Time to teach erm

The meltdown in the worldsfinancial markets, including the implosion of several major financial institutions, is spawning calls for significant improvements in risk management. Many believe that board and senior executive oversight of key risk exposures has failed miserablyby placing too much focus on known risk areas, such as operations and compliance, and too little focus on risks related to strategy and forward-looking events. In a October 2008 speech to the U.S. Federal Reserve Board of Governors, Fed Governor Randall Knoszner called for the integration of strategy and risk management and noted that the survival of financial institutions will hinge on such an integration. Similary , U.S. department of Homeland Security Secretary Michael Chertoff recently told an audience at the University of Pennsylvanias Wharton School of Management that our society simply failed on a looking-fordward basis to manage risk properly. These calls for more effective risk management should not only be thoroughly evaluated by boards, senior executives, and regulators, but also warrant intense consideration by university business schools, given their responsibility for educating the next generation of business leaders. In response, business schools, including accounting program that produce future internal audit leaders, are considering the implications of the recent financial crisis on their curricula, such as the need for different, more extensive training on the challenges of managing risk acroos complex enterprises. MOVING TOWARD ERM In recent years, businesses and governments have begun to embrace a more holistic, portofolio approach to risk management widely known as enterprise risk management (ERM). These changes often occur as business leaders realize that current risk management tactics can result in a silo, or stovepipe, approach to risk oversight, whereby individual business functions manage risks related to their operations with little understanding of and considerations for how they affect other functions whitin the enterprise. With a top-down enterprisewide approach to risk management, boards and senior executives are in a better position to see how risk drivers across numerous functions might interact to create significant risks that threaten the organizations ability to achieve its strategic objectives. In many organizations, internal auditingis providing significant leadership in the launch of ERM. Although underlying ERM concepts are relatively easy to understand, implementing ERM can be incredibly challenging. Historically, risk management rarely has beenthe focal point of explicit discussions or training for manyorganizations. Rather, management often assumes that key businessunit leaders understand the fundamentals of risk management and the importance of managing risks for entity survival. For other organizations, risk management merely represents traditional risk management functions, such as compliance, internal auditing, or insurance. To address these challenges as organizations move toward a more formal enterprisewide approach, risk champions are spending

greater amounts of time educating their teams of business leaders about this new mind-set of enterprise risk oversight and its importance to strategic planning and value creation. TEARING DOWN SILOS Like most organizations, business schools suffer from their own silos. Business schools are rewarded for having highly acclaimed experts on their faculties with in-depth, specialized knowledge and understanding of complex topics. As a result, risk management education within undergraduate and graduate business programs tends to be silo-based. That is, finance courses teach techniques for managing finance-related risks, through topics such as hedging and derivatives, while IT courses address the importance of managing IT-related risk exposures, and human resources educators address risks related to employment strategies and compensation. Because these courses are not explicitly designed to educate on risk management, students are not exposed o the fundamentals of risk management oversight. And, although these silo-topic courses often address specific risk-related issues in depth, they fail to help students adequarelly understand across sios, nor do they explain the relative importance of comprehending how risk management interacts with strategic planning and value creation. If business schools do not embrace a more holistic, enterprisewide approach to risk management, future business leaders will be no better prepared than current executives to meet the increasing demands for better risk oversight across tomorrows enterprises. To respond to these emerging expectation, business schools need to explore how they can provide ERMrelated learning opportunities. Often this will involve courses that explicity educate tudents on the fundamentals of ERM. This may likely involve courses to help students understand how ERM brings together conventional risk management techniques that may have been studied in more traditional courses. Once students have a big-picture view of the core elements of effective ERM, then additional coursework in strategy that more explicitly embeds risk thinking as a fundamental part of strategic planning is critical to ensure students realize the strategic value of more effective risk oversight. Further coursework in risk management techniques, such as training in probability evaluation, variance-at-risk techniques, insurance, and hedging and derivative tools, can provide students a strong foundation for risk management leadership later in their careers. Some business schools are responding to these challenges by offering courses that specifically address ERM. For example, the Enterprise Risk Management Initiative in the College of Management at North Carolina State University focuses on how ERM interacts with strategic planning and governance. Graduate courses for Master of Business Administration (MBA), Master of Economics, and Financial Mathematics studies expose students of the fundamentals of ERM, risk measurement and simulation tools, and corporate financial risk management. These students are exposed to real-world examples of ERM practices though the initiatives ERM Roundtable series, in which senior executives from industry and government, such as chief risk officers, chief strategy officers, and chief audit executives, speak about their organizations approach to ERM and related implementation techniques. Other schools are responding to the need for more formal risk management training. The University of Georgias Terry School of Business offers an elective ERM course in its executives MBA program. The

University of Pennsylvanias Wharton School also has an extensive focus on risk management. In addition , a July 2008 BusinessWeek article noted that a growing number of business schools are adding concentrations in risk management. There are viable options for students at business schools that currently do not offer any specific ERM coursework or fail to develop courses in the future. Many schools offer traditional coursework in risk management fundamentals, such as an insurance course. Although these courses may focus on traditional risk management concepts, they provide students a useful foundation in basics such as risk probabilities, impact, and tolerance. Students also should take advantage of strategy courses. Recent calls for improvements in risk oversight emphasize the importance of strstegic risk management that is more forward-looking and focuses on broad macro or systemic risk drivers. An enhanced understanding of strategy development and deployment can be a helpful foundation for developing skills related to strategic risk management. And, because ERM requires the coordinations and integration of risks across many silos, courses focused on project management, leadership, or communications areexcellent for those seeking ERM leadership opportunities. Internships and full-time positions also can provide viable exposure to important ERM issues. Many large organizations are creatingERM functions within the leadership team. Internship and full-time opportunities to work with these functions can be invaluable. Moreover, to be an effective risk champion within the organization, one needs to really understand how the business works. Because ERM is about understanding risk across compex enterprises, professional opportunities that give an individual the chance to see various aspects of the business provide a broader, enterprise understanding of risks. Internal audit positions offer enterprisewide exposure, as do management training programs that provide rotations across various business functions. CALL FOR CHANGE The current financial crisis cleary demonstrates that organizations can no longer think of risk in silos. Similarly, business schools must change how they think about educating the next generation of executives who will be expected to better manage risks across increasingly complex risk drivers. Students are recognizing the importance of these educational opportunities as they observe the crisis unfold. This is particulary true for students seeking more formal risk management training in preparation for careers in internal auditing and public accounting. No longer can institutions of higher lerning delegate risk oversight education to certain areas of the business school curricula. Graduates of business programs are expected to understand the overall risks facing an enterprise and how those risks are interrelated and linked to strategy.