 Hello, and welcome to the session in which we will discuss the enterprise risk management system. This is part two of five. And the reason I have to clarify this, because I already covered governance culture, which is one of the components of ERM. And within that component, we had five principles in this session, specifically, I'm going to be focusing on strategy and objective settings. And we're going to have four principles. Now, although I am covering each component separately, because we have five components for ERM, and in total of 20 principles, all these components and principles are interrelated. So just want to make sure you're aware of this. So if you did not watch one of five, I strongly, you do, you do so. In other words, if you're not familiar with governance and culture, you do so. Now this topic is covered in the CPA on the CPA exam, BEC section, as well as the CMA exam and in your accounting information system. So whether if any of these applies to you, especially if you're a CPA or a CMA candidate, I strongly suggest you take a look at my website, farhatlectures.com. I don't replace your CPA review course. I can do so. I wish I can, but I can't. But I can be a useful addition to your CPA review course or to your CMA. I can add 10 to 15 points to your score by explaining the material differently. You might need that alternative explanation. You might need that backup explanation. I can do that. Your risk is one month of subscription. Your potential gain is passing your certification, passing the exam. And if not for anything, take a look at my website to find out how well is your university doing for the CPA exam. I do have resources for other accounting, finance, CPA, CMA sections. Please connect with me on LinkedIn and take a look at my LinkedIn recommendations. Like this recording, share it, connect with me on Instagram and Facebook. So let's go ahead and get started. Once again, I'm going to go over the definition of ERM. It's the cultural capabilities and practices integrated with strategy, setting, and performance. I'm going to stop here. And the reason I'm going to stop here is because in the prior session, the reason I'm going to stop here. In the prior session, we basically looked at the culture, capabilities, and practices. In this session, I'm going to be looking at integrated with strategies, strategy, setting. Okay. And the reason I said this, because when I first, when the first time I looked at this definition, I told you this definition, it's going to be, it's going to take you an hour, an hour and a half of lecture to go over it. So this is the definition that we went over this part in the prior session in corporate governance. In this session, we're going to be looking at integrated strategy and objective setting. In the next session, we'll deal with the performance. And that's going to be the most extensive one. And obviously, you know, how to manage your risk in creating, preserving and realizing value. And those two, we'll cover them at the end. I may even combine them together. We'll see how it goes. So this is basically what we are looking at here. So let's go ahead and start to talk about strategy and objective setting. So the four principles in this session are analyze business contacts, define risk appetite, evaluate alternative strategies, and formulate business objectives. So all of those will be under the strategy and objective setting. And this umbrella, the whole umbrella we are dealing with is E, R, M. So it's good to keep that in mind, to keep that in mind. Before we proceed any further, I just want to talk about the core values, not talk about them. Just remind you that those were in the prior session, those core values were part of culture and governance. And specifically, we spoke about the core values, mission and statement. And the reason I'm mentioning this is because in this session, we're going to be talking about strategies. How do we, how do we create strategy? Well, to create a strategy, you have to have those missions, visions, and core values. And your strategy must support whatever you believe in. In the session, in the prior session, we spoke about Johnson & Johnson as a sample company. Well, that's great. We do have core values. We do have missions. Now our strategy obviously should support those mission. So we're going to integrate the enterprise risk management system with strategies to understand our risk profile and how we're going to be relating strategies and business objective to our vision, to what we do. So the first thing we're going to have to do is to understand what is a business context. They simply put every business function in a certain environment. It could be a risky environment, not so risky, stable environment, not so stable. What are, what could be some business context? Those are events, relationship trends and other factor that influence your organizational strategy and business objective, depending what business you are in, at what time you are operating, in which economic environment. That's going to determine how you're on your company, how you're on your strategy. Now, there are many factors that could influence the organization strategy and business objective. Some of these factors are internal and some are external. Let's discuss each one of them just to kind of give you an idea. What are we talking about here? How do we analyze the business within a specific context? Internal. For example, what capital do you have? Capital means what type of assets do you have? How much cash do you have on hand? If you have a lot of cash versus not a lot of cash, is your company liquid or not liquid? What type of property, plant and equipment you have? What type of intangible asset? That's going to determine what type of strategy you are going to undertake. And it's going to determine what type of risk you are going to accept based on your capital, based on your resources. Your capital are your resources. Also, part of kind of interrelated capital, basically people were going to treat them separately, but think of them the same. Your people are your capital. What type of knowledge you have? Skills? What type of a culture you have within your company? What type of values do you have? That's going to determine or that's going to align your strategies with your mission, with your core values. So you have to keep that in mind. Those are internal environment. For example, if you have people at your company that are rigid, that they don't think outside the box, well, you cannot be, you cannot be, you cannot consider yourself an innovative company. And even if you do, you are going to fail. So on the other hand, if the people that you employ are open-minded, they think outside the box, they're visionary, then your strategy will have to accommodate this. So those are internal factors. Processes. What type of processes do you have? Processes are activities, tasks, a change in management. What if each company will have a different processes and that will determine, that will help align the company toward a particular strategy? Technology. What type of a technology are you using? Is it new? Is it old? Is it average technology? Also, we have external factors that's going to influence your strategy. It's going to influence what type of business objective you are going to have. It's going to influence your mission statement. For example, there are political factors. Like, for example, when Trump is president versus Biden, well, the tax policies, it's going to influence how you operate. For example, if the tax policies for a certain administration don't favor you operating in the U.S., you might want to move to China. You want to move to Mexico to operate depending on that political environment. And that political environment is external environment. It has nothing to do with you, but you have to kind of comply with that political environment. Economic environment. That's a big one. Interest rate, inflation is of obtaining credit. For example, if interest rate is low and we have practically no inflation and we have a lot of credit, what companies do they borrow money to expand? So it's an expansion time. So your strategy, if you said, well, I'm going to set a strategy to expand my business, this makes perfect sense because the economic environment, the external environment will support that decision. Also, there are social factors, external factors. For example, customer preference. If the customer is now on Instagram or Facebook or Twitter, well, guess what? Then you have to align your strategy for that social media. Demographics, for example, in the area in which you are operating, people are young. Then if your strategy is not to serve those people, then it's going to be an effective strategy versus if you are operating in an area where mostly are retirees. For example, if you're operating in Florida, well, your business strategy will be different because the average age is much higher. A technology. What are the changes in artificial intelligence, big data, R&D? That's also going to influence how you're going to set up your strategies and business objective. Legal external environment laws, regulation, industry regulation, that's going to affect your company greatly, especially if you are in a company that are heavily regulated like oil, banking, insurance, so on and so forth. Environmental factors, climate change, natural catastrophe that could affect your business. So you have to take these internal environment, external environment in order to understand in what type of business environment you are dealing with. And that's going to influence what type of strategy and business objective you are creating for your business. A few more type of business contacts that we can think of. Your business contacts could be complex, could be unpredictable, could be dynamic. And we're going to have to define each one of them real quick. Dynamic is, for example, you might be in an industry where there's low barriers of entry. It means anybody can start a business. What does that mean? It means changing risks can appear anytime. I'll give you an example you may or may not agree with it. For example, think of Uber. Uber, I believe it's a dynamic industry because practically anyone who can create app servers, they can start a business like this. You may disagree with this, but it has a low barrier of entry. As a result, changing risks can appear anytime who are considered dynamic. Or you might be operating in a complex environment. Well, here you have many interdependencies and interconnection. For example, if you are a company like Coca-Cola or PepsiCo to be more specific, you are operating in many different countries. You are operating across the world. And a company like PepsiCo, they're in so many different businesses. So the risk here, you have unique external environmental factors, and they're going to affect your business differently because you're in so many businesses. So your business is considered complex. Or it could be your business is unpredictable, changes occur rapidly and anticipated. And here we are dealing with technology companies or pharmaceutical companies for that matter. But technology companies will be better. I mean, well, you might consider Uber technology company and predictable means it can change very quickly. And your product could become obsolete because of new technology. Yes, daddy? Real quick. Nothing. Okay, let me finish this. I just want to sit in your lap. Okay, good. I have more, okay? I have more. I'm just going to sit with you. Okay, okay. You can sit with me. Okay. The next thing we want to do is define the risk appetite. This is two of four. I mean, I failed to mention that we are dealing again. I don't want you to ignore the big picture. We are dealing with the second level of enterprise risk management. Let me just kind of go back up here, strategy and objective. We are done with analyzing business contacts. Now we're going to be dealing with the fine risk appetite, which is two of four. So when you see this two of four, so you understand, I don't want you to lose track of what we are doing. So in this context, we have to define risk appetite. What is first of all, what is risk? What is risk? Risk is the possibility that an event will occur and affect the achievement of the strategies and the business objective. It will occur basically negatively. It will affect it negatively. This is what a risk is. So something will happen and it will be real what you are thinking about. Now, different risks occur for different companies. For example, a restaurant company, the risk is way different than an airline company, way different than a beachfront property. Each one of them will have a different risk. For example, the restaurant, they are concerned about food safety. Airline companies are concerned about airplane safety or maybe a credit if they need to borrow money to survive. A beachfront property, they're worrying about maybe a hurricane happening and the beachfront property will be destroyed. So risk and all these factors will affect their business objective. It will not allow them to get to their business objective or reach their strategy. So what is risk appetite? What's the risk appetite? How much risk you are willing to take or accept? Different companies, as we spoke about in the prior session, different companies will have different risk appetites. Some companies are risk averse. They will try to avoid risk at any cost. In some companies, they embrace risk. They don't care about risk because they believe with risk comes return and they're willing to take on more risk. So the risk should be considered within the context of their mission, vision, culture, prior strategy and risk capacity. So everything we're going to be talking about in this session is it has to be within their mission, vision and culture and core values. So it has to be less than their risk capacity. Risk capacity is the maximum amount of risk you can take on. And risk can be expressed in many different ways for a company. For example, it can be qualitatively. For example, they can define risk as low, medium or high or it can be defined quantitatively with some numbers. For example, we will accept percentage of sales. For example, bad debt as 10% of sales or 5% of sales or bad loans, 3% of the total loans. Or we can define this as a standard deviation or we can define it as beta if we are a finance company. So you can define risk in so many, so many different ways. Just terminology, what's risk inventory? Every company should have a risk inventory. And what's risk inventory? You have to identify all the risks that could affect your business and its strategies. Those risks may or may not happen, but you need to be aware of them, inventory them, make sure you're aware of them. Because at some point of the environment changes, of the economic macro environment changes, they may become more probable or less probable, you want to be aware of them. There's something called inherent risk. This is the risk that exists in the absence of management action to curtail this risk. So this risk is present regardless of management action. They exist. Now what can we do? We can mitigate this risk. Once we mitigate this risk, if we take inherent risk, inherent risk, and we mitigate that risk, what's left is the residual risk, residual risk. So we always try to mitigate the inherent risk to come down to the residual risk. It's the risk that remains after management action to alter, not to later, to alter its severity, to reduce that risk. Obviously we want residual risk of zero, but that's not really possible because we live in the real world. So make sure you are aware of what's actual residual risk. It's inherent risk minus some mitigation. The company buys insurance, moves to another state if there's any risk in that particular state. Whatever the risk is, you mitigate that risk. And bear in mind, just want to make sure we're keeping the big picture in mind, the board of directors approved risk appetite and communicate this throughout the organization. So remember the board's on the top and it's going to communicate this information. This how much risk are we willing to take? Because you don't want to have a rogue manager or a rogue head of an apartment taking on a lot of risk. Another thing we want to do is we want to evaluate alternative strategies. That's part of ERM, part of our ERM, part of our strategy and objective. Because we may undertake strategy, but it may not be the only one or it may not be the optimal one. Therefore we want to look at alternative strategies. Although we're looking at alternative strategies, that's fine. We want to keep in mind our risk profile and we want to keep in mind that we have mission, vision, core values that must be aligned. Although those are alternative strategies, alternative like I'm an alternative to your CPA review course. Yes, they are alternative, but they still have to be aligned with your mission, vision and core values. They cannot violate those. How do we create alternative strategies? Well, hopefully you are familiar with this scenario analysis. We could do what happened if sales increases by a certain percentage or decrease by a certain percentage. What happened if we go through a recession? What happened if GDP contracted? What happened if GDP expanded? Well, those are scenario analysis. We could do SWAT analysis. We could look at our strength, weaknesses, opportunities and threat. Look at our opportunities, look at our threats and create strategies, alternative strategies if they materialize. Whether an opportunity materializes or threat materialize. We could look at competitors and analyze what they're doing and try to create alternative strategies in case they take different route. So this is how we evaluate alternative strategies and strategies should be changed. So we should not accept any strategies if it fails to create, realize or preserve value. Now you want to know what does create, preserve and realize value is. What is create value? When do you create value of the company? Well, you create value when the benefit is greater than the cost. You undertake an action and the benefit of that action is greater than the cost. How do we quantify this? Usually you can quantify this in NPV, net present value. Look at your net present value if it's positive. We assume we are creating value or as long as revenue is more than expenses. We can measure this through an income statement. What does realize is how do we realize value? We realize value when we cash out like a realized transaction. When actually when we transfer the benefit to the shareholder or to the company in retained earning, which eventually goes to the shareholder when we cash out. This is when we realize the value. And how do we preserve the value of the company? Well, we want to undertake any activities that sustain the company resources, sustain their assets. Don't let them erode. Don't let them go down like maintenance, R&D, creating new intangible asset and value eroded, which is it's not here. When does value eroded occur? When management don't produce or create value. So if you undertake a project and the costs are greater than the benefit, what you did is you eroded the value of the company in a sense that you are losing resources. You have less resources now as a result of undertaking this transaction. The key is to increase your assets, to increase your resources in terms of cash by undertaking activities. So this is what we mean by evaluating alternative strategies. Now also you want to formulate business objective and this is four of four, the principle four of four in this session that has to do with strategies and objective setting. So you have to have objective, business objective. Again, all your business objective has to be within your risk appetite, core values, mission statement, and vision. I mean, I know I mentioned this, but a lot of CPA questions, they throw the statement and you want to make sure your business objective, your strategies, your alternative, your alternative strategies are they all align with those concept. Okay. And you could have four type of business objectives. You could have strategic objective and here you are looking at the big picture. And this is usually expressed in the mission statement. It tells you what's the direction of the company. For example, one strategic objective is to, for example, conquer new market every two years. Just a big picture. This is a strategic objective. Okay. You might have operational objectives. Operational objectives are day-to-day operation, how to effectively use your resources. And we could have hundreds of examples of this. For example, one objective will be to reduce employee turnover. How would you reduce employee turnover? What steps you will take to do so well? You will train your employees, you will compensate them well. You support them. You have life, life for balance, so on and so forth. But again, and you could have so many operational objectives and ways to achieve those operational objectives. Also, you want to have reporting objectives. Those reporting objectives deal with financial reporting, whether it's internal or external. You want to make sure that your financial report, whether internally or externally, they are reliable, accurate objective. Now, how would you make sure that's the case? Well, you will have good accounting department. You'll have good internal control. You will make sure you have checks and balances. You'll bring an external auditor, so on and so forth. So you have so many different steps to do so. Compliance. Obviously, you want to have compliance as a business objective. You want to make sure we are complying with the law in the area we are operating with any regulation in our industry. You want to make sure your employees are complying with company policies and procedure. How would you do that? You will train the employees. You will remind them about, look, we have certain laws, procedures and company policies you have to be in compliance with. In compliance with it. If someone violate them, well, you don't reward them. You will either fire them or you discipline them and you make sure everyone is aware of this. This way you want to achieve your business objective, which is compliance business objective. Again, all these objectives should be specific. Now, I gave you, you know, examples, for example, conquer new market. That's a specific, but it has to be measurable. For example, how big should be the market? Is it a million dollar market, two million dollar market, five, 10, so on and so forth. It has to be observable. I can see it. We can touch it in a sense that we can measure it. We can measure it and observe it and we can obtain it. If it's not obtainable, well, business objective are useless. Actually, they're demoralizing if they are. Same thing with reducing employee turnover. Well, this is a key. Employee turnover. For example, if the employee turnover per year was 15% or 20%, we want to reduce it down to 10%. This is measurable. Can I see it? Is it obtainable? Can I reach that? If not, I should not, I should not, you know, I should not put pressure on HR. Maybe we want to bring it down to 15% or whatever that number is. This is what we mean by business objective should be specific, measurable, observable, and obtainable. Now, what I did in the session, we went over strategic and objective setting, which is part of ERM. So we are done with one. We are done with two. In the next session, we would look at three, which is performance. And here, again, we're going to be dealing just explaining this term in this definition of ERM is defined as cultural capability. A cultural capabilities, practices integrated with strategy setting. We're done with all of those and performance and performance that or get their organization rely on to manage risk. And we'll talk about managing risk, obviously, in this in the performance session. Okay. So the next session, I would say it's a major one. It's a big one. Again, at the end of this recording, I would like to remind you whether you are an accounting students or a CPA candidate, especially if you are a CPA candidate, I strongly suggest you visit my website. I don't replace your CPA review course. I don't, but I can be a useful alternative. I can give you additional explanation, additional resources, multiple choice through false. That's going to help you pass the exam. Good luck. Study hard and stay safe.