Initiatives Increase Investment Returns by 25% YTD % Increase in investment returns 25% • Implement new portfolio mgt system Learning & Growth

23. However, to create value, risk-taking must be aligned to strategy… Financial Increase Investment Returns by 25% Increase Retention of competent staff by 10% Increase Shareholder value Customer Objective Statement of what strategy must achieve and what’s critical to its success Appetite How much risk are we willing to run to achieve the objective? Exposure How much risk are we currently running? Alignment Is our current risk-taking aligned to appetite? Internal Process Sustainable Growth Objective Appetite Exposure Alignment Increase Investment Returns by 25% Moderate High Over-exposed Learning & Growth

24. Effective risk management supports value creation and protection... Financial Increase Investment Returns by 25% Increase Retention of competent staff by 10% Increase Shareholder value Customer Objective Statement of what strategy must achieve and what’s critical to its success Risks The threats and opportunities (risks) exist which may impact achievement of objectives Thresholds The appetite and tolerance thresholds used to monitor risk Mitigation The activities undertaken to manage risk Internal Process Sustainable Growth Objective Risks Thresholds Mitigation Increase Investment Returns by 25% • Unexpected changes in interest rates • Unexpected Equity movements • Appetite • Tolerances • Controls • Initiatives • Policy & procedures • Processes Learning & Growth

25. Many different types of risks make up the organisational risk universe Financial Increase Investment Returns by 25% Increase Retention of competent staff by 10% Increase Shareholder value Increase Investment Returns by 25% Strategic Risk Operational Risk Insurance Risk Finance Risk Hazard Risk Customer Internal Process Sustainable Growth Learning & Growth

26. Many different types of risks make up the organisational risk universe Financial Unexpected Equity movements Unexpected changes in interest rates Increase Investment Returns by 25% Increase Retention of competent staff by 10% Increase Investment Returns by 25% Increase Shareholder value Operational Risk Insurance Risk Finance Risk Hazard Risk Strategic Risk Customer Internal Process Sustainable Growth Learning & Growth

27. Risk categorises can be used to support risk identification and integration of risk in the Balanced Scorecard Increase Investment Returns by 25% Insurance Risk Underwriting Risk Operational Risk Strategic Risk Hazard Risk Financial Risk Business Risk Reputation Risk Process Risk Market Risk Credit Risk Liquidity Risk People Risk System Risk External Events Legal Risk Claims Mgt Risk Reinsurance Risk Product Risk Premium Risk Civil disruption Health & Safety Accidents Natural

28. How do we define a risk? The risk of (what, where, when)….. caused by (how) ……resulting in..…(impact/consequences) Examples • The risk of financial deficit at end of year caused by decreased in-patient activity and revenue, resulting in rationalisation of service offerings. • The risk of exceeding A&Ewaiting times, caused by increased demand and staff vacancies, resulting in not meeting community expectations and adverse patient outcomes

29. Where do we define Risks? Objectives Key Risks Key Controls

30. The Objectives, Risks and Controls structure is central to Stratex solutions Objectives Risk Appetite Processes Initiatives Systems People & Roles Assets Operational enablers are aligned to strategy KPIs Actions Key Risks KRIs Actions Assessment Events Key Controls KCIs Actions Assessment Certification Governance Commentary Workflows Audit Trails Build a strategy focused, risk aware culture

31. So to the question…. How to integrate Risk into the Balanced Scorecard? • Use Business Drivers to define levels of risk appetite and risk-taking • Links risk management in the strategic process • Shapes the conversation about risk • Enables the monitoring of the alignment of risk-taking to strategy • Enables us to answer the question: Are we operating within Appetite? • Use your Risk taxonomy to enable the Risk Identification process per objective

32. Q&A

33. About StratexSystems Our mission To provide an integrated strategy and risk management solutions which enhances strategy execution, enhance capital efficiency by 15% and reduce operational losses 25% while providing 100% confidence that your business is operating within appetite. “StratexPoint enabled us to reduce the value of our operational losses by 94%, the volume by 63% and our economic capital provision by 23%” - Head of Operational Risk, HML - Skipton group

34. Post credit crunch, Financial Services clients face challenges beyond traditional ‘Risk Management’ Confidence in our approach Proven partners Low Risk Keep us out of the newspaper Cost effective Deliver strategy Reduce capital provision Reduce operational losses Reduce / eliminate fines Enable the right culture Lack of an integrated, enterprise-wide solution Intensive and intrusive FSA oversight Too many spreadsheets Board and Senior Management pressure Systems reinforce silo processes Political pressure to reform and do things differently “Operate within Appetite” Compliance focused risk tools Basel 3, Solvency 2, S166

35. Examples of where our solution has added real and tangible business value 60% Op losses HML seen a 60% reduction in operational losses within 18 months 23% Regulatory capital HMLalso seen a 23% reduction in regulatory capital 182 Initiatives Consolidated global portfolio of major initiatives to enable single view of status & risk

36. Demonstration

37. Free trial of StratexLive • StratexBootcamp • 30 day free use of StratexLive • Regular ‘coaching’ session online • Load your own data • Add your own users • START NOW