A systems approach to enterprise risk management in high-tech industry

Abstract

The high-tech industry is showing increased interest in developing an enterprise wide approach to risk management. There are three reasons for this increased interest; first as the industry has matured, as evidenced by slower growth, increasing consolidation and global competition, managing "costs" has moved to center stage; second, technology product life cycles have progressively shrunk leading to increased technology strategy risk; and third larger events such as 9/11 and corporate scandals have created an awareness of new risks to be managed. In these changed circumstances, the old days of rapid growth and localized & reactive risk management techniques need to be replaced with a capacity to understand risks and manage them effectively across the entire enterprise. Although, risk management has been practiced in the high-tech industry for some time the approaches are based on silo techniques such as insurance, finance, strategy or operations. The challenge is that these varied approaches fall short of holistic risk management and further maintain risk silos that generate additional risks to the organization. To address these silos and develop an enterprise risk management approach we have devised a "generic" and "scalable" risk management framework that could be used by a firm irrespective of its current risk management maturity to achieve a higher level of risk management sophistication. Our approach is based on a three step process; identifying the risks in each of the organizational silos, analyzing their gaps and thereafter developing common risk language and measurement capability across the whole enterprise to close these gaps. To accomplish these three steps a firm can use a 3-T knowledge management assessment framework

(cont.) and a 4-R risk management process methodology. We have also devised a risk management maturity model that helps a firm assess its current risk management sophistication, determine the level of maturity the firm would like to target and so clarify the next steps to get there. We combine these frameworks and methodologies together to create what we call Integrative Corporate Risk Management (ICRM) architecture to help high-tech firms develop a state of the art enterprise risk management capability.