4/20/2020 Understanding Enterprise Risk Management for Utilities © Copyright 2007, CCRO. All rights reserved. 28 be utilized in scenario planning, scenarios typically go further in developing outcomes. For example, a typical scenario for a utility may involve a sustained service loss over an extended period. The financial impact would certainly be tested, but the analysis would go further in evaluating the sufficiency of recovery resources, the potential for reputational damage, regulatory backlash, additional reporting requirements, etc. Consequently, unlike stress tests, the results are not expected to be strictly quantitative. The results must include a narrative to explain the anticipated outcomes, the likelihood of the risk events, any other potential outcomes not explored, and the conclusions drawn from the exercise. A complaint that is sometimes heard about scenario planning is that the scenarios tested are not “realistic.” “Realism” is of course a qualitative assessment, but that said, risk managers should not feel limited to drawing up scenarios that are “realistic.” Very often, the most insight into risks may come from “unrealistic” scenarios. Furthermore, many of the critical risk events that we have seen occur at various companies might well have been considered “unrealistic” by management prior to their occurrence. The critical benefit of scenario planning is to force management to think “outside the box” about the risk environment. “Unrealistic” scenarios force reviewers to realize that the greatest risks are sometimes the unknown, not the known. Linked closely with risk metrics are monitoring and reporting, which are then linked back to risk tolerance, risk policies and ultimately governance. Effective monitoring and reporting processes are the cornerstone of an effective ERM framework. It is through these processes that controls are made effective through appropriate communication within the utility. Given the integral role that monitoring and reporting plays in ERM, it is important that firms implement a coherent reporting strategy and enabling infrastructure to ensure the free flow of necessary information to decision-makers. This integrated reporting strategy should effectively implement the monitoring requirements as set out in the ERM policy and sub-policies and comport to the culture of the organization. Reporting strategies consider not only the reports generated, but their frequency, distribution, and source. For most organizations, this will not mean a monolithic, single platform reporting architecture, but instead a heterogeneous mix of manual and automated solutions to meet the diverse needs of different functions. For utilities, the critical consideration in designing a reporting strategy is the wall between regulated and non-regulated activities. This adds an additional layer of complexity to what is typically already a difficult process.