Guest Post by James Kline (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

The National Institute of Standards and Technology (NIST) just issued the 2017-2018 Baldrige Excellence Frame Work.  There were modifications to a number of categories such as Category 1 Leadership, Category 2, Strategy and Category 6 Operations.  Included in the modifications were substantive additions for Cyber Attacks and Enterprise Risk Management (ERM).

In the discussion of the changes from the 2015- 2016 framework it is noted: “The future competitive advantage that will flow from good ERM is based on the holistic addressing of risk and the actions taken – including the pursuit of intelligent risks – as part of an overall strategic approach to managing organization performance.” (Baldrige.2017.45)

This statement makes two things clear.  First, ERM is seen as contributing to the competitive advantage for any organization.  Second, ERM is a holistic approach.  The inclusion of ERM in the Baldrige Excellence Frame Work does two other things.  It reinforces the momentum created by the inclusion of Risk Based Thinking in ISO 9001:2015 and the issuance by OMB of Circular A-123.   Both actions expanded the reach and ultimately the interest in ERM.  In addition, it signals that ERM is considered part of best practice. This means its use increasingly will become a standard by which all organizations can be evaluated by regulators and stakeholders. [Read more…]

Guest Post by Geary Sikich (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

We live in a world of consequences.  Everything that we experience is a consequence of some action, decision, reaction and/or choice.  For organizations, the consequences of a choice, action, decision and/or reaction can cascade throughout the organization and extend to its “Value Chain” rippling through all the known touchpoints and the as yet, unidentified touchpoints.

Organizations need to understand their strategic, operational and tactical capabilities and capacity to recognize, mitigate and/or capitalize on cascade effects.  As a result of the diverse nature of global business operations, geopolitical circumstances, culture, etc., there currently is a standardization gap with regard to how organizations should react to cascade effects.  This is partly due to opacity, nonlinearity and insufficient competitive/business intelligence that organizations can draw from.  This is not to say that the information does not exist.  Rather that it does not exist in a form that is readily recognizable to organizations in most cases. [Read more…]