Choosing the Right Risk Management Framework for Your Financial Institution

What’s the difference between Enterprise Risk Management (ERM), Integrated Risk Management (IRM), and Governance, Risk, and Compliance (GRC)? Does it really matter if financial institutions use one of these risk management frameworks?

As it turns out, it does. Selecting the right risk management framework empowers financial institutions to meet their strategic goals and achieve better business outcomes.

Let’s first define these frameworks before discussing their benefits.

What are the risk management frameworks?

Financial institutions might rely on one of the following risk management frameworks:

Baseline Risk Management: Baseline risk management involves a systematic approach to recognizing, evaluating, and addressing the risks that may impact a financial institution. It’s Risk Management 101. It encompasses an assessment of the likelihood and consequences of risk, creating strategies to mitigate these risks, and monitoring the effectiveness of these strategies.

Enterprise Risk Management (ERM): ERM is a comprehensive approach to managing risk that necessitates ongoing communication and coordination between business units. Distinct from baseline risk management, ERM involves active participation from senior management and the continuous evaluation of risk.

Integrated Risk Management (IRM): IRM is a framework that fosters a risk-aware culture. It builds on ERM by integrating technology to improve decision-making and boost performance.

Governance, Risk, and Compliance (GRC): GRC is a complex and expansive framework that focuses on achieving business objectives, managing risk, and upholding ethical standards. Unlike the other frameworks, risk is merely one component of GRC.

How can ERM, IRM, and GRC benefit financial institutions?

ERM enhances baseline risk management by adding value and improving performance. It differs from baseline risk management in the following ways:

1. ERM is a continuous, ongoing process led by senior leadership instead of a periodic task performed solely by risk and compliance officers.
2. It integrates insights from across business units, breaking down silos for a more holistic understanding of risk.
3. ERM promotes a collaborative, team-based approach to managing risk.
4. It places a strong emphasis on data to inform decisions.

IRM is a more advanced framework than ERM, offering the following benefits:

1. It adopts a comprehensive perspective on risk, embedding risk management practices into setting goals, assessing performance, and responding to risk.
2. IRM employs a data-centric strategy, utilizing longitudinal analysis to track and interpret risk patterns over time.
3. It fosters a risk-conscious culture, ensuring employees appreciate the importance of risk management and comply with regulations.
4. IRM decreases compliance costs and lowers the expense of fraud and remediation while also offering crucial risk insights for existing and new activities, thereby accelerating the decision-making process.

The Governance, Risk, and Compliance (GRC) framework originated for Fortune 500 companies as a response to Enron and other corporate implosions. It emerged during a period when risk management for financial institutions began to expand from merely addressing financial and security risks to encompassing a broader spectrum of risks.

Designed for large, complex companies, the GRC framework is more resource-intensive than either ERM or IRM, making it particularly suitable for larger financial institutions. Smaller institutions might find the ERM or IRM framework more appropriate, with the option to incorporate GRC solutions into their risk management programs over time.

What risk management framework is the best fit for your institution?

Choosing the most suitable risk management framework requires financial institutions to assess several key aspects introspectively:

1. The size and complexity of their institution
2. The prevailing organizational culture – whether it’s more process-oriented or people-driven
3. Plans for strategic growth
4. Internal core competencies – while investing in technology is crucial for ERM and IRM, institutions must ensure they possess the requisite resources. It’s important to consider whether institutions have adequate risk management personnel and technological expertise to support a more comprehensive approach to risk.
5. Support from the board and executive leadership.

Additionally, it's critical to evaluate the external risk environment. As the landscape of risk broadens and intensifies – from macroeconomic uncertainty and concentration risk in commercial real estate to challenges posed by neo-banks and the integration of digital banking services – financial institutions must assess their risk management requirements rigorously.

Risk management approaches that were sufficient in simpler times may not be adequate in managing the complexity and scale of current risks.