acknowledging that impacts may be widespread. even if the consequence for the organisation would be severe, it is best to allocate and manage the risk in the business area that has greatest scope for risk control. • monitoring and review of risks regular risk review is required, to evaluate any changes in the risk or control environment. likelihood and impact vary as political, social and technological factors evolve, and in response to changes in the business and the mitigations put in place. incidents occur and provide insight into risk assessment. the monitoring - feedback loop is a critical part of keeping risk management in focus. • reporting and escalation procedures – as risk severity changes, incidents occur, and risks materialise into issues, it is important that reporting and escalation processes exist. these enable broader perspectives and judgement to be applied in the evaluation and management of risks. project governance processes are standard mechanisms for project risks. supervisory oversight provides a reporting channel for operational risks and the senior leadership group should dedicate time to reviewing strategic risks, but more structured risk reporting processes for material changes in risk should be considered. a risk management committee may be established as one way of reinforcing the review processes. enterprise risk management at the reserve bank the reserve bank has reviewed its enterprise risk management framework ( erm ), and some key insights can be gained from this experience. bis central bankers ’ speeches the institution has one of the broadest sets of functions amongst its global central bank peers. amongst others, its activities include responsibility for monetary policy, regulation and supervision of the financial system, currency ( cash management ) operations, and operations of the payment systems infrastructure. there are considerable risks associated with each of these functions. at the reserve bank we openly acknowledge risk and recognise that an effective enterprise risk management capability is an integral part of successfully running our business. our erm model was developed in - house, following an extensive review of the relevant international standards and research into how other institutions were approaching risk management. it was tailored to meet two critical criteria. firstly, it had to be the right “ fit ” relative to the look and feel of the institution. businesses have unique cultures and values, ways of doing things, and accepted working protocols and erm solutions need to blend in ; otherwise they may not be embraced or effectively used. secondly, the erm model had to be capable of covering all broad policy and operational functions within the bank, and factor in the related external new zealand level risks. these matters were considered essential to winning

adequately anticipated or managed. j. smyrk, “ enhancing business projects in statistics new zealand : learning from the hlfs - cai initiative, a report on a review of hlfs - cai ”, september 2005. bis central bankers ’ speeches innovation is critical to strong business performance as organisations seek to enhance product and service offerings, lift efficiency, upgrade technologies and increase their resilience and adaptability. without innovation, organisations wither and customers and business owners suffer. becoming ideas constrained is fatal, but there are risks in innovating. as machiavelli said centuries ago, “ never was anything great achieved without danger. ” risk and reward are inextricably intertwined. leaving the boat safe in its harbour will not yield progress. good risk management is imperative for managing successful change. it involves anticipating and diminishing threats ; protecting sources of value ; and enabling value - creating risks to be taken in a calculated way, with reduced likelihood of failure or loss. 2 done well, it enables an organisation to seize opportunities to create and protect value for all its stakeholders. good risk management enables an organisation to move forward, because the downside risks of change are contained, and risk management provides a forward - looking orientation. it allows organisations to focus their competencies on value creating activity. done well, it informs strategy, investment prioritisation and business decision - making. it drives organisational direction and positioning. a second key benefit is that it reduces the likelihood and costs of adverse events that may damage organisational reputation, financial or business viability, and distract the organisation from achieving its goals. novopay, and acc ’ s privacy breaches, are familiar examples where the organisational and societal costs of risk management failures have been considerable. good risk management fosters both adaptability and resilience, two crucial aspects of enduring organisational performance. types of risk generally, three categories of risks are identified : strategic, operational and project risks. 1. strategic risks describe the impact on the business of possible changes in the wider environment, such as political, international, demographic, social, etc., and the dangers of business strategies not being adequately aligned to their operating environment. they also entail risks to the accomplishment of key business goals through loss of focus, inappropriate investment or resourcing, and reputational and communication risks. mitigations of strategic risks tend to be strategic choices and business model approaches ; investment prioritisation decisions during planning processes, often resulting