10 steps to better risk management

Bad risk management is seen as a major culprit for the banking crisis and as a result it is likely to come under the spotlight as regulators, central banks and governments overhaul the financial system. StrategicRISK believes that it was not risk management that failed, but rather the design of the system which constricted risk managers and hindered them from doing their jobs properly. The profit motive was just too strong and this drowned out the cries for restraint.

Risk managers also lacked the appropriate authority to exert their influence over senior management. The balance of power, and money, was too heavily weighted in favour of risk taking. The chief risk officer may also have found it too difficult to articulate an accurate view of the whole of the firm's risk exposure. This probably contributed to senior managers not properly understanding the risks they were accumulating and how catastrophic a failure would be. Clearly no one understood the extent to which risk has become systemic.

A new piece of research, published by the Economist Intelligence Unit, and sponsored by ACE, KPMG, SAP and Towers Perrin, examines the lessons learnt from the banking crisis and poses ten practical steps to address the weaknesses. Although the research is primarily directed at financial institutions it also highlights lessons that could apply to other corporates.

Ten steps to better risk management

• Risk management must be given greater authority

• Senior executives must lead risk management from the top

• Institutions need to review the level of risk expertise in their organisation, particularly at the highest levels

• Institutions should pay more attention to the data that populates risk models, and must combine this output with human judgment

• Stress testing and scenario planning can arm executives with an appropriate response to events

• Incentive systems must be constructed so that they reward long-term stability, not short-term profit

• Risk factors should be consolidated across all the institutions operations

• Institutions should ensure that they do not rely too heavily on data from external providers

• A careful balance must be struck between the centralisation and decentralisation of risk

• Risk management systems should be adaptive rather than static

The report concludes: ‘As the industry seeks to rebuild its reputation and regain trust among investors, customers and supervisors, the balance of power needs to shift back towards risk management. Armed with appropriate authority, clear visibility into lines of business, and the ear of senior executives, risk management will become an integral part of any future recovery.’