Choosing the Right Risk Management Framework for Your Financial Institution
What’s the difference between Enterprise Risk Management (ERM); Integrated Risk Management (IRM); and Governance, Risk and Compliance (GRC)? Does it really matter if financial institutions use one of these risk management frameworks?
As it turns out, it does. Selecting the right risk management framework empowers financial institutions to meet their strategic goals and achieve better business outcomes.
Let’s first define these frameworks before discussing their benefits.
What are the risk management frameworks?
Financial institutions might rely on one of the following risk management frameworks:
Baseline Risk Management: Baseline risk management involves a systematic approach to recognizing, evaluating and addressing the risks that may impact a financial institution. It’s Risk Management 101. It encompasses an assessment of the likelihood and consequences of risk, creating strategies to mitigate these risks and monitoring the effectiveness of these strategies.
Enterprise Risk Management (ERM): ERM is a comprehensive approach to managing risk that necessitates ongoing communication and coordination between business units. Distinct from baseline risk management, ERM involves active participation from senior management and the continuous evaluation of risk.
Integrated Risk Management (IRM): IRM is a framework that fosters a risk-aware culture. It builds on ERM by integrating technology to improve decision making and boost performance.
Governance, Risk and Compliance (GRC): GRC is a complex and expansive framework that focuses on achieving business objectives, managing risk and upholding ethical standards. Unlike the other frameworks, risk is merely one component of GRC.
How can ERM, IRM and GRC benefit financial institutions?
ERM enhances baseline risk management by adding value and improving performance. It differs from baseline risk management in the following ways:
- ERM is a continuous, ongoing process led by senior leadership instead of a periodic task performed solely by risk and compliance officers.
- It integrates insights from across business units, breaking down silos for a more holistic understanding of risk.
- ERM promotes a collaborative, team-based approach to managing risk.
- It places a strong emphasis on data to inform decisions.
IRM is a more advanced framework than ERM, offering the following benefits:
- It adopts a comprehensive perspective on risk, embedding risk management practices into setting goals, assessing performance and responding to risk.
- IRM employs a data-centric strategy, utilizing longitudinal analysis to track and interpret risk patterns over time.
- It fosters a risk-conscious culture, ensuring employees appreciate the importance of risk management and comply with regulations.
- IRM decreases compliance costs and lowers the expense of fraud and remediation while also offering crucial risk insights for existing and new activities, thereby accelerating the decision making process.
The Governance, Risk, and Compliance (GRC) framework originated for Fortune 500 companies as a response to Enron and other corporate implosions. It emerged during a period when risk management for financial institutions began to expand from merely addressing financial and security risks to encompassing a broader spectrum of risks.
Designed for large, complex companies, the GRC framework is more resource-intensive than either ERM or IRM, making it particularly suitable for larger financial institutions. Smaller institutions might find the ERM or IRM framework more appropriate, with the option to incorporate GRC solutions into their risk management programs over time.
What risk management framework is the best fit for your institution?
Choosing the most suitable risk management framework requires financial institutions to assess several key aspects introspectively:
- The size and complexity of their institution.
- The prevailing organizational culture – whether it’s more process-oriented or people-driven.
- Plans for strategic growth.
- Internal core competencies – while investing in technology is crucial for ERM and IRM, institutions must ensure they possess the requisite resources. It’s important to consider whether institutions have adequate risk management personnel and technological expertise to support a more comprehensive approach to risk.
- Support from the board and executive leadership.
Additionally, it's critical to evaluate the external risk environment. As the landscape of risk broadens and intensifies – from macroeconomic uncertainty and concentration risk in commercial real estate to challenges posed by neo-banks and the integration of digital banking services – financial institutions must assess their risk management requirements rigorously.
Risk management approaches that were sufficient in simpler times may not be adequate in managing the complexity and scale of current risks.
Michael Berman is the founder and CEO of Ncontracts, a leading provider of risk management and compliance solutions. His extensive background in working at Regtech and Fintech firms on legal and regulatory matters has afforded him unique insights into solving operational risk management challenges and drives Ncontracts’ mission to efficiently and effectively manage operational risk. Mr. Berman is a subject matter expert on Regtech with such notable presentations as: featured speaker at American Bankers Association, Independent Community Bankers of America, as well as numerous state association conferences; well-regarded host of monthly webinar series with up to 800 registrants; and published author of national and regional banking publications, including a regular contributor to the ABA Bank Compliance magazine. He is the author of a book about strategic risk management, The Upside of Risk: Transforming Complex Burdens into Strategic Advantages for Financial Institutions, which is available on Amazon. Michael received his undergraduate degree from Cornell University and holds a J.D. degree from the University of Tennessee.