Managing Risk and Performance: A Guide for Government Decision Makers

Chapter 9

Building Enterprise Risk Management into Agency Processes and Culture

John Fraser

Senior Vice President, Internal Audit, and Former Chief Risk Officer, Hydro One Networks Inc.

Drawn from the experience of Ontario electric utility Hydro One, this chapter provides advice for embedding ERM into the processes and culture of an agency, using a small central corporate risk office, reinforcing line accountability for risk management, and encouraging constructive conversations about strategy and risk among decision makers and stakeholders.

Historically, in large organizations, whether governmental or commercial, the business has evolved into operational silos across the organization and into layers of management with varying degrees of alignment of thinking. Enterprise Risk Management (also sometimes referred to as integrated risk management) seeks to operate the entity more effectively by dealing with risks in a holistic manner. ERM requires an honest and sympathetic understanding of human nature. It is not a purely mechanical or automated process, although mechanization and automation can, when injected at the right times and in the right places, help deal with complexity. Ultimately, though, ERM will only work when it embraces the full talents of human beings.

There are two critical elements to Enterprise Risk Management: first, building a shared understanding of key risks through structured “conversations,” and second, using these insights for improved decision making through ...