“Risk management is not about managing risk, it’s about managing for success”

Risk managers must stop thinking about mitigating individual classes of risks and redirect their focus to managing for the success of the company, says Norman Marks.

During his presentation at the inaugural Risk Management Awareness Week 2019, Marks says risk managers focus far too much on downside risks, leaning on traditional risk approaches to communicate the threats to a business, without balancing this argument with upside risks.

This, he says, is ineffective and fails to help internal stakeholders, executives and the board to make informed and intelligent decisions.

“Risk management should be about managing success”, he told delegates. “And not managing individual risks and militating failure.”

“Take buying a house, as an example. You must weigh up the pros and cons – you don’t just make a list of all the things that you don’t like and that may go wrong. You make a list of all the things you do like and what may go well.

“If you’re starting a new business, for example, you will need to think about customers, turnover and revenue. But what troubles me so much is when a risk practitioner says, ‘well I’m only going to focus on the negative side.’”

He adds that a risk professional may conduct disciplined and modelled analysis of all the potential downside. But if an analysis only presents one side of the argument, they question they must ask themselves is, “are we helping the business make informed and intelligent decisions?”

Ditch the word ‘risk’

The other challenge is gaining the ears and buy-in of executive management and the board. And part of the problem is the perennially used, four-letter word ‘risk’.

“Risk has such negative connotations. People think about [risk] if its only pertaining to things that go wrong. But that is not what COSO or ISO intend. It’s what they write about and it’s what they emphasise, but it is not what they intend.

“When you start talking about risk, [executives and board members] switch off… because they cannot see how it can help them run the business and if they cannot see how it helps them run the business, why should they spend time on it?”

He adds: “If you want to persuade someone to do something, then we need to appeal to their WIIFM, which stands for, what’s in it for me? If people can’t see that there is anything for them to gain, why would they spend time on it… If they can see that it is helping them be successful, then that is something entirely different.

“We get it wrong because we are focusing on traditional risk management is all about instead of thinking about our customer, the leaders of the business and what they need.”

You can acccess Marks’ full presentation, here: https://2019.riskawarenessweek.com/talks/risk-based-scheduling-and-planning-2/