We never got on that road, but the discussions had indicated that they would use our risk matrices as the basis for how they looked at our organisation. Three of the board members were from the office of the chairman, and all three of them were on board right from the start. They were the primary sellers of the new approach, along with me. During the first year of the programme, they were the ones who were really setting risk appetite. We did get started but we needed to get further down the curve.
Many ERM frameworks incorporate a common unit of risk.
Part of the answer is we hadn t gotten there fully yet. We were gauging risk in our businesses purely on a scale from high to low, from the perspectives of inherent risk and the probability of loss. Then tell me the probability, and then you can put controls into place at that juncture. The next step was to automate all of the matrices onto a database. We had started talking to some vendors.