Author(s)

M. D. Abkowitz & J. S. Camp

Abstract

Establishing the current status and future direction of an organization’s enterprise risk management (ERM) practice demands an ability to benchmark the existing level of performance and prioritize where risk mitigation actions are warranted. This requires a systematic and holistic approach that can identify and assess every \“reasonably foreseeable risk”, compare risks on a common basis for prioritization of \“hot spots”, and evaluate the effectiveness of candidate risk mitigation strategies. Designing and implementing a management tool that organizations can utilize for this purpose is challenging, given that it must be comprehensive in nature, yet easy to apply. This paper describes the development of such a tool and its subsequent application to a large marine transportation carrier. In this application, two separate ERM activities were undertaken; one focusing on a functional line of operations throughout the entire organization (information technology and cyber security), and the other involving all activities associated with a specific geographical region that serves as an operations hub. The resulting risk scenarios, assessments and candidate mitigation strategy evaluations are described and discussed. The paper also shares several lessons learned that are important for organizations interested in developing and applying ERM tools. These include how to overcome the challenges of: (1) structuring a framework for identifying enterprise risks and creating corresponding scenarios that are all inclusive, (2) creating an appropriate system for associating the likelihoods and consequences with various risk scenarios, and (3) developing a protocol to enable evaluation of the benefits and costs of potential risk mitigation strategies that are developed in response to those risks that have been deemed to warrant

Keywords

enterprise risk management, marine transport, cyber information security, risk identification, scenario analysis, risk mitigation, risk assessment, hazard analysis, disaster management