The Impact ofIntegrated Risk Management
An Illustrative Quantitative Analysis of IRM1

Integrated Risk Management (IRM) combines individual areas of risk
management into a cohesive approach to reduce the potential effect ofadverse events.
Archer views six major areas of IRM as follows:• Environmental, Social, Governance (ESG) - the risks associatedwith the new paradigms of the modern enterprise and key
indicators of a companies’ long-term viability;• Enterprise and Operational Risk – the risks to strategic
objectives and within operations that affect everyday deliveryof products and services;• IT & Security – the risks associated with the technology
infrastructure as organizations lean hard on technology
innovation for stability and growth;• Audit and Regulatory Compliance – the ever-present shifting
landscape of legal and industry requirements;• Business Resiliency – the expectations of the ‘always on, always
there’ organization; and• Third Party Governance – the risk of the expanding, complex
network of relationships so crucial to the organization’s success.
At the core of Integrated Risk Management is the ability for the business to make risk informed decisions - meaning
business stakeholders are presented a clear and concise picture of the interdependent nature of risk, the potential
impacts and the ability of the organization to weather negative events.

Most often, the benefits an organization sees in taking this more strategic andcomprehensive approach to risk management are evident in many different types ofmetrics such as fewer compliance violations, less disruptions, and more effective
responses to operational events. This eBook explores another way to view the impactof IRM through the lens of a quantitative Bow Tie Analysis .
2

The Bow Tie analysis provides a method to analyze the overall affect of an integrated
approach to risk management by quantifying the financial exposure.
The Bow Tie analysis is depicted as follows:• Drivers are actions, events or circumstances that could cause a Risk,or Risk Event.
• Each Risk Event can have multiple Consequences. TheseConsequences could be financial losses, reputational harm or othernegative effects for the organization.
• Controls are put in place to prevent the Driver from causing the Risk
event and controls are put in place to mitigate the consequences
and reduce the impact. Preventive Controls attempt to reduce theprobability the Risk Event happens; Mitigating Controls attempt toreduce the impact of the consequences.
Bow Tie analysis is often used to analyze individual risk events but can also be applied at the macro level. For purposes of anillustrative example of this type of approach, Archer Insight was used to create multiple Bow Tie analyses of integrated risk
management elements and determine a measurable impact. Bow Tie models were created for Environmental, Social, Governance(ESG), Resiliency, Third Party, Regulatory Compliance, and IT and Security risk. Common drivers and consequences were mappedto each of these risk events. The control set utilized was comprised of Archer use cases, representing major activities and processesof an integrated risk management program.

This is one example of a mapping
between a Driver, Controls anda Consequence related to thirdparty risk.

3

The Power ofQuantification

To complete the analysis of the effect of effective IRM practices, threecontrol scenarios were created and controls were assigned successprobabilities based on the nature of the control and the program state.
Baseline - The Baseline state represents a risk management program wherecontrol effectiveness is minimal representing early-stage programs or a verysiloed approaches to managing risk. Each control was weighted as “1/4effectiveness”.
Moderate - The Moderate state represents a mid-stage program wherecontrols are more effective representing programs in flight towards anintegrated approach. Each control was weighted as “1/2 effectiveness”.
Integrated – The Integrated state represents a mature program with highlyeffective controls. Each control was weighted as “full effectiveness”.

The effect of control scenarios on aggregatedfinancial exposure

The control scenarios resulted in significant reductions of risk exposure via
aggregated financial exposure, frequency of risk events and frequency ofconsequences.

The effect of control scenarios on risk event frequency
4The effect of control scenarios on consequence frequency

KEY FINDINGSThe intent of this analysis was to apply quantitative analysis at an extreme macro level to identify the impact of an integrated
approach to risk management. While most often the effectiveness of risk management programs is measured qualitatively, theapplication of bow tie analysis and the quantification capabilities of Archer Insight provides a view into a more tangible impact interms of reduction of financial loss exposure, risk events and consequences. This illustrative example resulted in findings that, ifapplied in an actual organization with accurate, defensible inputs, would yield significant appreciation of the value and benefits ofintegrated risk management strategy.

Risk management must take into consideration where your organization is headed. Risks can stand in the way of that journey. It is
important to understand fundamentally the inputs risk management can provide into the decision-making process.
•••An IRM program that includes the risk andcompliance processes enabled by Archer could
reduce overall operational risk financial loss
exposure by 40 – 70% depending on theeffectiveness of the program.
The analysis indicated a reduction of risk events(negative events) by significant rates.
The analysis indicated a reduction of consequences
events by the significant rates.

For more information, read the full analysis white paper.
5DOWNLOAD

Archer InsightArcher Insight is a suite of enterprise-wide risk quantification capabilities forbusiness leaders designed to deliver a complete view of enterprise risks,
improve resilience, and ensure achievement of strategic goals.
This innovative solution provides business leaders with more precision in an
aggregated view of risks that allows them to ensure compliance and better
protect your business from disruption. Using Archer Insight, organizations
can conduct risk quantification analysis, monitor, and report on their risk
management programs and then provide business leaders and decisionmakers with quantitative, transparent, and actionable information needed tomake strategic business decisions.

Archer Insight is entirely quantitative, enabling you to combine all threats
to your organization and truly understand the risks and consequences thatmatter. The solution makes quantitative risk management logical,
defensible, and straightforward by providing a full set of tools and features
for understanding and managing all types of risk in one platform:
operational, strategic, cyber-security, health and safety, investment, andreputational risk.

Learn more at:https://www.archerirm.com/archer-insight-risk-quantification

6

About Archer
Archer is a leading provider of integrated risk management (IRM) solutions that enable
customers to improve strategic decision making and operational resilience with a modern
technology platform that supports qualitative and quantitative analysis driven by both businessand IT impacts. As true pioneers in GRC software, Archer remains solely dedicated to helping
customers manage risk and compliance domains, from traditional operational risk to emerging
issues such as ESG. With over 20 years in the risk management industry, the Archer customer
base represents one of the largest pure risk management communities globally, with more than
1,200 customers including more than 50% of the Fortune 500.
For more information visit www.ArcherIRM.com.

@ArcherIRM

Archer Integrated Risk Management©2022 Archer Technologies LLC. All rights reserved. Archer and the Archer logo are registered trademarks or trademarks ofArcher Technologies LLC in the United States and other countries. All other trademarks are the property of their respective
owners. Archer believes the information in this document is accurate. The information is subject to change without notice. 11/22
eBook.
7