4/20/2020 Understanding Enterprise Risk Management for Utilities © Copyright 2007, CCRO. All rights reserved. 13 adequacy4 which presents several methodologies to aggregate an enterprise view of risk. The four-categories for risk underlie this capital adequacy framework. To take advantage of this methodology then, a company needs to adopt these four best practice categories for risks. Supports a Scalable Framework for Risk Another advantage from these risk categorizations is that the framework for risk analysis becomes entirely scalable. Scalable means that the language, metrics, assessments, and modeling approaches are much the same regardless whether studying the entire enterprise or a single project/deal. The impact of risk on a project can evaluated and explained using the same framework as the risk analyses supporting the overall corporate business plan. Similar metrics and approaches are used regardless whether the audience is the board of directors, risk committee, or business unit. Consequently, the cost-effectiveness of models and the communication of risk management insights are much improved. Obviously, scalability is a big advantage for the risk function that seeks to have impact at many levels and create value for the firm. Helps with deployment of emerging practices for risk management As the CCRO continues its on-going work uncovering, developing, and publishing best and emerging practices for all aspects of risk management, the four-bucket categorization system is underlying. Utilities and other firms that wish to advance their risk management capabilities are always striving to achieve best practices. Therefore, to put itself in a good position to be able to take advantage of new practices as they emerge, the utility is advised to widely adopt these best practice risk categories. Whether concerning organizational, control design, risk metric, or reporting issues, these categorizations are an important foundation supporting compliance with best practices now and in the future. The “Glue” for an enterprise risk management program The desirable characteristics of an enterprise risk management (ERM) program that is based on these risk categorizations has also furthered their adoption as best practice across the industry. 4 See CCRO Papers “Emerging Practices for Capital Adequacy” and Capital Adequacy Extension.