Risk management is failing to deliver the value that it should, according to a survey of more than 400 financial services executives by PricewaterhouseCoopers and the Economist Intelligence Unit, with fewer than one in ten respondents believing that risk management is very effective at enabling managers to make better business decisions.
The study, entitled 'Creating value: effective risk management in financial services', revealed that, while risk management has received considerable industry focus under the wave of regulatory reform such as Basel II and Sarbanes Oxley, there are considerable concerns that once the regulatory attention shifts elsewhere, the impetus to embed risk management properly and maintain it as a core business discipline could all too easily fade.
Despite major investment (almost a quarter of respondents increased their annual spending on risk management by more than 25% year on year for the past three years), risk managers do not seem very confident that this investment and their ongoing efforts are very effective in adding value to the business.
Only 50% of the risk managers in the survey sample believed the function contributed substantially more value than it did three years ago. The verdict from executives in other functions is worse, with only 23% saying there had been a substantial improvement.
Richard Smith, partner, PricewaterhouseCoopers LLP, said: "Senior executives concerned with bottom line performance and brand value are acutely aware of the damage that can be done, or opportunity lost, if risk is not managed properly. But our study suggests that it is still under-valued in many ways.
"As industry gradually gets to grips with requirements such as Basel II, executives inside and outside the risk function, need to punch their weight and demonstrate how risk management can have a material business impact on their whole organisation, otherwise they may risk losing the attention of their senior management."
The survey also revealed that the risk management function is often not proactively engaged by the rest of the business, with over 50% of respondents admitting there was no structured assessment of risk in some of the most critical business processes within their organisations and risk managers were often not involved in key business activities such as alliances and M&A, pricing, recruitment and compensation policies.
Richard Smith, partner, PricewaterhouseCoopers LLP, continued: "Many respondents still appear to be struggling with managing effectively the less traditional and tangible sources of risk, such as reputational and people risk, despite these forms of risk ranking among the more pressing faced by financial institutions."
This frustration, however, should not be mistaken for defeatism as the faint outlines of a redefined agenda are beginning to emerge. While survey respondents continue to expect regulation to be the main driver of change for the risk function, it was picked by significantly fewer respondents when they looked ahead over the next three years. More respondents now expect the aim of increasing the value of risk management to the business to drive change.
Miles Kennedy, also a partner at PricewaterhouseCoopers, remarked: "At its simplest, risk management is about avoiding losses and realising gains. But the value in risk management goes well beyond that. It can also burnish a company's reputation with customers and other stakeholders, reduce financing costs, maintain the capacity and flexibility to invest, deliver better management data and enable more competitive pricing."
A few major financial institutions have taken significant steps down the path of making risk management a core business discipline, for example by embedding risk managers and their processes into front line businesses. Others have strengthened the integration between the risk and finance functions to better support capital management, strategic planning and investor relations processes.
