Multaqa 2015: MENA's fledgling risk management sector shows signs of growth

Developing Middle East and North Africa (MENA) has made respectable economic progress, experiencing an average annual real growth rate of about 5% since the start of the millennium (lower than developing Asia’s rate, but higher than Latin America’s). This marks it out as an emerging market with attractive opportunities for business investment.

The Gulf Co-operation Council (GCC) (namely Bahrain, Kuwait, Oman, Qatar, Saudi Arabia and the United Arab Emirates (UAE)) in particular, has benefited enormously from oil and gas reserves and assets that have generated significant financial liquidity. In addition to being resource-rich, the region’s population growth, forecast to increase by 30% in the next decade to 53 million people by 2020, has kick-started numerous construction projects, including new cities, transport links and healthcare facilities. More than 100 major projects are due to be completed by 2030, costing in excess of $1trn (€746bn).

The GCC is also entering an important phase of diversification. As oil and gas reserves are expected to diminish in years to come, its countries aim to reduce their dependence on the hydrocarbon sector and create employment opportunities by integrating economies with the global knowledge economy, encouraging entrepreneurship, attracting foreign investment, fostering innovation and ensuring access to finance for SMEs.

All these developments spell opportunities and challenges for risk managers. Although risk management as a practice lags behind the region’s growth, it is gradually gaining momentum, according to three senior risk managers based in Qatar.

During a corporate risk management panel debate held at the ninth Multaqa Qatar reinsurance conference at the St Regis hotel in Doha, Qatar, the panellists – Gregory Irgin, director and group risk, legal and reinsurance at UrbaCon Trading and contracting; Philip Wood, insurance senior manager at Qatari Diar Real Estate Development Company; and Frédéric Desitter, director of enterprise risk management at Sidra Medical & Research Center – gave an overview of risk management in the GCC.

Businesses here are more familiar with project risk management and safety risk management than with the ERM concept

Wood started the debate with a clear account of maturity levels: “Risk management, as a practice, is relatively new to the region. Within the GCC and MENA, the focus is on laying the foundation of risk management. Once the fundamental blocks are in place, a more advanced framework can be implemented. Businesses and their employees are on a journey ; they are building risk awareness and, once this has been achieved, a more consistent and sophisticated risk management approach can be shaped.”

The panel commented that project risk management – whereby risks are managed on a project-by-project basis – takes precedence over the holistic ERM framework.

Desitter said: “Risk management is viewed as a governance process and many companies want to implement the function – doing so is seen as best practice. The main objective for many companies in Qatar is to adopt similar governance principles and mechanisms as companies in Europe.

“However, the function is in its infancy, particularly processes such as ERM. Businesses here are more familiar with project risk management and safety risk management than with the ERM concept.

“Having said that, ERM has been successful in some companies. I have started to implement the framework and other organisations, particularly those in the energy and aviation sectors and semi-governmental organisations, have been doing the same.”

Irgin added that although there has been an “upsurge in ERM and project risk management with encouraging success”, challenges exist in terms of engaging executive management. “A risk framework may be designed to the point of excellence and sought to be implemented vertically and perhaps horizontally across an organisation, but challenges remain for those who must follow and report upwards on such models. Chief executives lack understanding of risk management and they therefore do not prioritise it. Their main focus is on revenue generation and profits,” he said.

Talent and resource scarcity

The discussion moved on to the main risks affecting businesses in the GCC. Talent acquisition and resource scarcity, particularly for the construction sector, are two of the biggest challenges for the region.

GCC states rely heavily on expatriates. Indeed, in 2011, most people in the UAE and Qatar were foreigners (87% and 84% respectively, according to a study by the Kuwaiti-based think tank Diplomatic Centre).

With $1trn worth of construction projects, competition for skilled migrants and materials is fierce. “The scale and pace of developments within the GCC are a catalyst for risk,” Wood said. “The region is undergoing so much development and there are many major construction projects, that the availability of resources is scarce and, on the ground, the increased interface risk must also be carefully managed to avoid potential delays/bottlenecks. Companies are competing for skilled staff and materials such as steel and cement.”

Desitter added: “One way to improve talent retention is to offer attractive terms and conditions, but this can only go so far. Other limits make talent acquisition and retention ever more challenging.

“Take for instance, the numerous rail projects planned across the GCC – a metro network is being built in Doha and an even larger network in Riyadh, Saudi Arabia.

“There are limits in terms of the pool of skilled workers who have the knowledge, skills and experience to do the job across the world. Then, there are limits in terms of the number of skilled staff willing to leave their home town and set up base in a foreign country in order to take the job. So, businesses are competing for a limited pool of talent.”

He added: “The lack of materials is likely to affect the completion date of these projects. It may be the case that some companies would need to reconsider their plans and schedules if they are unable to get supplies into the country on time.”

The scale and pace of developments within the GCC are a catalyst for risk

Emerging and intangible risks – particularly cyber risks – are also attracting the interest of risk managers. Cyber crime was cited as the second-most reported type of economic crime in the region, behind asset misappropriation, according to a 2014 report by PwC.

The report, surveying 230 organisations in nine Arabic countries, found that 37% of organisations that reported economic crime had been victims of cyber crime in the previous 24 months. Such attacks were most common in financial services and were particularly prominent in the UAE, Oman and Lebanon in 2012 and 2013.

Governments are taking action: the UAE has enacted the Cyber Crimes Law 2012 and Saudi Arabia has drawn up the Arab Cybercrime Agreement 2012. However, risk managers are still struggling to engage chief executives.

“Cyber insurance remains a hot topic and there is a definite lack of understanding within the corporations I have liaised with as to why they need [insurance] and how it could affect their business in a tangible way,” Irgin said.

“The challenge for businesses is how to translate the benefit of insurance to chief executives, chief information officers and chief finance officers, who all have differing levels of understanding. Some of these executives have no comprehension of why insurance is required and some have a false perception of how secure their business and IT systems are.

“In plain English, cyber threat is real and it is being ignored at one’s peril. If it were to be compared to monetary terms and ignored, the executive committee that respond with such inaction would surely be dismissed swiftly.”

Reputational risk and political instability in neighbouring countries were two more risks that the panel discussed. Both risks were identified as having the potential to interrupt business, exposing them to expensive losses.

Nonetheless, the panel concluded on an optimistic note. Although risk management is less mature than in Europe, the US and parts of Asia, risk appetite is healthy. As Wood said when he opened the debate: “Businesses and their employees are on a journey.” That begins with the basic building blocks of risk awareness, risk culture and risk management