Solution
The client wanted to harmonize and streamline its disparate ERM processes in a single framework. MetricStream was chosen because of its capability to closely map organizational requirements to the MetricStream solution, and seamlessly integrate multiple ERM programs. MetricStream also brought to the table tremendous expertise and experience in ERM solutions, built over years of working with some of the largest organizations in the world.
For the client, MetricStream implemented an integrated ERM solution consisting of Risk Management, Compliance Management, and Issue Management applications that provided the following capabilities:
Risk Assessment and Analysis
The MetricStream ERM solution provides a centralized framework to easily document and manage all risks. Configurable embedded methodologies and algorithms enable both qualitative and quantitative risk assessments, helping decision-makers gain a clear view into the client’s risk profile and prioritize their risk-response strategies. The solution also supports residual risk rating to determine if risks need to be mitigated or accepted.
Compliance Management and Control Assessments
The MetricStream ERM solution helps the client define and maintain a centralized structure of the overall risk and control hierarchy, including processes and assets in scope, risks for the processes and assets, controls to address the risks, and mechanisms to address the controls. The solution facilitates automated control assessments based on predefined criteria and checklists with capabilities for scoring, tabulating, and reporting results. The assessment scores are automatically integrated with the risk scores to help the client determine if all controls are functioning effectively.
Loss Management
The MetricStream ERM solution captures loss incidents and near misses through manual or automated feeds. In-built statistical and trend analysis capabilities enable managers to identify key risks, analyze root causes, track recurring patterns and weaknesses, and recommend actions to mitigate losses. Automated alerts indicate when thresholds are about to be breached, allowing users to prevent loss incidents.
Scenario Modeling and Monte Carlo Simulation
The MetricStream ERM solution provides comprehensive information on incidents, risks, control self-assessments, and other relevant business metrics which are essential in establishing scenarios. The solution also enables Monte Carlo analyses, allowing decision-makers to examine the complete range of possible outcomes to their decisions, and assess the impact of risk. This, in turn, helps executives make informed decisions even in uncertain circumstances.
Risk-control Library
Information on enterprise-wide risks and controls are maintained in a centralized, Web-based repository. Equipped with an easy search capability, the repository enables users across the client’s organization to check if a specific control was tested, what the assessment results are, and if a remedial action plan is required.
Risk Monitoring
The MetricStream ERM solution contains powerful executive dashboards and heat maps with drill-down capabilities that offer real-time visibility into risk management processes, risk profiles, assessment plans and other important risk related data across the client’s enterprise. The solution provides tremendous flexibility to configure ad hoc risk reports in addition to preconfigured standard reposts. Quarterly and monthly trending analyses enable risk managers and process owners to stay in constant touch with the ground reality and progress on risk management programs. Automated alerts for events such as exceptions and failures eliminate any surprises and make the risk management process predictable.
Issue Management
The MetricStream ERM solution enables the client to adopt a systematic approach to identifying, investigating, and resolving issues arising from risk and control assessments, loss incidents, and scenario modeling. The solution captures relevant information about each issue, and routes it to various authorized users for in-depth investigation and remediation. The progress of each issue is automatically monitored, with alerts provided if deadlines are missed. Once a corrective action or remediation is initiated, the case remains open till the action plan is carried out, and results are verified for effectiveness.
Challenges:
-
Need for a Higher Risk Management Maturity: ISO 31000 has become one of the most important standards by which stakeholders and customers judge an organization’s proficiency in risk management. The client, who has already been accredited with multiple ISO standards, was eager to add ISO 31000 to the list. But complying with the ISO 31000 standards meant that the client had to strengthen its risk management maturity.
Limited Collaboration
The client’s business units managed their risk and control management initiatives in independent silos. There was little collaboration and information-sharing between them. The Internal Control Group and the ERM Group needed to better coordinate their efforts to avoid multiple redundancies and complexities in risk management, and to improve operational efficiency.
Insufficient Visibility into Risk Management
Decision-makers needed to gain top-level visibility into ERM processes and metrics to develop a clear business strategy, and to mitigate risks effectively. However, the client’s existing systems did not offer them this kind of visibility.
High Costs, Cumbersome Risk Management Processes
Most risk management processes were executed manually. Employees had to spend a lot of time and effort painstakingly entering and calculating data on large, unwieldy spreadsheets. The process was time-consuming and required a lot of manpower and costs that could have otherwise been more valuably utilized elsewhere in the organization.
Why MetricStream?
Integrative ERM Capabilities: The MetricStream ERM solution is built on a centralized, Web-based platform that scales across large organizations, integrating and harmonizing various risk management initiatives. Organizations are empowered to manage risks more efficiently and proactively, make informed strategic decisions, and improve business performance.
Simplicity of Use: Highly intuitive user interfaces and navigation features minimize the learning curve, and enable companies to adopt the MetricStream solution quickly. Users can easily monitor risks and controls, rapidly access contextual information, and intuitively visualize the relationships between processes, risks, controls, regulations and policies.
Innovative Features: The MetricStream solution provides a host of innovative capabilities such as powerful dashboards, heat maps, configurable forms, real-time exception tracking, reports, risk-control libraries, email alerts and notifications, business intelligence, analytics and secure access control - all built and deployed on the robust MetricStream GRC platform.
Market Leadership: MetricStream is widely regarded by leading analysts and industry experts as one of the market leaders in the GRC space. MetricStream solutions are widely deployed in leading manufacturing companies across the world.
Benefits
- Improved Standardization
Using the MetricStream ERM solution, the client streamlines and harmonizes multiple risk management processes across the enterprise. Redundancies are minimized, and risk management processes are standardized, and made more reliable and easy to manage.
- Increased collaboration and accountability
The MetricStream ERM solution breaks down organizational silos, and improves collaboration on various ERM processes, as well as decision-making. The solution also facilitates accountability by clearly defining and tracking roles and responsibilities for risk management.
- Integrated, Real-time View of Risks
The MetricStream ERM solution provides advanced risk heat maps, charts, dashboards, and trending analyses that strengthen transparency into risk and control management. They also enable the client to proactively identify and mitigate risks, control loss events and resolve issues in time. Decision makers can closely track the status of risk management, and ensure that it is progressing as planned.
- Increased Risk Protection
The MetricStream ERM solution fully maps process vulnerabilities, risks, and threats to critical assets, enabling enable decision-makers to quickly determine the potential impact of risk on each asset, and develop a suitable action plan. The solution also improves top-down coordination on risk management initiatives, helping the client address not only the individual risks facing the company, but also the interdependencies between these risks.
- Improved Risk Management Maturity for Compliance with ISO 31000 Standards
The MetricStream ERM solution enables the client to effectively comply with ISO 31000 standards through various capabilities such as enabling a structured and systematic approach to risk management; improving risk identification, analysis, evaluation and monitoring; and aligning risk management with decision-making.
- Greater efficiency, Reduced Costs
The MetricStream ERM solution automates multiple manual processes such as risk-control assessment, reporting, remediation, and audit trails. This saves the client valuable resources, manpower, time, and costs.
