risk-management git:20251217.3f83b43A

Immutable. This exact content never changes and is served at /api/v1/blob/f50850cd6ea468c4.

---
name: risk-management
description: Enterprise risk management expertise for ERM frameworks, risk assessment, business continuity, insurance strategy, third-party risk, and reputational risk. Use when assessing risks, building continuity plans, or managing organizational risk exposure.
---

# Risk Management Expert

Comprehensive risk frameworks for enterprise risk assessment, business continuity, and risk mitigation.

## Enterprise Risk Management (ERM)

### COSO ERM Framework

```
COMPONENTS:

GOVERNANCE & CULTURE:
- Board risk oversight
- Operating structure
- Defines desired culture
- Commitment to core values
- Attracts, develops, retains talent

STRATEGY & OBJECTIVE-SETTING:
- Analyzes business context
- Defines risk appetite
- Evaluates alternative strategies
- Formulates business objectives

PERFORMANCE:
- Identifies risk
- Assesses severity of risk
- Prioritizes risks
- Implements risk responses
- Develops portfolio view

REVIEW & REVISION:
- Assesses substantial change
- Reviews risk and performance
- Pursues improvement in ERM

INFORMATION, COMMUNICATION & REPORTING:
- Leverages information systems
- Communicates risk information
- Reports on risk, culture, and performance
```

### Risk Categories

| Category | Description | Examples |
|----------|-------------|----------|
| **Strategic** | Risks to business model/strategy | Competitive disruption, M&A failure |
| **Operational** | Risks in day-to-day operations | Process failures, supply chain |
| **Financial** | Financial loss risks | Credit, market, liquidity |
| **Compliance** | Regulatory/legal risks | Regulatory changes, lawsuits |
| **Reputational** | Brand and stakeholder risks | Negative publicity, social media |
| **Technology** | IT and cyber risks | Cyber attacks, system failures |
| **Human Capital** | People-related risks | Key person, talent shortage |
| **External** | Environmental/external risks | Natural disasters, geopolitical |

### Risk Appetite Framework

```
RISK APPETITE COMPONENTS:

RISK APPETITE STATEMENT:
High-level description of risks organization is willing to accept

RISK TOLERANCE:
Acceptable variation from risk appetite targets

RISK LIMITS:
Specific thresholds that trigger action

EXAMPLE:
Risk Category: Credit Risk
Appetite: Moderate credit risk exposure to support growth
Tolerance: Total credit exposure <$500M
Limit: Single counterparty exposure <$25M

RISK APPETITE TIERS:
| Level | Example |
|-------|---------|
| None | Safety incidents causing fatalities |
| Low | Regulatory compliance breaches |
| Moderate | Strategic investments with uncertain returns |
| High | Innovation and new market entry |
```

## Risk Assessment

### Risk Assessment Process

```
RISK ASSESSMENT STEPS:

1. RISK IDENTIFICATION
   - Environmental scanning
   - Stakeholder interviews
   - Workshop facilitation
   - Historical analysis
   - Scenario analysis

2. RISK ANALYSIS
   - Probability assessment
   - Impact assessment
   - Velocity consideration
   - Control effectiveness

3. RISK EVALUATION
   - Risk prioritization
   - Comparison to appetite
   - Aggregation analysis
   - Interdependency mapping

4. RISK RESPONSE
   - Accept (within appetite)
   - Mitigate (reduce likelihood/impact)
   - Transfer (insurance, contracts)
   - Avoid (eliminate activity)

5. MONITORING & REPORTING
   - Key Risk Indicators (KRIs)
   - Risk dashboards
   - Escalation triggers
   - Periodic reassessment
```

### Risk Heat Map

```
RISK MATRIX:

         IMPACT
         Low    Medium    High    Critical
LIKELIHOOD
Very High   3      6        9        12
High        2      4        6         9
Medium      1      2        4         6
Low         1      1        2         3

SCORING:
1-2: Accept/Monitor
3-4: Active Management
6: Senior Management Attention
9-12: Executive/Board Attention
```

### Quantitative Risk Analysis

```
VALUE AT RISK (VaR):
Maximum expected loss over time period at confidence level

EXPECTED LOSS:
EL = Probability × Impact

LOSS DISTRIBUTION:
- Monte Carlo simulation
- Historical simulation
- Parametric methods

SCENARIO ANALYSIS:
| Scenario | Probability | Impact | Expected Loss |
|----------|-------------|--------|---------------|
| Best | 20% | $1M | $0.2M |
| Expected | 60% | $5M | $3.0M |
| Worst | 20% | $20M | $4.0M |
```

## Business Continuity

### Business Continuity Management

```
BCM LIFECYCLE:

1. POLICY & PROGRAM MANAGEMENT
   - Executive sponsorship
   - BCM policy
   - Program governance
   - Resource allocation

2. RISK ASSESSMENT
   - Threat identification
   - Vulnerability assessment
   - Risk prioritization

3. BUSINESS IMPACT ANALYSIS (BIA)
   - Critical process identification
   - Impact assessment over time
   - RTO/RPO determination
   - Resource requirements

4. STRATEGY DEVELOPMENT
   - Recovery strategies
   - Resource requirements
   - Cost-benefit analysis

5. PLAN DEVELOPMENT
   - Documentation
   - Procedures
   - Communication plans
   - Resource lists

6. TESTING & EXERCISE
   - Tabletop exercises
   - Functional tests
   - Full-scale exercises

7. MAINTENANCE & IMPROVEMENT
   - Plan updates
   - Training
   - Continuous improvement
```

### Recovery Objectives

| Metric | Definition | Example |
|--------|------------|---------|
| **RTO** | Recovery Time Objective - Time to restore | 4 hours |
| **RPO** | Recovery Point Objective - Data loss tolerance | 1 hour |
| **MTPD** | Maximum Tolerable Period of Disruption | 24 hours |
| **WRT** | Work Recovery Time - Time to catch up | 8 hours |

### Crisis Management

```
CRISIS TEAM STRUCTURE:

EXECUTIVE TEAM:
- Strategic decisions
- External communications
- Stakeholder management

OPERATIONS TEAM:
- Incident management
- Business continuity
- Resource coordination

COMMUNICATIONS TEAM:
- Internal communications
- Media relations
- Social media

CRISIS ESCALATION:
Tier 1: Operational response
Tier 2: Business unit leadership
Tier 3: Executive team
Tier 4: Board involvement
```

## Third-Party Risk Management

### Vendor Risk Framework

```
TPRM LIFECYCLE:

1. PLANNING
   - Vendor inventory
   - Risk categorization
   - Assessment requirements

2. DUE DILIGENCE
   - Questionnaires
   - Documentation review
   - On-site assessments
   - Reference checks

3. CONTRACTING
   - Security requirements
   - SLAs
   - Audit rights
   - Termination provisions

4. ONGOING MONITORING
   - Performance tracking
   - Risk reassessment
   - Issue management

5. TERMINATION
   - Data return/destruction
   - Access revocation
   - Transition planning
```

### Vendor Risk Tiers

| Tier | Criteria | Assessment |
|------|----------|------------|
| **Critical** | Core business, high data access | Full assessment, annual |
| **High** | Significant operations impact | Comprehensive, annual |
| **Medium** | Moderate business impact | Standard, biennial |
| **Low** | Limited impact | Self-assessment |

### Vendor Assessment Areas

```
ASSESSMENT DOMAINS:

INFORMATION SECURITY:
- Security controls
- Data protection
- Incident response
- Access management

OPERATIONAL:
- Business continuity
- Change management
- Performance history

FINANCIAL:
- Financial stability
- Insurance coverage
- Pricing sustainability

COMPLIANCE:
- Regulatory compliance
- Certifications
- Audit history

REPUTATIONAL:
- Market reputation
- Legal history
- References
```

## Insurance & Risk Transfer

### Corporate Insurance Program

| Coverage | Purpose | Key Terms |
|----------|---------|-----------|
| **Property** | Physical assets | Replacement cost, BI |
| **General Liability** | Third-party claims | Occurrence, aggregate |
| **D&O** | Executive protection | Entity coverage, Side A |
| **Cyber** | Data breach, ransomware | First/third party |
| **E&O/Professional** | Service failures | Claims-made |
| **Employment** | HR-related claims | Wage & hour, EPLI |
| **Crime/Fidelity** | Internal theft | Employee dishonesty |

### Insurance Program Structure

```
PROGRAM LAYERS:

RETAINED RISK:
- Deductible/SIR
- Captive insurance
- Self-insurance

PRIMARY LAYER:
- First dollar coverage (after retention)
- Lower limits
- Broader coverage

EXCESS LAYERS:
- Higher limits
- Follows primary terms
- Multiple carriers

UMBRELLA:
- Additional limits
- Gap coverage
- Broader coverage
```

### Risk Financing Strategy

```
RISK FINANCING OPTIONS:

RETENTION:
- Self-insurance
- Captive insurance
- Large deductibles
Pros: Cost control, cash flow
Cons: Volatility, capital requirements

TRANSFER:
- Traditional insurance
- Alternative risk transfer
- Contractual transfer
Pros: Certainty, expertise
Cons: Cost, coverage gaps

HYBRID:
- Captive + reinsurance
- Finite risk programs
- Parametric solutions
Pros: Optimization
Cons: Complexity
```

## Operational Risk Management

### Operational Risk Framework

```
OPERATIONAL RISK CATEGORIES:

PEOPLE:
- Human error
- Inadequate training
- Fraud
- Key person dependency

PROCESS:
- Control failures
- Procedure gaps
- Documentation issues
- Capacity constraints

SYSTEMS:
- IT failures
- Data integrity
- System integration
- Technology obsolescence

EXTERNAL:
- Vendor failures
- Regulatory changes
- Natural disasters
- Market disruptions
```

### Key Risk Indicators (KRIs)

| Risk Area | KRI | Threshold |
|-----------|-----|-----------|
| **Operational** | Process exceptions | >5% |
| **Technology** | System downtime | >99.9% uptime |
| **People** | Staff turnover | <15% |
| **Vendor** | SLA breaches | <5% |
| **Compliance** | Policy violations | 0 critical |

### Control Assessment

```
CONTROL EVALUATION:

DESIGN EFFECTIVENESS:
- Is the control properly designed?
- Does it address the risk?
- Is it documented?

OPERATING EFFECTIVENESS:
- Is it consistently applied?
- Is it working as intended?
- Is evidence maintained?

CONTROL RATINGS:
Effective: Control works as designed
Needs Improvement: Minor gaps
Inadequate: Significant gaps
Absent: No control in place
```

## Reputational Risk

### Reputation Risk Framework

```
REPUTATION DRIVERS:

PRODUCTS & SERVICES:
- Quality
- Safety
- Value

CORPORATE BEHAVIOR:
- Ethics
- Governance
- Environmental impact

WORKPLACE:
- Culture
- Diversity
- Employee treatment

LEADERSHIP:
- Integrity
- Competence
- Communication

FINANCIAL:
- Performance
- Transparency
- Investor relations
```

### Reputation Monitoring

```
MONITORING SOURCES:

MEDIA:
- Traditional news
- Online publications
- Broadcast

SOCIAL:
- Twitter/X
- LinkedIn
- Reddit
- Industry forums

STAKEHOLDER:
- Customer feedback
- Employee surveys
- Investor calls
- Analyst reports

METRICS:
- Sentiment score
- Share of voice
- Message pull-through
- Crisis response time
```

## Risk Reporting

### Board Risk Reporting

```
BOARD REPORT ELEMENTS:

EXECUTIVE SUMMARY:
- Top risks
- Emerging risks
- Risk appetite status

RISK DASHBOARD:
- Heat map
- Trend analysis
- KRI status

DEEP DIVES:
- Focus areas
- Incident summary
- Response effectiveness

FORWARD LOOK:
- Emerging risks
- Strategic risks
- Mitigation plans
```

### Risk Metrics Dashboard

| Category | Metric | Target | Status |
|----------|--------|--------|--------|
| **Risk Appetite** | Risks within tolerance | 100% | |
| **Incidents** | Material losses | 0 | |
| **Controls** | Effective controls | >90% | |
| **Issues** | Overdue remediation | <5% | |
| **Training** | Completion rate | >95% | |

## See Also

- [Fortune 50 Security](../fortune50-security/SKILL.md)
- [Fortune 50 Legal/Compliance](../fortune50-legal-compliance/SKILL.md)
- [Fortune 50 Finance](../fortune50-finance/SKILL.md)