git:20251217.3f83b43 to git:20251217.30f5541

7 added, 242 removed. Audit A to A.

---

name: risk-management

description: Enterprise risk management expertise for ERM frameworks, risk assessment, business continuity, insurance strategy, third-party risk, and reputational risk. Use when assessing risks, building continuity plans, or managing organizational risk exposure.

---

# Risk Management Expert

Comprehensive risk frameworks for enterprise risk assessment, business continuity, and risk mitigation.

- ## Enterprise Risk Management (ERM)

- ### COSO ERM Framework

- ```

- COMPONENTS:

- GOVERNANCE & CULTURE:

- - Board risk oversight

- - Operating structure

- - Defines desired culture

- - Commitment to core values

- - Attracts, develops, retains talent

- STRATEGY & OBJECTIVE-SETTING:

- - Analyzes business context

- - Defines risk appetite

- - Evaluates alternative strategies

- - Formulates business objectives

- PERFORMANCE:

- - Identifies risk

- - Assesses severity of risk

- - Prioritizes risks

- - Implements risk responses

- - Develops portfolio view

- REVIEW & REVISION:

- - Assesses substantial change

- - Reviews risk and performance

- - Pursues improvement in ERM

- INFORMATION, COMMUNICATION & REPORTING:

- - Leverages information systems

- - Communicates risk information

- - Reports on risk, culture, and performance

- ```

+ **Detailed References:**

+ - [ERM Framework & Risk Appetite](references/erm-framework.md) - COSO framework, risk appetite, quantitative analysis

+ - [Business Continuity Management](references/business-continuity.md) - BCM lifecycle, recovery objectives, crisis management

+ - [Insurance & Risk Transfer](references/insurance-risk-transfer.md) - Insurance programs, risk financing strategies

- ### Risk Categories

+ ## Risk Categories

| Category | Description | Examples |

|----------|-------------|----------|

| **Strategic** | Risks to business model/strategy | Competitive disruption, M&A failure |

| **Operational** | Risks in day-to-day operations | Process failures, supply chain |

| **Financial** | Financial loss risks | Credit, market, liquidity |

| **Compliance** | Regulatory/legal risks | Regulatory changes, lawsuits |

| **Reputational** | Brand and stakeholder risks | Negative publicity, social media |

| **Technology** | IT and cyber risks | Cyber attacks, system failures |

| **Human Capital** | People-related risks | Key person, talent shortage |

| **External** | Environmental/external risks | Natural disasters, geopolitical |

- ### Risk Appetite Framework

- ```

- RISK APPETITE COMPONENTS:

- RISK APPETITE STATEMENT:

- High-level description of risks organization is willing to accept

- RISK TOLERANCE:

- Acceptable variation from risk appetite targets

- RISK LIMITS:

- Specific thresholds that trigger action

- EXAMPLE:

- Risk Category: Credit Risk

- Appetite: Moderate credit risk exposure to support growth

- Tolerance: Total credit exposure <$500M

- Limit: Single counterparty exposure <$25M

- RISK APPETITE TIERS:

- | Level | Example |

- |-------|---------|

- | None | Safety incidents causing fatalities |

- | Low | Regulatory compliance breaches |

- | Moderate | Strategic investments with uncertain returns |

- | High | Innovation and new market entry |

- ```

- ## Risk Assessment

- ### Risk Assessment Process

+ ## Risk Assessment Process

```

RISK ASSESSMENT STEPS:

1. RISK IDENTIFICATION

- Environmental scanning

- Stakeholder interviews

- Workshop facilitation

- Historical analysis

- Scenario analysis

2. RISK ANALYSIS

- Probability assessment

- Impact assessment

- Velocity consideration

- Control effectiveness

3. RISK EVALUATION

- Risk prioritization

- Comparison to appetite

- Aggregation analysis

- Interdependency mapping

4. RISK RESPONSE

- Accept (within appetite)

- Mitigate (reduce likelihood/impact)

- Transfer (insurance, contracts)

- Avoid (eliminate activity)

5. MONITORING & REPORTING

- Key Risk Indicators (KRIs)

- Risk dashboards

- Escalation triggers

- Periodic reassessment

```

- ### Risk Heat Map

+ ## Risk Heat Map

```

RISK MATRIX:

IMPACT

Low Medium High Critical

LIKELIHOOD

Very High 3 6 9 12

High 2 4 6 9

Medium 1 2 4 6

Low 1 1 2 3

SCORING:

1-2: Accept/Monitor

3-4: Active Management

6: Senior Management Attention

9-12: Executive/Board Attention

```

- ### Quantitative Risk Analysis

- ```

- VALUE AT RISK (VaR):

- Maximum expected loss over time period at confidence level

- EXPECTED LOSS:

- EL = Probability × Impact

- LOSS DISTRIBUTION:

- - Monte Carlo simulation

- - Historical simulation

- - Parametric methods

- SCENARIO ANALYSIS:

- |----------|-------------|--------|---------------|

- | Best | 20% | $1M | $0.2M |

- | Expected | 60% | $5M | $3.0M |

- | Worst | 20% | $20M | $4.0M |

- ```

- ## Business Continuity

- ### Business Continuity Management

- ```

- BCM LIFECYCLE:

- 1. POLICY & PROGRAM MANAGEMENT

- - Executive sponsorship

- - BCM policy

- - Program governance

- - Resource allocation

- 2. RISK ASSESSMENT

- - Threat identification

- - Vulnerability assessment

- - Risk prioritization

- 3. BUSINESS IMPACT ANALYSIS (BIA)

- - Critical process identification

- - Impact assessment over time

- - RTO/RPO determination

- - Resource requirements

- 4. STRATEGY DEVELOPMENT

- - Recovery strategies

- - Resource requirements

- - Cost-benefit analysis

- 5. PLAN DEVELOPMENT

- - Documentation

- - Procedures

- - Communication plans

- - Resource lists

- 6. TESTING & EXERCISE

- - Tabletop exercises

- - Functional tests

- - Full-scale exercises

- 7. MAINTENANCE & IMPROVEMENT

- - Plan updates

- - Training

- - Continuous improvement

- ```

- ### Recovery Objectives

- | Metric | Definition | Example |

- |--------|------------|---------|

- | **RTO** | Recovery Time Objective - Time to restore | 4 hours |

- | **RPO** | Recovery Point Objective - Data loss tolerance | 1 hour |

- | **MTPD** | Maximum Tolerable Period of Disruption | 24 hours |

- | **WRT** | Work Recovery Time - Time to catch up | 8 hours |

- ### Crisis Management

- ```

- CRISIS TEAM STRUCTURE:

- EXECUTIVE TEAM:

- - Strategic decisions

- - External communications

- - Stakeholder management

- OPERATIONS TEAM:

- - Incident management

- - Business continuity

- - Resource coordination

- COMMUNICATIONS TEAM:

- - Internal communications

- - Media relations

- - Social media

- CRISIS ESCALATION:

- Tier 1: Operational response

- Tier 2: Business unit leadership

- Tier 3: Executive team

- Tier 4: Board involvement

- ```

## Third-Party Risk Management

### Vendor Risk Framework

```

TPRM LIFECYCLE:

1. PLANNING

- Vendor inventory

- Risk categorization

- Assessment requirements

2. DUE DILIGENCE

- Questionnaires

- Documentation review

- On-site assessments

- Reference checks

3. CONTRACTING

- Security requirements

- SLAs

- Audit rights

- Termination provisions

4. ONGOING MONITORING

- Performance tracking

- Risk reassessment

- Issue management

5. TERMINATION

- Data return/destruction

- Access revocation

- Transition planning

```

### Vendor Risk Tiers

| Tier | Criteria | Assessment |

|------|----------|------------|

| **Critical** | Core business, high data access | Full assessment, annual |

| **High** | Significant operations impact | Comprehensive, annual |

| **Medium** | Moderate business impact | Standard, biennial |

| **Low** | Limited impact | Self-assessment |

### Vendor Assessment Areas

```

ASSESSMENT DOMAINS:

INFORMATION SECURITY:

- Security controls

- Data protection

- Incident response

- Access management

OPERATIONAL:

- Business continuity

- Change management

- Performance history

FINANCIAL:

- Financial stability

- Insurance coverage

- Pricing sustainability

COMPLIANCE:

- Regulatory compliance

- Certifications

- Audit history

REPUTATIONAL:

- Market reputation

- Legal history

- References

- ```

- ## Insurance & Risk Transfer

- ### Corporate Insurance Program

- | Coverage | Purpose | Key Terms |

- |----------|---------|-----------|

- | **Property** | Physical assets | Replacement cost, BI |

- | **General Liability** | Third-party claims | Occurrence, aggregate |

- | **D&O** | Executive protection | Entity coverage, Side A |

- | **Cyber** | Data breach, ransomware | First/third party |

- | **E&O/Professional** | Service failures | Claims-made |

- | **Employment** | HR-related claims | Wage & hour, EPLI |

- | **Crime/Fidelity** | Internal theft | Employee dishonesty |

- ### Insurance Program Structure

- ```

- PROGRAM LAYERS:

- RETAINED RISK:

- - Deductible/SIR

- - Captive insurance

- - Self-insurance

- PRIMARY LAYER:

- - First dollar coverage (after retention)

- - Lower limits

- - Broader coverage

- EXCESS LAYERS:

- - Higher limits

- - Follows primary terms

- - Multiple carriers

- UMBRELLA:

- - Additional limits

- - Gap coverage

- - Broader coverage

- ```

- ### Risk Financing Strategy

- ```

- RISK FINANCING OPTIONS:

- RETENTION:

- - Self-insurance

- - Captive insurance

- - Large deductibles

- Pros: Cost control, cash flow

- Cons: Volatility, capital requirements

- TRANSFER:

- - Traditional insurance

- - Alternative risk transfer

- - Contractual transfer

- Pros: Certainty, expertise

- Cons: Cost, coverage gaps

- HYBRID:

- - Captive + reinsurance

- - Finite risk programs

- - Parametric solutions

- Pros: Optimization

- Cons: Complexity

```

## Operational Risk Management

### Operational Risk Framework

```

OPERATIONAL RISK CATEGORIES:

PEOPLE:

- Human error

- Inadequate training

- Fraud

- Key person dependency

PROCESS:

- Control failures

- Procedure gaps

- Documentation issues

- Capacity constraints

SYSTEMS:

- IT failures

- Data integrity

- System integration

- Technology obsolescence

EXTERNAL:

- Vendor failures

- Regulatory changes

- Natural disasters

- Market disruptions

```

### Key Risk Indicators (KRIs)

| Risk Area | KRI | Threshold |

|-----------|-----|-----------|

| **Operational** | Process exceptions | >5% |

| **Technology** | System downtime | >99.9% uptime |

| **People** | Staff turnover | <15% |

| **Vendor** | SLA breaches | <5% |

| **Compliance** | Policy violations | 0 critical |

### Control Assessment

```

CONTROL EVALUATION:

DESIGN EFFECTIVENESS:

- Is the control properly designed?

- Does it address the risk?

- Is it documented?

OPERATING EFFECTIVENESS:

- Is it consistently applied?

- Is it working as intended?

- Is evidence maintained?

CONTROL RATINGS:

Effective: Control works as designed

Needs Improvement: Minor gaps

Inadequate: Significant gaps

Absent: No control in place

```

## Reputational Risk

### Reputation Risk Framework

```

REPUTATION DRIVERS:

PRODUCTS & SERVICES:

- Quality

- Safety

- Value

CORPORATE BEHAVIOR:

- Ethics

- Governance

- Environmental impact

WORKPLACE:

- Culture

- Diversity

- Employee treatment

LEADERSHIP:

- Integrity

- Competence

- Communication

FINANCIAL:

- Performance

- Transparency

- Investor relations

```

### Reputation Monitoring

```

MONITORING SOURCES:

MEDIA:

- Traditional news

- Online publications

- Broadcast

SOCIAL:

- Twitter/X

- LinkedIn

- Reddit

- Industry forums

STAKEHOLDER:

- Customer feedback

- Employee surveys

- Investor calls

- Analyst reports

METRICS:

- Sentiment score

- Share of voice

- Message pull-through

- Crisis response time

```

## Risk Reporting

### Board Risk Reporting

```

BOARD REPORT ELEMENTS:

EXECUTIVE SUMMARY:

- Top risks

- Emerging risks

- Risk appetite status

RISK DASHBOARD:

- Heat map

- Trend analysis

- KRI status

DEEP DIVES:

- Focus areas

- Incident summary

- Response effectiveness

FORWARD LOOK:

- Emerging risks

- Strategic risks

- Mitigation plans

```

### Risk Metrics Dashboard

|----------|--------|--------|--------|

## See Also

- [Fortune 50 Security](../fortune50-security/SKILL.md)

- [Fortune 50 Legal/Compliance](../fortune50-legal-compliance/SKILL.md)

- [Fortune 50 Finance](../fortune50-finance/SKILL.md)