A Free Open Source Portfolio Mgt System

A Free Auditing and ERM System

RiskWaves ERM by RCA LLC

Why ERM?
ERM provides the requisite resiliency for long term survival, and a strategic framework for short term success
The concept of Risk Appetite is the best starting point for understanding the value of ERM. Most of us assume we are equipped with the common sense to know when we are over-extended, and would avoid taking risks that have the potential to eliminate our entire net worth. However, as this article about the psychology of spending points out, this assumption is far from valid. We act in our best interests when we are aware of the drivers underlying our individual risk-reward trade-offs. This phenomenon is amplified in an organization where many individuals act under the assumption that they are optimizing organizational interests. Where one manager might jump at the opportunity to acquire a new business based on a deep discount to market value under the assumption that the savings to the organization are too good to pass by, another manager might decide exercising a real option to wait is the optimal decision, and still another manager might decide ignoring the decision is the safest strategy. In each of these examples, the manager's decision reflects their own understanding of the organizations interests, as well as their individual appetite for risk which can be influenced by past experience, career goals, and their own understanding of the organization's strategic objectives. The point here is simply that if an organization cannot articulate Risk Appetite, how then can managers truly understand what comprises an optimal decision. In reality, many organizations cannot articulate what would happen to their value as an entity if the sum of all their top risks were simultaneously manifested in a "black swan" event. Nonetheless, nearly all organizations purchase insurance, comply with laws and pursue investments. In many cases, though, serious consideration is not given to ERM until it is too late; often accompanying a change in ownership or leadership. There is inherent value in understanding how much stress your organization can absorb at one time (capacity), whether related to risks or prospects, and factoring risk capacity in the strategic planning process to balance objectives and appetite for risk. If this value was derived merely from adequate insurance programs, though, it would not result in the approximately 9% premium on stock prices for companies practicing ERM. The value is derived from the impact of the ERM process on the way an organization makes decisions, not just regarding the protection of asset values, but in its pursuit of objectives ranging from the nebulous (e.g., optimal balancing of profits and goodwill) to the prosaic (e.g., identifying and pursuing growth opportunities). In this process, a company's posture shifts from merely preparing for the worst scenario to being ready for, even shaping, the best scenario. While the premium for business's with ERM is debatable, the fate of organizations that have no ERM or a poorly implemented ERM program is not - and is demonstrated time and time again through large fines, losses, and high-profile failures. There is even more value, we posit, in pursuing ERM with an emphasis on financial performance as commented below.
Why RiskWaves? RiskWaves makes it easy and affordable to implement a standards based Enterprise Risk Management and Internal Audit Process 

RiskWaves is a best practice solution designed to help organizations implement or upgrade their risk management program. RiskWaves supports multiple users in a locally hosted or distributed (cloud) database environment, and can also be deployed as a desktop solution. RiskWaves is free making it a cost-friendly platform for an integrated risk management process. Migrating RiskWaves to Azure Remote-App will carry Microsoft's costs for deployment. RiskWaves supports you from organization through strategy with user friendly interfaces, workflow features, in-line help, and analysis tools. RiskWaves also provides the alerts, heatmaps, reports, and pivot tables necessary to communicate results, manage your risk profile and keep things moving forward.


Organize: Begin by replicating your risk ecosystem starting with your system users, organizational hierarchy, time periods, business functions and processes, geographic elements, controls, and responsible parties. This information lays the foundation for recording and assigning risks, specifying exposure details, and linking risks to objectives and other contextual elements. You also have the option of replicating your value chain which expands the value of your risk data. Risk data can be linked to key events in and around your organization to distinguish between rights and obligations, opportunities and threats, or your own categories. The enhanced level of context in RiskWaves empowers you to monitor the evolution of risks from a strategic perspective, and shape the future of your organization to optimize your risk profile and prospects based on your appetite.

Integrate: Speaking of appetite, RiskWaves provides helpful tools and reporting to integrate your policy and process. For example, you can apply preconfigured alerts based on your appetite, total residual risk and active residual risk levels, as well as treatment costs, and RiskWaves will alert you when these indicators exceed your threshold. You can configure custom alerts based on other metrics as well. The RiskWaves dashboard  provides a recap of total exposure, treatment impacts, residual risks and treatment costs by treatment status and can be filtered (like all reporting) for any subset of entities and time periods you wish. RiskWaves features a variety of additional features to aid in integration. For example, RiskWaves calendar allows you to schedule and email tasks to users, and reports can be emailed from within the system. RiskWaves lets you determine who is authorized to move treatments forward for additional control.

Analyze: Whether you are dealing with qualitative risks, quantitative risks, or hybrid risks, you will quickly appreciate the speed with which you can move from identifying and defining risks to analyzing and evaluating then. RiskWaves captures your quantitative risk criteria as well as qualitative guidance to facilitate delegation. In RiskWaves, you can quickly establish criteria for likelihood and consequence, and analyze your risk based on specific confidence levels and probability distributions for each in the same step. Probability estimates include Poisson, binomial, uniform, normal, and exponential, plus custom user defined formulas. During treatment, you can target low and/or high end risks at the consequence or total level. Your analysis can target the likelihood risk level simply by swapping the likelihood and consequence in your analysis. The Analysis and Treatment also feature a currency converter for handling foreign quantitative risks.

Optimize: RiskWaves Treatments let you accept, avoid, reduce or transfer risks. You can document your specific treatment strategies, including contingency plans with optional detailed project plans for qualitative strategies, and apply quantitative treatments where applicable including options, futures, swaps, surety, indemnification, short and long positions, and initiatives to reduce exposure. RiskWaves will automatically calculate the impact of your treatment and residual risk levels. Multiple treatments can target the same risk too. And for hedges, RiskWaves will even provide you with an estimated cost.
RiskWaves includes three levels of simulation for optimizing your treatment strategy. Our recommended approach is as follows:

  • Simulate each quantitative Treatment using the 'Accept' Treatment Type.
  • Assign simulation records to the appropriate RiskGroup with applicable beta factors (normally -1 or +1).
  • Simulate the RiskGroups based on desired confidence levels.
  • Then run a Summary Simulation which covers all the Risk Groups.
  • Your simulations will automatically reflect the subset of reporting periods and entity sets you select on the Main Menu.
  • Simulations can have up to 2,000 turns, and take only seconds to run in the cloud.
  • Download your Summary simulation to your own economic model for calculating economic capital and VAR, or use our VAR estimate.
  • Download RiskGroup simulations to the Risk Group Simulation Cube for analysis.
  • Start recording Treatments and perform the above steps with your Treatments to analyze Treatment Impact and Remaining Risk.

You can demo this functionality in our Trial version of RiskWaves. Residual risks can be pooled at the exposure level to take advantage of natural hedges. While treatment periods unfold, recording the actual treatment results in the follow up module lets you analyze financial performance by treatment, event class, counterparty, and treatment umbrella.

Grow: RiskWaves was designed with your success in mind. Leverage RiskWaves to reduce time allocated to rote activities and focus more on building resiliency into your strategic plans, and positioning your organization for greener pastures. RiskWaves is unique in its approach towards risk management in that it emphasizes results and strategic significance. Treatments data is converted into financial statements, including entity level before and after risk level views to help you assess adherence to appetite, and potential payoffs. RiskWaves includes numerous results based reports to ensure your transactional relationships are value added. The strategic context captured within the risk management process positions you to consult with your management team regarding risk concentrations and opportunities for growth. The ease with which you can process risks in the system, and the throughput gains resulting from the efficiencies provided by RiskWaves, will likely result in a more robust risk management strategy. back

RiskWaves is your Easy, Mobile, Flexible, Powerful, Cost Effective ERM solution
Easy - RiskWaves consists of modules aligned with standard risk management methodologies in an intuitive user interface that allows you to speedily enter critical information to process risks. We made extensive use of navigation, help text, validation, automation and integrated tables to develop an efficient, friendly user experience. Beginning with Objectives, you will notice that you can move your risks from one module to the next with one click on the menu, and RiskWaves checks for completeness along the way. From the main menu RiskWaves allows users to directly access or print specific records in any core module.

Flexible - RiskWaves includes a variety of user defined reference data to help you replicate your specific operating environment. For example, you can create separate organizational units and define each unit's type, level, and parent unit. Planning periods are also user defined. RiskWaves includes a variety of reports for reporting risk management activity and open items, and you can create custom reporting groups for specific sets of entities and planning periods. Each report can be downloaded in Excel or PDF format, emailed and printed from within the report. In addition to the data you would expect to see in a risk management system, we have prepositioned additional fields that can we can customize remotely based on your specific needs without touching existing data.

Powerful - RiskWaves doesn't force you to be a numbers person. You can enter your own exposure estimates for risks when applicable, or you can leverage built in statistical functions to calculate more precise estimates for likelihood and consequence to arrive at more specific estimates, applying confidence levels when desirable. You can copy data directly from spreadsheets directly into risk waves and use it for predicting events and or consequences if you wish. RiskWaves applies the same approach to risk management strategies which can be simple action plans, or more advanced financial mitigations. Each treatment allows you to describe the treatment, and if necessary, create detailed project plans. After Action Reviews allow you to record actual outcomes and capture key learnings which can later be searched and applied to future mitigations, or to shape risk management policy.

Cost Effective - Costs associated with managing risks include costs for treatments as well as the cost of managing the process. RiskWaves provides you with important metrics for modeling and evaluating mitigations including ROI. Standard reporting includes potential and actual ROI measures based on mitigation type and counterparty to enable effectiveness comparisons. Exposures to inversely correlated risks can also be pooled together before and after treatment to allow you to evaluate to what extent your risks offset each other. Also, RiskWaves saves you time and money by reducing the manual tasks often characteristic of producing reports, preparing analysis, and answering questions. For example, you can leverage RiskWaves to store, update, and report on your risk universe, and download risk and treatment data to a spreadsheet to quickly create custom analysis when required. Standard reporting also prepares Risk Profiles which allow you to view all exposures to risk by specific Risk Source.

In summary, RiskWaves has the power to support a rigorous, data focused process, and the flexibility to accommodate a more subjective approach. You can begin using it today at no cost and we will support you any way we can. RiskWaves can be implemented as a desktop solution, or a shared solution (we can help with that as well). RiskWaves is a useful tool for piloting a program, implementing a program, and as a training tool.  back