Where should risk management be placed within the governance structure of a business?

A while back I recorded a short video on the topic of risk management organisational structure in a non-financial company. In the video, I discussed various options for where risk management should be placed within an organisational structure.

There is no single right answer and the few common options include: reporting directly to the CEO, reporting to the board or audit committee, reporting to the CFO or the head of internal audit.

My view is, it doesn’t matter where risk manager sit as long as two important criteria are met:

Risk managers have direct access to decision makers: risk managers must be close enough to the decision-makers to be able to support the risk management integration into business processes and decision-making and be able to reinforce risk management culture. This requires some level of seniority to be able to participate in the decision-making and reach executives or board members when required.

Access to information – risk managers need unfiltered access to various sources of information, including internal audit findings, IT data, production data, financial and accounting information, compliance data and so on. This requires good relationships with key information owners and established communication channels that will allow risk managers to use corporate data for risk analysis on a daily basis. The second criteria is the most important in my mind.

As long as these two criterions are met, the risk manager will be able to fulfil his role almost anywhere within the organizational structure

But it helps to sit with internal audit.

In my personal experience, I reported to head of strategy, CFO, CEO, chair of the audit committee and the head of internal audit. And while reporting lines are unique to every organisation, I found that sitting together with internal audit makes perfect sense, because:

• Internal audit does not own many risks. So, there is less pressure on risk managers to withhold information or exclude data from risk analysis. The opposite could be reporting to a CFO. Finance department originates and owns a lot of risks. I have come across companies where risk managers who reported to the CFO were pressured to exclude financial risks from the analysis or were prevented from integrating risk analysis into financial business processes.
• Internal audit has direct communication routes to the board and the audit committee. This helps to integrate risk management into strategic decision-making.
• Access to financial and operational company data: internal auditors usually have full access to company data and facilities, which is invaluable when performing timely and accurate risk analysis.
• Access to audit findings, non-compliance, and control weaknesses: Internal audit is a gold mine of data which can significantly improve quality of risk analysis. I was very fortunate to be able to communicate with internal auditors on a daily basis. Their input helped me dramatically improve my risk analysis and hence improve the quality of the overall decision-making in the company.
• Risk management can also improve internal audit planning and auditing procedures. The relationship works both ways.

There are, of course, arguments against having risk management and internal audit in one department. I am sure you have thought of a few right now.

Lack of independence and conflict of interest are usually quoted as the main logic for separating risk management and internal audit. But I disagree:

First, to think internal audit is truly independent is a bit of stretch and second lack of independence with risk management in particular is literally the least of Internal auditor’s problems.

I encourage you to share your arguments for or against.