'Risk management and Crisis management are separate'. Elaborate.

Risk management Risk management, also known as Enterprise Risk Management ("ERM"), is a systematic and holistic approach for firms to address all their risks, whether operational, strategic or financial, comprehensively. ERM focuses on identifying risks, developing and monitoring a risk management system and reacting to risk events, when they occur. As ERM is a firm wide effort to manage all the firm's risks, involvement by the company's board of directors and senior management is imperative. In India, both the Companies Act, 2013 and the Listing Guidelines view risk management practices as one of the fundamental functions of the board of directors. Beginning in the mid-1980s, the Committee of Sponsoring Organizations of the Treadway Commission (COSO), initially formed in part to study fraudulent financial reporting, began to articulate a risk management framework. In 2004, following several corporate governance scandals around the world, COSO issued a detailed report defining ERM as "... a process, effected by an entity's board of directors, management and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risks to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives." The COSO approach presents eight interrelated components of ERM: internal environment (the tone of the organization), setting objectives, event identification, risk assessment, risk response, control activities, information and communications, and monitoring The significance of ERM can be seen in the value it creates when effectively implemented and the value it destroys when there are shortcomings in leadership and implementation. Case Study: BP's deep water oil spill On April 20, 2010, an explosion at BP's offshore oil drilling rig caused by a blowout resulted in the death of 11 people and ignited a fireball that continued for 36 hours until the rig sank. This left the well gushing at the seabed for 87 days, resulting in the largest oil spill in U.S. waters and devastating the economy and coastline in the Gulf of Mexico Region. BP itself suffered considerably as a result of the spill; criminal and civil settlements to date have cost the company tens of billions of dollars. The accident was not a first for BP which only 5 years previously had sustained a deadly explosion at a Texas refinery. Several investigative reports generated after the 2005 explosion identified significant risk issues including lack of uniform safety culture, lack of effective early warning systems, lack of effective education and training, and inadequate senior management oversight. By the time the deep-water horizon spill occurred 5 years later, BP's board and senior management had still not created systems for addressing many of these issues, according to BP's own accident report in 2010. The failure of the BP Board to implement an effective ERM system, even 5 years after its ERM weaknesses were exposed by the 2005 explosion, demonstrates the Board's shortcomings. BP's ERM failure proved to be disastrous not only for BP, but also for the environment. Crisis management Crisis management is the process by which an organization deals with a disruptive and unexpected event that threatens to harm the organization or its stakeholders. Unlike risk management, which involves planning for events that might occur in the future, crisis management involves reacting to negative events during and after they have occurred. Following the example above in which a company faces a high probability of a flood damage, a back-up system for all computer systems might be created. This way, if a flood occurs that affects the company, it would still have a record of its data and work processes stored. Although business might slow down for a short period of time while the company purchases new computer equipment, business operations would not be completely halted. By having a crisis resolution in place, a company and its stakeholders can prepare and adapt well to sudden, unexpected, and adverse developments. Crisis can either be self-inflicted or caused by external forces. Examples of external forces that could affect an organization's operations include natural disasters, security breaches, or false information about a company that hurts its reputation. Self-inflicted crises are caused within the organization, such as when an employee smokes in an environment with hazardous chemicals, opens or downloads questionable files on an office laptop, offers poor customer service that goes viral online, or an accounting department cooking the books. Internal crisis can be managed, mitigated, or avoided if a company enforces strict compliance guidelines and protocols regarding ethics, policies, rules, and regulations among employees.