joshua rosenberg : thrive in any environment - strengthening resilience through risk management remarks by mr joshua rosenberg, executive vice president and chief risk officer of the federal reserve bank of new york, at the garp global risk forum, federal reserve bank of new york, new york city, 7 november 2019. * * * as prepared for delivery good morning and thank you for the opportunity to speak to you today. let me begin by saying that the views i express are my own and do not necessarily represent those of the federal reserve bank of new york or the federal reserve system. the ability to thrive in any environment, in both normal and chaotic conditions, is an organizational imperative. we can strengthen organizational resilience — “ the ability to prepare and plan for, absorb, recover from, and more successfully adapt to adverse events ” — through risk management. 1 that ’ s because the tools of risk management help us make plans and take action today in the face of an uncertain tomorrow. in fact, we can deliver even more value to our organizations by defining resilience as a goal of risk management. today, i will talk about some of the challenges to achieving resilience and how risk management can be part of the solution. while there are many aspects of resilience, i ’ m going to choose two challenges and their connection to risk management : organizational silos and the complexity of control. organizational silos the first challenge is organizational silos. 2 threats do not respect organizational boundaries. some, like cyber threats, actually exploit them. hurricanes don ’ t care about your organizational chart, and cyber attackers would actually like a copy of it to use it against you. since threats aren ’ t siloed, our defenses can ’ t be siloed either. one of the insights of enterprise risk management is that good outcomes rely on integration across organizational boundaries and types of risk. that ’ s why it ’ s not just risk management, its enterprise risk management. 3 we can use approaches from enterprise risk management to create bridges across silos. to start, enterprise risk management focuses on an organization ’ s objectives and the critical processes that support them. critical processes span organizational units in a connected chain of activities, starting with inputs delivered by suppliers, to value - added transformations within the organization, to the final delivery to customers. so, to strengthen resilience, we identify the risks to process outcomes and then design processes and controls to address those risks. since silos weaken resilience,

solution. will you be satisfied with the performance of your corrective controls when you need them? there ’ s also a bias towards automated controls that is not always well considered. both manual and automated controls have a place in a control system. while machines are better than people at repetitive tasks with clear decision criteria, people are better than machines ( for now ) at tasks that are ambiguous and require judgment and flexibility. when you automate controls, are you preserving the knowledge and skills of staff who need to understand the system well enough to solve problems when automation fails? so, we ’ ve seen how controls are part of a dynamic system in an environment of uncertainty. we can ’ t know whether our controls are sufficient unless we look at the behavior of the control system as a whole. and, we can ’ t achieve our desired outcomes unless we design for them. 10 conclusions today, i ’ ve highlighted two challenges to resilience : organizational silos and the complexity of control. and, i ’ ve proposed a set of solutions based on risk management tools : a focus on organizational objectives, end - to - end management of critical processes, integrated risk management, and a systems approach to control. these all share the common characteristic of being integrative. resilient components do not necessarily add up to a resilient whole. so, organizational resilience is an enterprise goal that is achieved through coherent and coordinated enterprise solutions. a resilient organization is able to make better plans, decisions, and actions that deliver desired outcomes over a range of conditions. to strengthen resilience, we seek to tame the problematic present and constructively move forward into the hazy future. the tools of risk management can help get us there. 1 national research council, 2012, disaster resilience : a national imperative, washington, dc : the national academies press. 2 gillian tett, 2005, the silo effect : the peril of expertise and the promise of breaking down barriers, new york, 4 / 5 bis central bankers'speeches ny : simon and schuster. 3 committee of sponsoring organizations of the treadway commission, 2017, enterprise risk management : integrating with strategy and performance. 4 philippa girling, 2013, “ operational risk and convergence ” in operational risk management : a complete guide to a successful operational risk framework. hoboken, nj : wiley. ramy farha, allen meyer, evan sekeris, and elena belov, 2018, non - financial risk, convergence