Institutional rules or guidelines that address business risk with only a qualitative view do not indicate a method to evaluate this exposure quantitatively. In the traditional qualitative analysis, the measure of the riskiness of a company is a snapshot at a point in time. Mitigation measures are evaluated later, often from audits to verify the degree of compliance on previous snapshots. The effort to implement these mitigation measures is typically not dynamically evaluated, nor are its results compared to what was expected within the range of risks vis-à-vis the cost of mitigation.
The PEAT ERM module intends not only to document the state of vulnerability of a company to the events that may lead to risk losses, whether economic or non-economic, but also to quantify and measure the uncertainties of the risks and their mitigation costs. All of this is done dynamically, whereby the company may periodically make adjustments to achieve its targeted goals for reducing exposure and pushes the envelope from qualitative assessment to quantitative risk analysis.
PEAT ERM allows dynamic assessments and measures the degree of vulnerability of the company over time using the “% Risk Mitigation Currently Completed” parameter for each risk control and their respective weights in the Risk Register window (see Figure 4.5), which assumes the function of the measurement parameter of Vulnerability as applied within Eletrobrás. This percentage parameter is interpreted as “% Mitigation Completed = 100% − % Vulnerability” indicating a reduction in risk exposure due to the company having implemented measures to reduce its exposure to the risks identified.
This parameter ranges from 0% Complete (i.e., 100% Vulnerable), indicating that the company is exposed to the Total Risk Value, up to 100%, to 100% Complete, indicating a 0% Vulnerability measure, where the risk is reduced to an exposure at its minimum level, also known as the Residual Value Risk.
