SymEx 2015 - Turning Risks Into Results, A Wider Perspective to Understand Project Risk Comprehensively

- 23 Years working with EY, now leader for RISK Advisory Group
- Projects mostly in Government &Public Sectors, Infrastructure and
Transportation, Banking and Insurance, performing IT Strategy, IT
governance, risk, control and compliance, IT security, Information Systems
Design and Implementation, and also Corporate Governance, Risk
Management and Internal Audit
- Graduated from University of Indonesia, mastering in Accounting with
concentration in Strategy & Finance
- Social activist and music enthusiast
insert photo  Partner & Managing Director – EY
 President – ISACA Indonesia Chapter
 Certification: CISA, CIA, CGEIT, CISM
 Others: CompTIA Project Management,
ISO/ISMS 27001

“companies with
more mature risk
management
practices outperform
their peers
financially.”

• The top-performing companies (from a risk maturity
perspective) implemented on average twice as many of the
key risk capabilities as those in the lowest-performing
group.
• Companies in the top 20% of risk maturity generated three
times the level of EBITDA as those in the bottom 20%.
• Financial performance is highly correlated with the level of
integration and coordination across risk, control and
compliance functions.
• Effectively harnessing technology to support risk
management is the greatest weakness or opportunity for
most organizations.

“ When it comes to
strategy development
and execution, it’s
important for risk to
enable business
performance — not
simply protect the
business.”

These components
are critical to
transforming risk and
driving better
business
performance”

Enhance risk strategy
 Organizations conduct two-way, open communications
about risk with external stakeholders.
 Communication is transparent and timely, providing
stakeholders with the relevant information that conveys the
decisions and values of the organization.
 The board or management committee plays a leading role in
defining risk management objectives.
 A common risk framework has been adopted and
implemented across the organization.

Embed risk management
 There is a formal method for defining acceptable levels of
risk within the organization.
 Stress tests are used to validate risk tolerances.
 Leadership has put in place an effective risk management
program.
 Planning and risk reporting cycles are coordinated so that
current information about risk issues is incorporated into
business planning.

Optimize risk management functions
 Completion of risk-related training is incorporated into
individual performance.
 Risk monitoring and reporting tools are standardized across
the organization.
 Integrated technology enables the organization to manage
risk and eliminates or prevents redundancy and lack of
coverage.
 The reporting system notifies all stakeholders affected by a
risk, not just those in the function or area where the risk
was identified.

Improve controls and processes
 Lines of business have established key risk indicators (KRIs)
that predict and model risk assessment.
 Self-assessment and other reporting tools are standardized
across the business.
 Controls have been optimized to improve effectiveness,
reduce costs and support increased business performance.
 Key risk and control metrics have been established and
updated to address impacts on the business.

Communicate risk coverage
 Organizations talk about their risk management and control
framework in their annual report.
 Organizations provide assurance to their customers and
other stakeholders using independent reports (e.g., SOCR).
Enable risk management
 Issue tracking, monitoring and reporting are regularly
performed using GRC software.
 Risk identification and assessment are regularly performed
using GRC software.

• Effective risk management starts at the top with effective strategy and governance.
• Embed risk management practices into business planning and performance
management are more likely to achieve strategic and operational objectives.
• Align and coordinate risk activities across all risk and compliance functions,
organizations can reduce their risk burden (overlap and redundancy), lower their total
costs, expand coverage and drive efficiency.
• Optimize controls around key business processes, harnessing automated versus manual
controls and continuously monitoring critical controls and KPIs, organizations can
improve performance and reduce the cost of controls spend.
• Communicate openly and often with all stakeholders, provide third-party assurance
and leverage technology for maximum benefit.
• Embed risk as the fourth dimension of business has the potential to fundamentally
transform how organizations connect risk to reward.

Note: Illustration copied from
http://www.mosaicprojects.com.au

SymEx 2015 - Turning Risks Into Results, A Wider Perspective to Understand Project Risk Comprehensively

More Related Content

What's hot (20)

Viewers also liked (14)

Similar to SymEx 2015 - Turning Risks Into Results, A Wider Perspective to Understand Project Risk Comprehensively (20)

More from PMI Indonesia Chapter (7)

Recently uploaded (20)

SymEx 2015 - Turning Risks Into Results, A Wider Perspective to Understand Project Risk Comprehensively