Promote the risk manager!

When Paul Moore, ex head of group regulatory risk at HBOS, made his damning statement to the UK parliament’s Treasury Committee about how he had been ignored and dismissed by the bank over his warnings of excessive risk taking, it seemed to crystallise many people’s fears about the powerlessness of risk management to influence an organisation’s thinking or strategy.

‘When I was head of group regulatory risk at HBOS,’ said Moore, ‘ I certainly knew that the bank was going too fast (and told them), ‘had a cultural indisposition to challenge (and told them), and was a serious risk to financial stability (what the FSA call ‘maintaining market confidence’) and consumer protection (and told them).

‘I told the board they ought to slow down, but was prevented from having this properly minuted by the CFO. I told them that their sales culture was significantly out of balance with their systems and controls.’

In its entirety, Moore’s statement is a graphic example of what can go wrong in an organisation which does not take risk management seriously.

But is his experience typical? To answer this question, AIRMIC recently conducted a survey of its members to find out if they felt they had the support and resources they needed. The overall results, according to chief executive John Hurrell, were encouraging, with two thirds of respondents feeling able to challenge risk strategy without being threatened. But this still leaves a significant number of risk managers who felt otherwise.

So what can risk management do to get itself taken more seriously, especially when cost cutting imperatives in the depths of a recession may lead to jealous eyes being turned on the function? According to AIRMIC’s chair, Julia Graham, much depends on the position of risk management in the organisation and how well it responds. If risk managers have the ear of the board and can be nimble enough to help adjust the risk profile of the organisation, she says, it is an opportunity for them to add value. ‘But if the risk manager has no voice, or does have a voice but fails to do a good job, then it is very difficult.’

“The recession brings opportunities as well as dangers

Perception, she adds, is everything, and to that end, good communication is essential. ‘You need to help people understand what risk management is, and how it sits as part of the golden triangle of governance, risk management and compliance.’ Where organisations recognise the importance of risk management, that recognition can make the risk management function busier.

‘Is your voice heard, and will you do a good job?’

So where does the risk manager start? Paul Taylor, director of risk assurance at Morgan Crucible, thinks that the recession brings opportunities as well as dangers. The downside, he says, is that the very name ‘risk management’ is associated with things going wrong. He agrees with Julia Graham that communicating what the profession is about is of key importance. One of the things that has changed as a result of the financial crisis is that there a sharper awareness of the cumulative impact of events on a global, as opposed to regional, scale. The risk manager, he suggests, can take advantage of this. It is the role of risk management to improve decision making and to deliver an improved predictability of achieving business plans, and the current situation provides good opportunities for proving how this can be done. Cars have brakes, says Taylor, to enable them to go faster – a point for the risk manager to emphasise.

But what is to be done where a risk manager fears he is not being heard? Identify quick wins, suggests Taylor. Management want to know the two or three key things that are going to ‘bite them in the bum’, and how to manage them at an acceptable level of risk. Identify the issues and come up with a clear way to manage them.

In the longer term, risk managers also need to step back from comfortable assumptions about how valuable the profession is and ask themselves some challenging questions. Such is the opinion of Felix Kloman, author of ‘Risk Management Reports’. He considers that over-reliance on quantative analysis must end. ‘Those trying to put in place a culture of intelligent risk management must begin to undermine the numerical fallacy that ‘it doesn’t count if it can’t be measured.’ Paul Taylor concurs to a degree: ‘The key risks emerge from brainstorming and discussion, not from sophisticated computer programs.’

‘Can any one person manage risk?’ asks Kloman. ‘I doubt it. The best an advocate can do is try and implant some combined sense of doubt and curiosity within an organisation’s culture. This person must become a superb communicator if they are to have any effect whatsoever! And the entire system of incentives must be reviewed to get us to make better decisions for the benefit of all stakeholders.’