Discuss different steps involved in successful implementation of ERM.

Implementing ERM is not something you do once and forget. It is an ongoing process. The 10 steps are grouped into 4 phases. Each phase builds on the previous one.

Phase 1: Planning and Designing

Step 1 — Identify Intended Benefits and Gain Board Mandate:

First, the bank must clearly identify what it expects to gain from ERM — better risk visibility, stronger compliance, improved capital planning. Most importantly, the Board must formally support and mandate the ERM initiative. Without top-level buy-in, ERM will not succeed.

Step 2 — Plan the Scope and Develop Common Language of Risk:

Define how wide the ERM initiative will reach — which departments, which risks. Equally important, everyone in the bank must use the same risk terminology. When ‘risk’ means different things to different people, communication breaks down.

Step 3 — Establish Risk Management Strategy, Framework, and Roles:

Develop a formal risk management policy. Decide who is responsible for what. This is where the risk architecture, risk strategy, and risk protocols are officially documented.

Phase 2: Implementing and Benchmarking

Step 4 — Adopt Suitable Risk Assessment Procedures and an Agreed Risk Classification System:

Choose the right tools and methods for identifying and assessing risks — such as questionnaires, SWOT analysis, PESTLE analysis, workshops, HAZOP, FMEA, or flowcharts. A consistent risk classification system helps compare risks across departments.

Step 5 — Establish Risk Significance Benchmarks and Undertake Risk Assessments:

Develop benchmarks to determine the significance of identified risks. For financial risks, a monetary threshold is used. For operational disruptions, the length of the disruption may be a suitable benchmark. For reputational risks, the profile of the event and its impact on share price or stakeholder support can be the measure.

Step 6 — Determine Risk Appetite and Risk Tolerance Levels, and Evaluate Existing Controls:

Define how much risk the bank is willing to accept. Evaluate whether existing controls are managing risks within that appetite. All findings go into the Risk Register, which should be viewed as a risk action plan.

Phase 3: Measuring and Monitoring

Step 7 — Ensure Cost-Effectiveness of Existing Controls and Introduce Improvements:

Evaluate whether existing controls are delivering value. Implement risk improvement plans. Also ensure Business Continuity Plans (BCP) and Disaster Recovery Plans (DRP) are in place and regularly tested.

Step 8 — Embed Risk Aware Culture and Align Risk Management with Other Management Tasks:

Risk management must become part of how people think and work every day — not just a compliance task. This step focuses on building that culture and aligning risk management with daily operational tasks.

Phase 4: Learning and Reporting

Step 9 — Monitor and Review Risk Performance Indicators to Measure ERM Contribution:

Track Key Risk Indicators (KRIs) regularly. Review audit reports and evaluate sources of risk assurance available to the Board and audit committee. Investigate the opinions of key stakeholders both internally and externally.

Step 10 — Report Risk Performance in Line with Legal and Other Obligations:

Report to all stakeholders — Board, regulators, and the public — on how risk is being managed and what improvements are being made. A company needs to report to its stakeholders on a regular basis, setting out its risk management policies and the effectiveness in achieving its objectives.

The contents of a typical risk management policy include:

• Risk management and internal control objectives;
• Statement of the attitude of the organization to risk (risk strategy);
• Description of the risk-aware culture; level and nature of risk that is acceptable (risk appetite);
• Risk management organization and arrangements (risk architecture);
• Details of procedures for risk recognition and ranking (risk assessment);
• List of documentation for analyzing and reporting risk (risk protocols);
• Risk mitigation requirements and control mechanisms;
• Allocation of risk management roles and responsibilities;
• Risk management training topics and priorities;
• Criteria for monitoring and benchmarking of risks;
• Allocation of appropriate resources; and risk activities and risk priorities for the coming year.