Edging to the top of the curve

What are your hopes for risk management in the future?

Across many companies and industries there are strong examples of robust and effective risk management: of risk managers structuring their function to positively influence departments; of risk managers feeling empowered to reach out to internal and external stakeholders. Risk management is a business enablement tool that can make a difference. It has indeed matured significantly over the last few years but, as a profession, are we at the top of the risk maturity curve? I don’t think so. And there are two core reasons why we’re not:

• Risk management is fragmented: the understanding and appreciation of risk management across departments and at board level; and the depth of influence that risk managers have in shaping decisions, vary from company to company and industry to industry.
• Engagement with the board and executives is sometimes lacking: risk managers don’t always have a seat at the top-table. This means they are unable to educate and influence decision-makers.

Risk management is a relatively new discipline. There isn’t always a uniform approach. The scope and practice in one company will differ from another. Similarly, the job titles for risk managers will also vary. And this will create confusion over what risk managers do and of their value. As a community, we need to address this fragmentation. By doing so, we will edge closer to the top of the risk maturity curve.

What would you change about risk management?

Risk management can make a big difference in the world of business – if we allow the function to flourish. And this requires a change of mindset – that we as risk managers must adapt to change to ensure our relevance in the future.

The world of business is fast-evolving and how we conduct business in the future will be very different to how we operate now, not least because of technological advances and globalisation. These trends will inevitably affect risk management practices and as a profession we need to contribute to discussion around the future of business. We need to be proactive about future risks. After all, it is our job to be informed of both present and future risks so that we can shape the business decisions of tomorrow.

What frustrates you most about how risk management is perceived?

One of risk management’s biggest hurdles is a lack of uniform understanding of

what risk management is and its value to business. If this is not recognised across departments, at the toptable, and externally by other professions, businesses will end up diluting its purpose and its

full strength and potential will not be fully realised. This is why there should be no ‘reporting line boundaries’ and the risk manager must be able to move through all levels of a company. It is not enough to just be ‘present’ at the board, they need to be visible at every level; and be open and easily approachable.

So, what can risk managers do to enhance their role?

• Working smarter on communication: it must be part of our role to promote what we do and educate. This is not always easy, particularly when you are trying to engage with colleagues who are very out of touch. The fact is, for those who have little understanding or appreciation for risk management, the risk conversation will take time: they must be shown our achievements, scope and potential on a regular basis, through internal marketing.
• Risk philosophy: the risk department can achieve double the impact if a risk management mission statement and philosophy is clearly outlined and everyone sings off the same hymn sheet: a good team shares the same purpose, philosophy, and objectives.
• Expanding risk management beyond the risk community: sharing best practice among the risk community is very important but we must go a step further and reach out to and connect with other professions – engineering, finance and accounting, HR, supply chain, for example. By doing so, we can learn about their understanding of risk management, educate them of the value and influence their perception of it. This is where we can really make a change.

If I were to give you the challenge of writing a risk manifesto for the future, what would be the number one point that you would push and why?

We need to shift our mindset from looking purely at corporate risks and give focus to corporate social responsibility. Risk management of the future needs to give serious consideration to societal and environmental risks – looking at the company’s carbon footprint, for example, and considering the damage to the environment; or conducing a careful review of supply chains to ensure ethnical trade. There are good reputational consequences here, too. A company’s commitment to reducing environmental and societal risks should be backed by a good PR plan to spread the message.