Relevant departments only need to focus on the management of a specific type of risk, and the relevant departments are often familiar with the characteristics of this type of risk.

(1) The traditional risk management system ignores the interrelationship between risks

(2) Traditional risk management systems often fail to pay attention to the interdependence and dynamic nature of risks, leading companies to over-hedging

(3) Under the traditional risk management system, each functional department often uses different methods to assess and measure risks according to their own needs, resulting in the management being unable to uniformly measure the risks faced by the company as a whole.

The definition given by ISO 31000 (International Organization for Standardization): Risk refers to "uncertain impact on objectives", while risk management refers to "coordinating the relevant activities of an agency or organization to control risks."

The definition given by COSO (National Commission to Combat Fraudulent Financial Reporting) in 2004: Enterprise risk management refers to the identification and management of risks that may affect the entity within the scope of the enterprise's risk appetite when the board of directors, management and other personnel formulate overall corporate strategies. Potential risk events provide reasonable guarantee for the realization of the subject's goals.

Comprehensive risk management requires a complete, integrated organization

Comprehensive risk management requires an integrated risk transfer strategy

Comprehensive risk management requires integrating integrated risk management into the company's business processes

Risk appetite and the relationship between risk appetite and corporate strategic goals

Board risk oversight

risk committee

Chief Risk Officer (CRO)

corporate governance structure

Report line and report content

Scenario analysis

pressure test

Comprehensive risk measure

VaR

total risk cost

Indicators for specific risks

Company-wide risk mapping

risk transfer strategy

risk transfer tools

risk monitoring tools

A strong risk culture is one where the actions of a company’s employees are based on a common understanding of shared goals, practices and behaviors

Enterprise-Team-Individual

Risk culture core indicators

(1) Help enterprises define and adhere to their risk appetite

(2) Focus on supervising the most threatening risks.

(3) Identify enterprise-level risks generated at the line-of-business level.

(4) Manage the risk concentration of the entire enterprise.

(5)Manage emerging enterprise risks

(6) Support compliance with company regulations and protect stakeholders.

(7) Help companies understand the correlation and cross-over risks of risk types.

(8) Optimize risk transfer fees based on risk scale and total cost.

(9) Factor capital costs in stress scenarios into company product pricing and business decisions.

(10) Incorporate risk into business model selection and strategic decisions.

definition

Classification

Analysis steps

Analytical method

limitation

1. Advantages and Disadvantages of Scenario Analysis

2. Scenario analysis after the financial crisis

Regulators around the world are beginning to insist that large, systemically important banks prove they can withstand tougher and more realistic scenarios

USA

Europe

future

(1) Capture multiple dimensions of risk through a series of risk indicators; develop new forms of scenario analysis and stress testing to supplement the overall statistical data

(2) Scenario analysis and stress testing shift to a more comprehensive approach

(3) Comprehensive thinking about risks is the direction forward for management. Traditional risk management and comprehensive risk management are not antagonistic.

(1) Scenario stress testing can help banks understand how risks develop over a long period of time and how they transition between different risk types.

(2) Risk models must play a key role in setting the enterprise's risk appetite, analyzing the risks of each business model, explaining how risks interact, and planning for contingencies.

(3) The company needs to determine in advance what response it should give when key warning indicators change.

(1) Future risk managers will operate at the intersection of risk, data science, new understandings of human behavior, and business judgment

(2) Risk managers need to think comprehensively and use new methods to formulate the company’s business strategy

(3) Even if the risk signal is vague, it is necessary to ensure that the company responds reasonably to the risk signal