4/20/2020 Understanding Enterprise Risk Management for Utilities © Copyright 2007, CCRO. All rights reserved. 3 1.1. Objective The objective of this paper is to provide an understanding of ERM and assist executives in developing and applying an ERM framework unique to the business of a regulated utility. This paper establishes a framework for assessing the collective risk of the company, and assuring accountability for the evaluation and mitigation of risk. Within this paper, a utility is defined as an entity that has some component of regulated revenues from an obligation to provide full service to some or all users in a pre-determined service territory using a specified portfolio of assets and related infrastructure. Due to the considerable information already published on ERM, this paper only touches on basic concepts and fundamentals related to an ERM program, pointing the reader to the more in-depth discussions in other papers. As a result, this paper focuses on particular issues that apply to a utility in the context of an ERM program and the unique challenges these companies face. The intent of this paper is to provide guidance to utilities that are implementing or improving ERM frameworks. Such frameworks are not prescriptive, one-size-fits-all endeavors. Rather an ERM framework must balance the utility’s risks, business and regulatory structures and current risk management practices and governances. The guidelines published herein are intended as objectives to strive toward only to the extent that is practical and useful in managing the individual utility’s risk. Further, the full implementation of an effective ERM framework may be iterative, with each iteration improving the framework. Therefore, each utility must consider where they are on the Risk Management Practices Continuum, shown in Figure 1.1. Figure 1.1: Risk Management Practices Continuum Many utilities may be tempted to strive for ‘industry best practice’, which is continually evolving at this point, in developing an ERM Framework, yet ‘industry best practice’ may not be the most effective risk management framework for an individual utility. Instead, the utility must aspire to implement those practices that best manage the risks the utility faces. Figure 1.1 demonstrates that utilities should be cognizant of the difference between their current, actual practice versus what is appropriate for their business, size, and risk portfolio. A best practice component of risk management may be marginally, if at all, improving risk management practices from the appropriate practice level. Insufficient Best Practice Appropriate Practice Actual Practice Practice Gap Performance Gap