THE COSO vs ISO SHOWDOWN

background

I have blogged about the roll-out of the COSO ERM update back in 2017. In 2018, ISO updated their well-known risk management standard, too. Since then, I’ve spent considerable time studying and using both standards.  Hence, I now feel comfortable and confident to share my opinion about those two well-known ERM frameworks. In other words, bienvenu to the COSO vs ISO battle.

Specifically, my comments pertain to the ISO 31000:2018 standard and the “COSO Enterprise Risk Management, Integrating with Strategy and Performance – June 2017” edition. The latter being quite a “mouth-full”. 

In this post I set the scene for my considerations and share some high-level, more general comments about each of the standards. The following instalments will contain more detailed elaborations and considerations.

Admittedly, I am an erstwhile COSO-fan who voluntarily turned more into an ISO supporter over the past few years. Over the course of this article I outline why I have changed my preference.

If you prefer to listen the audio version of this blogpost, click on the image below.

Megrow Podcast, Episode 6

standards – why do we need standards?

The world is beautifully diverse, every company is different, and jurisdictions and regulations vary across the globe. Hence, why do practitioners need risk management standards in the first place?

Very strong arguments must be made in favour of standards:

  • activities and outcomes of ERM-work undertaken by different companies and in different locations are easily comparable on a like for like basis
  • standards set a common tone
  • standards set a baseline, i.e. no more need to explain the basics
  • practitioners and consumers of their work can focus on the outcomes and not the underlying methodology – particularly important for Board of Directors
  • and there always is the “best practice” argument and defence

Which standard ?

Risk management standards are commonplace for a long time. Auditing bodies, ISO, COSO, the IRM, RIMS, AS/NZS 4360 and many other institutions have and are issuing RM-manuals and standards. For this series of podcasts, I will focus on the most recent releases of the ISO and the COSO standards, respectively. 

ISO and COSO – A High Level View

Both standards are well known and respected globally. In the same breath, the two guides desperately needed an update. ISO brushed-up after nine years: they released the most recent version in 2018. COSO on the other hand, took 13 years to update. Their most modern publication now dates to 2017.

At first glance, the ISO standard got more comprehensive in its coverage whilst shrinking in size. This was achieved by moving certain parts to other standards and focusing more on principles and high-level frameworks.

In stark contrast, the COSO document is impressive in length, the executive summary already covers 16 pages. The most eye-popping change is the abandonment of the famous COSO cube. COSO developed something akin to a triple helix to describe their view of ERM.

At this stage of the “COSO vs ISO smack down”, the score is even.

ISO

the “E”

The first thing I noticed when reading through the ISO 3100:2018 is the lack of the word “enterprise” almost throughout the document. Has ISO gone back to the bad old days of silo-risk management? I don’t understand this apparent lack of the “E”-word. Having said that, the ISO standard goes to great length and detail referring to the enterprise and its entity, so there is nothing to worry, it seems.

the “SPEAK”

I have a great liking for fluff-free written and spoken communication. ISO scores VERY big in this department. Simple, short sentences. Very little lingo & if there is specific vocabulary, then it gets explained separately in ISO 73.

the “CONTENT”

ISO updated its definition of “risk” to a more modern meaning. They now give attention to the up-side and the downside of risk (FINALLY). Their previous focus on classical hazard risk, which by default knows only down-side, was a serious detractor to use ISO in a strategic and entrepreneurial context. I emphasise that proper management of hazard risk is very important, but ERM is so much more than that. The 2018 update emphasises more on strategic aspects of risk. In addition, it repeatedly calls the board of directors and senior management to duty. 

the “APPROACH”

ISO 31000:2018 focuses on principles and guidelines for ALL risks faced by any entity. On the flipside, the ISO document is rather generic and provides very little, detailed guidance for practitioners. That is a fair point of critique, however basic principles are – by the very nature of the term – generally applicable. The customisation to an industry, company-size and other idiosyncrasies is best left to the practitioners. In addition, regulators, trade bodies and other stakeholders often prescribe certain ERM standards, so the localisation is taken care of by other institutions.

COSO

When I set out as a full-time ERM-pro, I was immediately drawn to COSO. The main attraction was the strong link to business, opportunity risk and strategy. Almost like love on first site. 

My miss-perception that ISO is all about sequential processes that provide no entrepreneurial freedom and dictate compliant business almost how to sharpen their pencils added even more oil into the fire. Going through an ISO 9000 certification many many moons ago didn’t help either.

the “TRIPLE HELIX”

COSO abandoned their famous “cube” and developed something akin to a triple helix. The new shape is supposed to be as comprehensive as possible and depict the entire value chain. I give COSO a lot of credit for having the courage to defect one of their key trademarks. Having said that, the new triple helix appears to be too much of a good thing. It reminds me of the myriad of physicists who try to develop the unified “world formula”. This endeavour is a great thing. However, how many people will truly understand it and how practical is it?

the “SPEAK”

The new COSO framework has the dimensions of a study textbook. Kudos for being that comprehensive. The illustrations look contemporary. However, I have a strong preference for a shorter and crisper version, something like the “core” ERM-approach. The more elaborate considerations, together with examples could have been published in a separate “book”.

the “CONTENT”

COSO’s approach is very comprehensive. New risks, such as the ongoing development of technology and the ever-increasing connection between risks take an important spot in their framework. Furthermore, I like the ongoing emphasis that ERM is linked to strategy and performance. And lastly, COSO published a separate document delving into practical examples. Sadly, this compendium comes at an extra cost. 

the “APPROACH”

I give COSO a lot of credit for their (attention dear listeners: guff alert!!) reach-out to stakeholders through various channels. The authors and publishers released a comprehensive Podcast series, e-distributed brochures and set-up a YouTube channel.

Having said that, the executive summary that reaches almost 20 pages (with all due respect and consideration that COSO needs to give to various stakeholders) is a detractor. Depending on the format you choose, the COSO executive summary is about half the length of the entire ISO 31000 standard.

COSO vs ISO: THE VERDICT

After round one of the COSO vs ISO smack-down my score is as follows: taking conciseness, guff-free language and strong focus on general principles and guidelines into account, my verdict after round one is clear: “GAME and SET for ISO”. Bear in mind though, the match isn’t over yet!

Stay tuned for upcoming editions of the Megrow blog, in which I will take this COSO vs ISO contest into the next rounds. In the meantime, if you have questions about ERM or would like an outside-in-view at your current or planned ERM-efforts, kindly contact me via the links at the bottom of the page.



Megrow Podcast: Episode 5

“The Making Of”

Several listeners have asked me to talk about the technicalities of podcasting. This blogpost summaries my approach of preparing, recording, editing and publishing the Megrow podcast. As a general rule, I strive to combine a decent quality outcome with the use of relatively modest hard- and software. Note though: many roads lead to Rome!

This blogpost is the (almost) verbatim script of the recently released Megrow Podcast Episode 5. If you prefer listening to it, click on this link or the image just below. Otherwise enjoy the reading.

GEAR

You do NOT need to spend thousands of dollars on high-tech equipment or rent a professional studio to record a podcast at decent quality. However, some good equipment is needed to produce professional podcasts. Nothing worse than high quality content that loses its impact due to poor recording and shoddy processing!

A decent quality microphone is the single most important investment to make. Almost any external microphone is better than the built-in microphones in your laptop / tablet / PC / mobile phone.

I purchased a Yeti Blue, for around USD 130, because

  • all the reviews I read, attested the Yeti a very good sound quality
  • the price, whilst not cheap, felt reasonable
  • it connects via USB to any computer
  • no additional hardware, like sound mixers, needed
  • simple plug-in and record, no need to install apps or software
  • both the microphone and the stand feel very robust
  • micro can be adjusted for solo podcasting or interview-type conversations
  • and, I do like the design and the colors
The Yeti microphone is ideal for podcasting
the YETI microphone..

The detailed technical description of the microphone and the color choice is available on the Yeti website. The Yeti is NOT a light-weight!

I also invested 20 USD into a pop-screen. When buying one, make sure it is big enough to cover the entire microphone. Make sure the lock comes with mounting clamps or screws to fix the screen on your mic or the table/stand that you put your recording gear on.

the pop blocker screen
temporary recording studio set-up

recorder

Both iOS and W10 have built-in voice recorders. They work perfectly well for podcasting purpose.

Important: regardless of the device/app you use, make sure it can record with at least 44.1 kHz sampling rate. Most apps have a “setting” or “preference” option where you can adjust audio quality to “maximum” or whatever the terminology of your preferred OS is. 44.1 kHz records sound at excellent quality whilst keeping the audio files at a manageable size.

One thing to note: when using a good quality microphone at 44.1 kHz settings, be absolutely sure that you record in a quiet environment to avoid picking up background noise. Our brains are excellent at filtering out low level noise emanating from air conditioners or cooling fans of computers. However, a good microphone will register fan noise, which will distort your recording. Hence be wary of “silent” noise when recording.

One additional point to note, especially when your recording device runs a different OS than your post-processing device(s). You need to record your audio in a format that the “receiving” OS and software can open and process. 

soft-wear

Once you have recorded your ramblings, you may want to do some post-processing to enhance the messaging of your podcast.

Depending on the operating system you use, different options (at no extra cost) are available for editing your recordings. I mostly edit on a W10 machine using DaVinci Resolve 16 from Blackmagic. This editor is extremely feature rich, requires a journey along a steep learning curve and is available as a free download from the Blackmagic website. I use DaVinci because I grew reasonably familiar with it during the early days of my personal YouTube channel.

On the side: iMovie on your Mac will do the job just as nicely. 

A voice-only editor is insufficient for me, because I add images, titles, lay-over text, video snippets and music to the voice recording.

PROCESS

content creation

Thus far, I’ve had a smooth journey in terms of finding content. I do a lot of Enterprise Risk Management consulting work, hence ERM is a given topic. Let’s hope the creative vibes stay with me for a long time!

I could easily record an entire podcast episode without preparation. However, I prefer to script each episode at great level of detail. Putting my thoughts on paper (aka MS Word) forces some discipline into my thought process. In addition, a script eases content management and instills more focus on the actual delivery. Reading off a script also makes recording quite straight forward. 

And lastly, I release an accompanying blogpost on the Megrow website concomitantly to the podcast. The blog is a very close copy of the actual podcast script, so very little work is needed to cover two communication channels in one go.

Episodes usually last for about 10 minutes. I believe that 10 minutes provide enough time to get some detailed content across without “hand-cuffing” listeners for too long.

quality control

Once I have an almost final version of the script, I choose the “read-aloud” function in MS Word for proofing. Listening to the computer voice whilst following the text is such an efficient way of spotting mistakes and errors. Additionally, I also record the time needed for MS word to read the entire text – just to make sure I stay within the ten minutes target duration.

I’m obviously not a native English-speaker, so spell- and grammar check is a given.

the studio

Once I’m OK with the script, I set up the recording hardware. Mostly, I just put the Yeti on top of a cardboard box and fit the pop-blocker onto the microphone. It doesn’t look very professional, but this set-up is fast and practical. The Yeti microphone needs to stand vertical and you need to talk into the microphone from the front for best sound quality. 

The Making Of: a simple, highly mobile and flexible recording studio set-up
THE recording studio

I record each episode in chapters. Recording in slices makes the process much easier. When I stumble over my own words, I can simply discard the current chapter and re-record it. In addition, bite-sized audio slices also speed up my editing workflow.

editing

My editing process is relatively straight-forward:

  • set the editor – DaVinci Resolve in my case – to 1920×1080 Full HD resolution. This is currently the best choice when considering file size and quality
  • match quality setting of the audio track in your editing software to the high-quality settings used for voice recording
  • add opening screen, the intro and the outro from my templates stock. The intro and outro form the boundaries of the podcast in the editing software’s story line
  • mark chapters in the podcast with distinct titles for easy navigation
  • add images, URLs and video snippets when needed
  • pre-view the episode a few times for final quality control
  • export the project at full HD and upload to YouTube

going live

Recorded and edited, how will the world find your podcast and listen to it?

The state-of-the-art publishing process encompasses publication on one of the well-known Podcast feeders, such as Apple Podcasts or “Podcast Addict” for Android (to name just two). I was initially considering going down that route as well, but after a bit of thinking and tinkering, I decided to simply publish the Megrow podcast on YouTube. 

YouTube has a very distinctive set of advantages

  • it is a very well-known, easily accessible and omnipresent platform
  • tagging and onwards distribution/linking to other Social Media channels is easy
  • I’m familiar with the platform
  • listeners can subscribe to my channel and post comments
  • show notes can be added easily
  • device and platform independent, only needs a browser

My current method of reaching out to my audience is a five-pronged approach:

  • post on YouTube
  • announce the Episode on my Megrow Twitter account
  • put the link on Megrow’s LinkedIn page
  • post link on “my” LinkedIn page
  • publish the (almost) verbatim podcast on Megrow website as a blogpost.

OUTRO

I hope my thoughts will be helpful to some of you who are current or aspiring podcasters! Thank you very much for reading this blogpost. Other blogposts are here. You can contact me via the buttons at the bottom of the page.



Megrow Podcast Episode 4

the intro

Thank for reading the (almost) verbatim script of the recently released Megrow Podcast Episode 4. If you prefer listening to it, click on this link or the image just below. Otherwise enjoy the reading.

there should be a Megrow logo here…. probably a bug in the Gutenberg plug-in…

This episode, the forth one I’m releasing in 2019, is a little different from my previous ramblings. My favorite topic, ERM, is taking a breather for now. Instead, I will share some of the experiences I made setting up and running Megrow. Hopefully, my thoughts are helpful to others who are in a similar situation prior to a start-up journey or any other career move.

the why and the how

Often, I get asked “how and why did you choose to leave the corporate world and embark on this journey”? Before setting up Megrow, I went through a high-level, structured thought process designed to help me in answering the “what’s next” question. I wholeheartedly recommend this approach to anybody who is looking to make any career move. 

This thought-process is about answering three related, yet different questions pertaining to your skills, your preferences and perceived opportunities. If there is overlap between answers, I consider the manifestation of this overlap as an attractive career move. 

the three circles

  1. First, think about what you are really good at. This can be any combination of hard and soft skills.
  2. Second, reflect on your professional passion, in colloquial terms “what gets you out of bed in the morning”.
  3. Third, you need to be very clear whether the intersection of your skills and passion has a “market” now and is likely to have a “market” in the future. I use the term “market” in the very widest sense of the word in this context. This can be anything from entrepreneurship to arts to charity work.

The intersection of the three circles – or more specifically the answers to the questions is a very good starting point to plan.

the three circles model

I came up with this three-realms-idea, when I helped a charity to guide young students along their journey. It is somewhat linked (but NOT a copy) to the well-known Japanese method of “Ikigai”. Ikigai is more complex and philosophical than my simple three circles method. 

Whilst I find this approach very intuitive and extremely helpful, it is crucial to be open-minded for new ideas and opportunities that lay outside of the three realms. Sometimes a good opportunity comes along, hence it is important to stay alert and curious all the while. After all, outcomes matter not processes.

In my case, I am very passionate about Enterprise Risk Management, because it is a greatly undervalued strategic tool; secondly there is a current and future market for it and most humbly, I also think I acquired hard and soft skills necessary to support customers along their ERM-journey.

I’ll share a few examples from my Megrow journey where the three circles overlap well; and other cases where there was not even a touch point, let alone an overlap.

the perception

Often, people ask or challenge me about the benefits of entrepreneurial freedom. More casually put, “life must be wonderful without a boss”. This is the single, biggest misconception about a micro enterprise. I do agree that processes are lean and mean, and Megrow is nimble and efficient. I do have entrepreneurial freedom to manage my time and yes, nobody can “commandeer” me around. However, the pressure and expectation are of a totally different nature when running your own company. As a micro-entrepreneur I am acting in splendid isolation or in “intellectual loneliness”.

I realized this risk of being an eremite very early on and started building a network of like-minded professionals who are in similar situations. I’m grateful to Acacia Ltd in Hong Kong, AKR Zell Consulting and Covolve Pte Ltd in Singapore, Qalybrate in Malaysia and Dr. Bessant in Manila for being such great sparring and business partners over the years! We really do help each other as peers, idea reviewers, we share practicalities, sometimes act as mutual IT-helpdesks and much, much more.

“you are doing your current best and you keep improving”.

my self-mantra

the emotions

The most gratifying experience is direct, positive feedback from a client. Believe me, it doesn’t get better than this.

Clients have told me that my work or what I’ve delivered together with Megrow’s partners has made tangible impact to their bottom line, has solved some of their communication challenges, has opened new sources of revenues or drove their strategic thinking. This feedback is so valuable, especially since I use “outcomes matter” as a tagline very often. In other words, there were moments of grandiose joy and reasons to celebrate lavishly!

Having said that, there have been difficult and challenging periods.

For instance, at one moment in the not too distant past, my name card stock was gravitating towards zero. Despite ongoing and numerous sales efforts, not a single, new mandate was in-sight. At that stage, I was pondering for a very brief moment, whether I really need to print another stack of name cards or just let it all hit “zero”. Of course, I did print a new box of name cards, but still…

the challenges

How do I deal with these challenges? I’d like to share a few points that certainly have helped me over the years.

  • first, never never never stop the marketing and the networking.
  • second, spread the marketing wider than the target client base; often, an indirect recommendation or source of information is most valuable.
  • third, it is OK to chill occasionally, but keeping a good professional routine combined with a balanced lifestyle is such a great baseline! Mens sana in corpore sano – the old Romans knew that already.
  • fourth, occasionally re-do the skills – preference – market thinking process. Especially in times of great innovation, a certain skill can lose its edge rapidly. Or another skill becomes a rare commodity overnight. Think of film cameras or radiologists. I emphasize on the “occasionally”, because if you feel the need to reevaluate your three circles several times a day, something isn’t right with at least one of them.
  • And last, but not least: reflect on your value proposition: is it really unique what and how you are delivering? You might have the greatest product or service on a stand-alone basis, but if somebody offers your service or product as (a free) part of another package, then the market simply isn’t there and, in all likelihood, will not return.

d.y.i. or ?

If you start out and remain a micro enterprise, you have to decide and regularly reevaluate what you will do your-self and what is best outsourced. I probably could do most “internal” tasks, such as accounting, statutory reporting, data management, compliance and logistics myself. However, how efficient is this “solo” approach? And secondly, will I achieve the best outcome if I really do – or try to learn how to do – all these things myself?

I’ll pick three examples to share my experience, the thought process behind my decision and the outcomes.

the logo

passion: yes; skills: NO; market: yes --> outsource

Almost every time I give a name card to somebody, I note from their facial expression and subsequent comments how much they like the Megrow logo. I think it is a stroke of genius. Did I design the logo? I wish I could create an item of such beauty – but no chance. The three-circle model that I described a few minutes back, led me very quickly to the conclusion that designing a logo is NOT something I should try to do myself or aspire to learn.

The detailed self-assessment reads as follows: 

  • I really love creating visual things; hence circle No. 1 gets a tick mark
  • Secondly, there definitely is a market for well-designed logos. In other words, two boxes are ticked already.
  • However, do I have the skills to design a logo or could I acquire them within a meaningful time frame: the straightforward answer is “NO”. I realized the latter a long time ago, so I didn’t even bother thinking about designing a logo myself.

Luckily, my partner JC is very good with colors, shapes and designs, so all credit to her for designing this beauty of a logo. If you are interested in the history and “making of” the logo, head over to the “about” page.

In conclusion, the logo-design is a clear case, where a do-it-yourself approach would not have resulted in anything meaningful.

www

passion: yes; skills: yes; market: yes --> DYI

The Megrow website initially served a compliance purpose. I wanted potential clients to get background information about Megrow and myself. Furthermore, all stakeholders who visit the site should get the impression, that a real business, run by a professional, drives the content. 

When I launched the website a few years ago, I wanted to have more and better content than just “what we do” and “about us”. Driven by this urge, back in 2015 I overdid it with the content. Hence, the web-page became bloated with duplicated and triplicated content. Over time, I have reduced the number of pages and most new content flows into the “blog” section, keeping the other pages stable. The “width” and “breadth” of the site feels very appropriate now.

The list of required features for the website was and remains straightforward: a light design that scales well on different devices, operating systems and browsers; standard fonts and colors; easy to manage, security taken care of; provides for “pages” and a platform for regular “blogging” and the basic social media buttons must be there. Lastly, the platform needs to be coding-free and WYSIWIG-style editing.

After a bit of trying and tinkering, I settled with the official WordPress theme in 2017 and its subsequent updates. I switched over to the controversial Gutenberg editor halfway through 2019, because I find it intuitive and easy to use. Very soon, I might consider migrating the layout to the official 2020 WordPress theme.

more on www

A few years into being webmaster and content creator, I feel comfortable making the following recommendations:

  • as long as your web-presence consists of a few static pages plus a blog, there really, really is NO need to invest in expensive web-design, plug-ins and other customisation.
  • get a proprietary URL for your company.
  • leave no stone “un”turned in finding a good class host; speed, reliability, security and service is of paramount importance no matter how big or small the business is. I chose Axac Pte in Singapore, because they flawlessly host my personal website for 15 years. Their service is excellent, I never had a security issue, back-ups are available, and support is as fast as I need it.

As a side note: if you are a WordPress user, there are meet-ups of the local WordPress community in most bigger cities, highly recommended events to network and learn. I got many an inspiration from such meetups.

must do better

passion: yes; skills: ?; market: yes --> outsource

The final example is a great learning out of an old-school marketing approach. Together with a partner company of Megrow, I spent a lot of time, using modernist templates, to compile a content-rich, hard-copy brochure outlining the “things we do”. We invested significant time and other resources on it, had our fun and our discontent, got it printed on high quality paper and distributed quite a few. Initially, we were quite elated with the outcome. Clients “took” the leaflets and stashed them away.

megrow brochure
the front page of the flyer

More recently, however, each time I pick up a copy in my office and look at it, my enthusiasm to take it to a client meeting gravitates closer to zero. To a point where I don’t use the brochures anymore. There should be much more “ooommmpf” in the leaflet. The more I think about it, the more obvious it gets: we should have outsourced the design and lay-outing. Hence, if I ever decide that Megrow needs a hard-copy brochure again, I will spend money on the design. A lesson learnt!

the journey continues

What are the plans for Megrow heading into year five and further? I’m closing this blog by going back to the “three circles” approach that I described earlier in the podcast.

ERM will remain a core offering of Megrow, because all three circles get a “tick” mark.

Secondly, I have rediscovered my passion for teaching and coaching; Asia remains knowledge hungry (allow me the generalization for now) and I have honed my teaching and coaching skills. Hopefully, knowledge and experience sharing will become a slightly stronger leg to stand on going forward.

And lastly, my track record as an executive, particularly in generating growth and positive results, is another valuable asset to Megrow’s clients in the form of strategy advice or an interim mandate as a C-level executive.

Hopefully, you got some helpful information for your own journey out of this blog-post.

You can contact me via social media, LinkedIn and Email. The respective buttons are at the bottom of the page. Thank you for reading.



Happy Birthday Megrow!

Heading Into Year 5

Megrow Consulting has turned four. A big “THANK YOU” to all clients, business partners, advisers, service providers and supporters for another fruitful year! Time really flies. Sometimes it is hard to believe that Megrow now is in its fifth year of operation.

I am also quite humbled by the high click-rates my “Happy Birthday Megrow” post got on LinkedIn. Close to 2000 views after approximately 1 week!

Looking Back

I’m grateful to some of Megrow’s past and current customers who allow me to display their logos on our site. Head over to the client section of the site to get an impression of our past and current customers. Most notably, the list keeps getting longer every year.

The work my partners and myself have done over the past year has slightly shifted in nature compared to the previous period. ERM did remain a key activity and service. Teaching activities and a significant interim mandate as the Chief Executive of a Lloyd’s of London entity in Singapore complement the 2018/2019 palmares.

High Level Analytics of Megrow's current and past portfolio. Happy Birthday Megrow!
Happy Birthday Megrow! Diversification has improved

ERM remains an important pillar of Megrow’s deliveries. However, the past year has seen a wider diversification of mandates, notably teaching and interim management services grew significantly.

Reto Brosi, founder of Megrow Pte Ltd

The analytics above are the result of a straightforward approach, i.e. I simply counted the number of contracts per category. More accurately, I should have used “hours spent” or “outcomes”. However, for the purpose of a high level view on how the portfolio is developing, this simplified approach is good enough.

The Podcast

I have launched the Megrow Podcast early 2019 and thus far published three episodes. A podcast or more precisely a VLOG on YouTube is a good complement to the other marketing and branding activities that I undertake. You can access the latest episode via the embedded link below.

Episode 3 of the Megrow Podcast, October 2019

The podcast is slowly getting traction, I’m happy with that. Episode 4 is scripted and ready for recording. Furthermore, ideas for a few more releases are ready. Stay tuned! However, all my “shout-outs” for interviews and guest contributors haven’t born fruit yet. Maybe I need to advertise the podcast a bit more emphasizing the high “click” rate the podcasts gets on LinkedIn.

if you would like to appear on the Megrow podcast, contact me via the links at the bottom of the page!

If you like the contents, please subscribe to the channel to stay current with the latest episode.

Looking Forward

Business School teaching and common sense indicate that Megrow is at a stage of either “scale up” or “pack up”. Needless to say, the “scale up” challenge is what keeps me awake at night. From a more transactional perspective, both risk management and teaching are future-proof activities. Naturally, the contents and modes of delivery will evolve. Hence, I need and will “stay modern” in these aspects.

The more challenging consideration, however is the question “how to scale up a micro-enterprise”? Some early successes are emerging, but I’m not yet “at peace” with a more strategic and scalable approach. I’m sure the Happy Birthday Megrow! blog post in a years time will have interesting news to share.
In the meantime, stay tuned for updates on this blog and on Megrow’s YouTube channel.



Megrow Podcast: Episode 3

Episode 3 of the Megrow Podcast is live ! It focuses on the tangible benefits that good ERM brings to a company. If you like to listen to the video podcast, click the embedded link below. However, if you like to read the (almost) verbatim script, just scroll down and enjoy.

The Script of Episode 3

Megrow Podcast Episode 3 picks-up the topic trail where episode two ended. Back in episode 2, I scratched on the importance of making ERM a tangible benefit to any business. In this episode I will elaborate substantially more on this topic and most importantly share some examples to illustrate my point.

the evolution of the benefit slides

I start with a slide that is a core part of Megrow’s marketing materials since almost day 1 of the company. When I show this slide to colleagues and clients, the reactions are always very positive.

all stakeholders benefit from good enterprise risk management

Everybody seems to see the message of “benefits to business” right away. Naturally, some people tell me that the looks of the slide is borderline childish and inappropriate for business. However, the many spontaneous, “eyes wide-open” positive reactions I got and keep getting from different audiences convince me that it is a good slide. Hence, it keeps its important spot in many of my presentations.


Having said that, as I keep acquiring and completing more mandates, I felt the need to give the slide a good second look and decided to overhaul it: more focus and a slightly more polished look. So, here is the new version of the slide:

Good ERM improves results!

The diverse, colorful head image is the best representation of the variety of stakeholders that benefit from good ERM. For the updated version, I reduced the number of “benefits boxes”. Furthermore, I significantly enlarged the “improved results”. The “improved results” text box now sits right below the image – simply to give it the importance it deserves!

On to the real topic now: I will focus on a few, very tangible benefits of good Enterprise Risk Management.

ERM and Credit Rating

I start with the lever that Enterprise Risk Management has on credit rating.

Credit rating is the combination of balance sheet strength analysis and a number of adjustment factors; ERM being a crucial adjustment factor to derive a final credit rating. I refer to AM Bests’ credit rating approach, because I’m most familiar with their method. Having said that, all credit rating agencies use similar ways to go about it.

AM Best increase their assessment by one “notch” for a leading ERM-approach and, most importantly, lower their rating by up to 4 “notches” for an nonexistent ERM-approach. 

”Minus four notches” – that is very very significant. In other words, it pays off greatly to be at the “good practice level” for ERM. At the other end of the scale it is devastating to have a sub-standard ERM-output.

Higher credit rating means access to additional business, hence higher profits. Furthermore, a higher credit rating also lowers financing cost for a company. In reverse, a lowered credit rating closes some doors to business and makes access to some forms of capital more expensive. Hence, good ERM translates 1:1 to improved profit.

ERM Eases Communication

I’m very grateful to the CEO of a customer who “lifted” me onto the second “benefit” I highlight in this paragraph.

During a past mandate, the senior management team of the customer and I spent a lot of time compiling a good “risk appetite statement”. We managed to find a very sensible balance between some quantitative and a few, selective qualitative statements. In other words, we managed to define a tangible, yet flexible enough risk-appetite description. This enables the company to evaluate the up- and downside risks of some major strategic endeavors against its own perception of risk. I was very happy with that outcome.

The icing on the cake: what the CEO shared with me after the company’s next board meeting. According to the CEO, the revised risk appetite statement made the communication with the board so much more tangible, faster, efficient and easier. The bottom line: a significantly more efficient board of directors meeting!

ERM and Cyber

The risk landscape is continuously evolving; most risks are more interconnected and more challenging to mitigate than ever before. The entire realm of Cyber risk is a prime example. Exposures are interlinked, severity and frequency sometimes difficult to estimate and a plethora of mitigation efforts are deployed. ERM with its company-wide, consistent approach to identify and mitigate risk, is the best tool to “up” the defense for a company. It also is best suited to help a company finding additional business opportunities in the Cyber realm.

Thank you for reading through the transcript of the Megrow Podcast Episode 3. More episodes are in the making already. Megrow is here to make your ERM-journey fast and efficient. Contact details are at the bottom of the page.



The Superhuman CRO

I wrote about the “ideal” CRO Superhuman almost a year ago in a blogpost. Interestingly, this topic remains an evergreen. During almost all conversations about ERM sooner or later the question about the CRO’s ideal skill set come up.

the decathlete

In my earlier blog, I used the “decathlete” analogy quite frequently. Whilst this analogy is tangible, it probably isn’t the best explanation in a business context. Hence, I came up with a different, more business-relevant description. A good CRO has a “thorough understanding of the entire value chain” of the respective industry.

What does that mean? Taking the insurance industry as an example, a CRO must understand how risk management and capital provision interlude along the value chain. If we imagine the value chain as a line, then insured and capital provider sit at either end. In business reality, the risk and the capital pass through many hands and undergo multiple transformations. Each component of the value chain has its idiosyncrasies, uncertainties, upside and downside risk embedded in it. Hence, the understanding of the interlude and which ‘change’ triggers which reaction is the key.

In other words, the CRO’s ensures that the organisation

  • understands both external and internal drivers that influence the value chain
  • recognises, quantifies and mitigates downside risks and opportunities associated with these drivers in a consistent manner
who then?

(1) Any professional who has developed a thorough understanding of the entire value chain is a good candidate. Naturally, qualified actuaries and CIIs (or equivalents) with leadership experience are very well suited.

(2) a strong trait of constructive curiosity, excellent communication and influencing skills in all dimension of an organisations current set-up.

(3) a mind-set and corresponding actions to position good ERM as a strategic tool that supports all stakeholders.

Over the past years, I’ve had the opportunity to support clients who asked themselves the “superhuman” question. Together we found a matching answer every time!

you can reach me at reto.brosi@megrow.asia



COSO ERM Framework – One Year After the Update

The COSO ERM framework update

COSO released a significant update of its well-known ERM-framework in late 2017. An executive summary is accessible on their website.  The ERM community, especially the “COSO-istas” most eagerly awaited the update. Additionally, the wider stakeholder community was excited to see how the new framework will benefit businesses.  I’m a fan of COSO because their approach is forward looking and tries to integrate strategy and performance with Enterprise Risk Management.

So far so good.

who is the target?

Once I started reading the executive summary, a few questions came to my mind. First, who is the target audience? Second, how many ERM-sceptics can this update convince? And lastly, where are the increased, practical benefits of this version versus its predecessors? I’ve shared some of my supportive and critical views about the new framework in a few blogposts.

gnōthi seauton

Lo and behold, pwc, one of the key contributors to the revision, published a blog reflecting on the “so what” question one year after the update. I really like the open and candid views in that blogpost. Hurdles, miss-conceptions, prejudices, resistance to change… not surprisingly, it’s all there. My advice: “NEVER EVER GIVE UP”.  Having said that, it is no surprise to me that “take up” of the new framework probably isn’t where the authors envisaged it.

and now?

Talking to practitioners and clients across Asia, I noticed that the new framework needs significantly more marketing. It appears not to be known (almost) at all. Out of the many people I spoke to, only ONE (yes 1) appears to have read the new framework.

I have a few suggestions

  1. The effort to summarise the entire approach into a picture is a great endeavour. However, this double-triple helix (*) needs to be simplified and made more tangible. Only then, business leaders will buy into it. In plain simple English: the current depiction is too complicated.

    COSO ERM framework update
    the COSO ERM double triple helix
  2. Nothing beats tangible, $$$-denominated examples. Concepts and frameworks are great, but ultimately businesses will only buy into it, once they see tangible top and bottom line benefits. Preferably, these benefits are palpable within the coming quarter or two.  Dear reader: I “hear” you screaming that ERM is a long-term strategic undertaking,,,, but after all,,,,, sales and results drive a business.
  3. I’m also cognisant that a special compendium with “real life” cases has been released. However, why do we need to buy and read even another document to convince us that the first document (the framework) is a good thing? Somehow counter-intuitive..
megrow

Whenever I speak or write about ERM, I make a point to emphasise the tangible benefits of good ERM for the business. The benefits come in various shapes and forms:

  1. better understanding of new risks can be transformed into new business
  2. better ERM contributes to positive credit rating evaluation, which will lower capital costs and open doors to new business as well
  3. properly managed Cyber exposures protect the downside and can lead to new business opportunities, too
  4. good ERM will lower compliance costKeen to know more? Contact Megrow via the “buttons” at the bottom of the site and stay tuned for new blogs on www.megrow.asia

    (*) the picture is used with permission from COSO as stated on their website.


ERM – The Benefits

ERM done – so what

I’ve shared some technical and practical considerations about ERM in a few previous blogposts. This episode addresses the most important topic: “ERM done – so what”. Whenever I talk about Enterprise Risk Management, I emphasize on its tangible benefits. ERM is about managing downside and creating opportunity.

The picture below displays a wide, although not complete, stakeholder landscape and the tangible benefits of good ERM. The regulatory, governance and credit rating agency related values are clear. Furthermore, an optimal alignment of risk appetite and capital possibly supports increased risk taking. So far, all so good.

good ERM - happy stakeholders
all stakeholders profit from good ERM

cyber

IMHO Cyber Risk is one of the best cases in point to illustrate practical benefits of ERM; two aspects:

  1. Firstly, the defensive angle: companies must prepare to deal with Cyber attacks as an “entirety”, silos don’t work. This is relatively new category of risk(s), hence it requires some subject matter expertise and a very diligent look “across” the entire organization. Megrow has done Cyber risk mapping with clients (and for its own good – just to state the obvious). I will not dwell on that here. However, if you are interested in good Cyber-webinars, I highly recommend FireEye.com – excellent!
  2. Secondly, the opportunity angle. Let’s assume an insurer covers small and medium sized enterprises. Very many of these clients could and should do more to identify and manage Cyber risks. Buying Cyber insurance is only one mitigating factor. How can the insurer provide additional value and services for this type of risk? The principles of Cyber Risk management are rather universal. In other words, if an insurer has a good grip on its own Cyber risk landscape, this knowledge can become part of its service offering to insureds. This works exactly the same way as traditional loss prevention services that insurers offer their customers. Any sales person of that insurance company will be more than pleased to have an additional service ace in his/her sleeve!

 

In other words, we killed two birds with one ERM-stone. Thorough ERM helps this insurer manage potential downside risk of Cyber and enhances the company’s value proposition to its customers. It doesn’t get much better than this!


ERM – It’s All About Strategy!

NO, it isn’t.

I have sympathy with directors who complain about boring red-amber-green risk heat maps. How do we engage directors for Enterprise Risk Management? COSO and other opinion leaders have taken a great step into the right direction with the new COSO framework. Linking risk and opportunity to strategy and performance is the right way to go. I have shared some thoughts about the 2017 update  in previous blogposts.

however

By its very nature Enterprise Risk Management looks at the entire enterprise. Hence, we need to find a way to cover the micro, such as smaller operational risks AND the macro, such as the really significant risks and opportunities. Then ERM truly becomes “E”. When I accompany customers along their ERM journey’s, I really make sure we cover the entire spectrum. Otherwise we miss out on either end. And btw – that’s the beauty and the challenge of doing good ERM….

and the benefit is

I still have two bones to pick with some of the proponents of the ‘new’ ERM. Firstly, strategy is very important, but let’s not forget all the other, smaller risks! Many a little makes a mickle. And secondly, we need to up the ante in terms of communicating the tangible benefits of ERM. Concepts are great to understand a matter. However, a board of directors or a CEO will want to see expected tangible benefits before engaging a CRO. When writing about ‘tangible benefits’ in a business context, I’m clearly referring to a measurable impact on either sales or profits and preferably on both. These benefits must be on top of the well-documented benefits of good ERM with regards to credit rating or reduction of compliance costs.

Keen to know how my work benefits your company? Contact me via the social media buttons below or directly at reto.brosi@megrow.asia

 

The COSO ERM Update – Megrow Starts the Dissection

The COSO ERM Update – So What?

COSO, together with a number of partners, published the much anticipated ERM-framework update a few months back. I blogged about it the moment it was hot off the press.

The dust has settled, it’s time to dig a little deeper and ponder about the actual impact of the update. The executive summary of the press release already spans 16 pages, giving us an indication about the complexity of the task the authors have tried to tackle.

I decided to look at the new framework from two angles. First: what does it mean to the “converted”, i.e. the ERM practitioners who are familiar with the matter and second, how does an ERM-skeptic (yes, they exist in large numbers… ) look at the new framework and more importantly would it convince him or her to become an ERM-believer?

for the converted

For the “converted” it seems to makes sense. The world has moved on, risks have become more complex, Cyber, IoT and other hot topics were not on the agenda 14 years ago when the original framework was published.

Furthermore, linking ERM to strategy and ultimately to performance also is the right thing to do. After all, elaborately conceived risk heat maps that end up in drawers don’t contribute much to a company’s performance. Boards have become bored with just looking at risk maps, showing numbers in red, amber and green.

And lastly, to counter the ever-increasing complexity of risk with a set of principles is probably the only way to go about it. It is impossible to define universal, detailed standards for today’s and tomorrow’s rapidly evolving risk landscape. Taking the “principles” route is an easy way around being tangible – this criticism of the new framework is heard often.

for the non-converted

stay tuned, update coming soon.