How do you ensure that your ERM reporting and disclosure is consistent, accurate, and timely?

A vital process? Insurance has been around for thousands of years and has grown to a multi-trillion dollar industry mostly without undertaking this “vital” process! How could that have happened?

An important first step is choosing metrics. What are you trying to protect and how much risk are you willing to tolerate. For many companies, it might be a combination of: Likelihood of missed earnings or even negative earnings are you willing to tolerate for a quarter. This will vary, but it shouldn't be too strict. Likelihood of business disruption are you willing to tolerate. This might mean regulatory involvement for some companies or putting some growth plans on hold for other companies. This should be less likely, but if we're being honest with ourselves there is some risk that this happens to most companies. Likelihood that we can't meet our obligations to customers. We might tie this to the likelihood of default on a bond.

Establish clear standards and guidelines for ERM reporting and disclosure to ensure consistency and accuracy. Define risk terminology, metrics, data sources, and reporting templates. Document these standards in a policy and communicate them effectively to the ERM team and stakeholders.

A key challenge in ERM reporting is integrating and consolidating data from diverse sources within the organization. Technology and automation play a crucial role in simplifying this process. Utilizing tools like data warehouses, dashboards, analytics, and visualization aids in collecting, storing, analyzing, and presenting ERM data effectively. Compatibility and interoperability with existing IT infrastructure and security protocols are essential considerations for reporting and disclosure systems.

Data gathering is a strenuous exercise if certain organizational data is not being captured through ERPs. Since SAP, Oracle EBS etc have a financial focus, qualitative data e.g. organization-specific KPIs is often ignored. In some instances the system is gathering multiple data points but not all of them are reflected in standard reports. When capturing ERM data, I follow 2 strategies: 1) I liase with functional representatives to start capturing the data on MS Excel via defined formats 2) If the data reliability is reasonable, I lodge a formal report development request with the IT department. This two-pronged approach captures essential data and later we can integrate it into our ERP system.

For timely and relevant ERM reporting and disclosure, regularly review and update information. Continuously monitor risk environment and performance, identifying changes and trends. Seek stakeholder feedback to assess report effectiveness. Adjust reporting frequency, content, and format based on findings.

We need to disclose our risks to senior leadership and the board so that they can ensure that we have the risk risk tolerance. We should disclose our risk tolerance to our customers so that they know how good our promise is. This is an important way for insurance customers to know how likely a company is to fulfill the promise that they have paid for.

Effectively communicating consistent, accurate, and timely ERM reporting and disclosure to stakeholders is crucial. Tailoring communication style and channel to audience needs, using clear language and visuals, and highlighting achievements, challenges, and opportunities in the ERM program are key aspects. Demonstrating the value added by the ERM program to the organization is also essential in effective communication.

ERM reporting and disclosure is crucial for effective risk management. Consistency, accuracy, and timeliness are ensured through robust data governance, clear reporting standards, and automated processes. For instance, using standardized risk taxonomy and metrics enables consistent reporting. Additionally, leveraging data analytics provides timely insights into risk trends. A recent study found that companies with mature ERM programs experienced 18.13% fewer incidents.

One important thing for designing ERM is organizational culture. Culture defines where to start. Additionally people should commit ERM goals.