How corporate risk management is shaping up after the financial crisis

Blame the financial crisis. No other event in the past few years – not even the disastrous Thailand floods – has had such a profound effect on risk management as the implosion of some of the world’s biggest banks and insurance companies.

This devastating event destroyed the complacency of the financial sector, governments and regulators concerning the effectiveness of their oversight of the industry and triggered a series of official reactions that continue to influence the climate of risk management today.

Legislative responses occurred across crisis-hit regions – Europe and the UK, much of Asia-Pacific and, above all, the US. “The crisis was a big driver of risk management skills,” says Tom Teixeira, a managing director at Alvarez & Marsal in London, who has 20 years of risk management experience with a swathe of big companies.

“[The crisis] has made risk managers more analytical in nature and that’s occurred across most industries – aerospace, engineering, property, resources. Risk managers must now present trends and numbers to the board.”

As others have done, Teixeira cites the Financial Reporting Council’s increasingly specific recommendations as having profound consequences on the way risk is being monitored within preset, agreed tolerances and in the way the results are presented to the board. “Directors now want to see numbers,” he adds. “Further, the analytical techniques that have been adopted by the financial sector are coming into other industries.”

Lloyd’s

 

In a timely example of the way advanced practices are percolating through the broader commercial world, some of Europe’s best and brightest risk managers assembled at Lloyd’s of London in April for six days of hothouse tuition. A series of speakers introduced these relatively young executives, all with three to five years of experience, to the burning issues of the day.

Among other topics, they were given insights into emerging risks, an overview of how Lloyd’s tackles risk appetite and its management and claims management. Launched in 2013, these seminars are certain to improve risk management techniques – and make companies safer – in the coming years. FERMA president Julia Graham is not alone in seeing the Lloyd’s sessions as a crucible of talent.

Looming threats

There is a growing recognition that because too many companies failed to see the dangers that befell them the onus is increasingly on risk managers to head off threats before it is too late.

According to a consensus of views, risk managers are moving into a much more prominent role. As such, they are expected to confront the boards, if necessary, on looming threats. This is what many directors need.

“Generally, boards have a poor oversight of short-term risks and their consequences,” concludes John Hurrell, chief executive of Airmic. “They don’t have to micromanage everything, but they do need effective oversight.” Yet, the more remote the board, the less likely it is to have that oversight.

Recently, Hurrell had a meeting with a titan of the banking industry in an office perched high above Canary Wharf. “It must be very difficult [to be aware of the risks] in such splendid isolation,” he suggests.

“It will become more and more important to behave all the time as though your offices are in a greenhouse, rather than in a fortress such as Dover Castle.”

Sharman report

The Financial Reporting Council’s Sharman report proved to be a wake-up call.

“All directors have responsibility for managing risks,” explains Hurrell. “In this environment, it will be risk professionals who must be their eyes and ears. “Boards need more guidance. There’s a strong need for leadership in reporting to the board.”

Indeed, the analysis of recent commercial disasters tells a sorry story of bewildered boards. In all too many case studies highlighted in Roads to Ruin, the report conducted by Cass Business School for Airmic, the risk management function was buried so far down the executive hierarchy that directors were largely unaware of the menace that caused all the damage. The authors of Roads to Ruin – which should be obligatory reading for all directors in all industries – describe this tendency as “board blindness”.

As Hurrell points out, most companies have about half a dozen management layers and risk management usually lies somewhere near the bottom. He believes the function should have a floating role: access through all levels, so risk managers can gain an in-depth insight into commercial threats from within as well as from without. Armed with that insight, they are then in a position to take their case to the C-suite.

“Boards don’t need to know everything, but they must be confident that the company is not at risk,” explains Hurrell.

Better or worse

Essentially, directors need to know only one thing: “Have things become better or worse?” asks Teixeira. That requires information-rich risk managers with better presentation skills than most have at present.

Typically, says Teixeira, boards are confused by too much data. It may appear as though the risk manager is doing their job, but this will not be sufficient in tomorrow’s world. “Boards can’t separate the wheat from the chaff,” he points out.

Today’s smartest risk managers are using simple colour-coded graphs – or often dashboards – to summarise complex data in a form that is easily assimilated by paper-burdened directors.

Litigation

The phenomenon cannot be blamed on the financial crisis, but Asian risk managers are learning how to deal with the growth of a Western phenomenon: litigation.

As Singapore-based Gabriel Chew, head of insurance programmes and training at palm-oil giant Inter-Continental Oils and Fats Pte Ltd, explains: “The main change in Asia in the past few years is in the area of liability. Historically, the region has seen relatively little litigation – for instance, incidents of bodily injury haven’t normally gone to court – but the old practice of settlement out of court is gradually being replaced by a culture of litigation. This is the result of growing foreign investment in the region.”

This has led to a demand for more highly trained risk managers to look beyond the mere transference of risk. Increasingly, insurers are pressurising them to do so.

Liability

Developments in law are complicating the landscape. In India, for example, since the 1984 Union Carbide chemical disaster in Bhopal, public liability protection has been mandatory under law in certain industries such as oil and gas. In these designated industries, it is obligatory to pay immediate relief payable to affected employees and inhabitants.

However, as Chew points out, there are wide variations across the region: “Practices in Singapore are in line with those applying in international liability.”

Supply chains

Risk managers are also coming to grips with lengthening supply chains because of the explosion in pan-Asian trade. Most companies in the region developed as vertically integrated, family or partially government-owned businesses and had little need to take much notice of what was happening elsewhere, except in terms of compliance with local regulations. However, this is changing as risk managers learn how to negotiate often vastly different regulations in different countries.

In short, whether in Asia or elsewhere, the role of the risk manager is moving up the executive chain and moving outward into new geographies.