GRC Tuesdays: Adding Risk Scenario Analysis to Your ERM Processes
In a previous blog, we discussed the importance of risk analysis and how SAP Risk Management’s powerful and flexible configuration can support different risk analysis models. This blog will discuss risk scenario analysis in the risk evaluation process.
According to a recent PWC article, a “risk scenario analysis is a powerful tool that complements existing risk assessment processes.” The article also points out the differences between risk assessment and risk scenario analysis:
“Enterprise risk assessment focuses on identifying and prioritizing existing and emerging enterprise risks. Risk plans are typically developed by risk owners using risk-monitoring and risk reporting processes supported by the ERM function. The goals of the enterprise risk assessment process are to quickly prioritize risks and then drive risk ownership and action.
Risk scenario analysis focuses on identifying potential scenarios caused by existing and emerging risks, risk consequences, and risk plans. The scenarios should be plausible, relevant, and challenging combinations of potential risks in terms of such things as events and trends. Discussions should not focus on whether an event can occur but on how to apply a risk lens in order to assess and respond effectively. The goal of the risk scenario analysis process is to better understand stakeholder activities and communication before, during, and after a risk issue occurs.”
Risk scenarios analysis can lead to better “identification of common risk drivers, interrelationships, and dependencies to support coordinated risk plans, improved integration between risk management and business and strategic planning and integration of risk simulation processes with strategic decision making”
Scenario Management Features
SAP Risk Management provides features to define scenarios to describe risks and their impacts. This allows risk managers to address complex cross-organizational scenarios to make better decisions.
You can use the Scenario Management in SAP Risk Management to create a scenario case. The scenario case contains related risks, events, assumptions about the risk values used, scenario responses, and results of the scenario analysis. Risk managers can create scenarios, define the assumptions, and analyze the responses and results of the scenario analysis in both graphical and non-graphical views.
Monte Carlo Simulation
The Monte Carlo simulation is another powerful tool that can help risk stakeholders make better decisions about their risks by selecting risks and assigning them to a random distribution to simulate the total aggregated loss at risk for the selected simulation. SAP Risk Management allows users to create a simulation which contains relevant risks and descriptions, assumptions, and the results.
For example, a risk stakeholder can use a Monte Carlo simulation to estimate the best, worst, and average impact of supply chain risks to a company’s revenue. The results can be printed and shared with risk stakeholders to help them to make decisions on the remediation action. The graphical overview and the business terminologies in SAP Risk Management’s Monte Carlos simulation help risk managers to communicate with executive management effectively and efficiently without presenting the detailed complex quantitative background.
In addition to the scenario management and Monte Carlo features, SAP GRC solutions provide real-time dashboards that are updated automatically with the latest risk information to speed up collaboration, enabling quick and timely risk treatment and monitoring.