Getting the message

Many risk managers say that they do not manage risks themselves but enable or facilitate others to do so. So one might assume that communication is a key part of their role. Significantly, however, our survey suggests considerable variation in the amount of time spent communicating. Seventy per cent of respondents spent less than half their time on risk communication and almost a quarter (22%), less than 10%.

Interestingly, the primary focus of risk communication was split almost evenly upwards and downwards. Eighty seven per cent of risk professionals said their communications efforts were directed at line or business unit management, and 85% communicated to board level or senior management. Some risk professionals (27%) also targeted shop floor staff, regulators (17%) and the general public (15%). Only 7% had an input in communication to shareholders.

If those are the targets, what are the messages? We asked our respondents to identify what they considered to be the top priority aspects of risk communication. Three-quarters agreed that ensuring discussion of particular risks in the decision-making process was a top priority. Some way behind and fairly closely matched were: encouraging risk-reducing behaviour (55%), changing knowledge, attitudes and opinions (53%) and creating trust and confidence in the risk decision-making processes (52%). Almost half of respondents (45%) also said that ensuring compliance with regulatory requirements was a priority, although only 33% mentioned ensuring compliance with corporate best practice.

We then asked our respondents how important they considered it for risk communication to promote a broader concept of risk, encompassing not only hard information but also dimensions such as individual attitudes and initiative. Replies included the following.

• “Risk communication must take into account the recipient's attitudes to risk. It is important to distinguish between risk communication to individuals and to groups – their attitudes and behaviours are quite different.”

• “Communication is critical but unfortunately is a corporate illness as many managers fail in this area. One major stumbling block is the definition of risk and risk management. Misunderstandings lead to problems and result in lack of communication.”

“Risk communication must take into account the recipient's attitudes to risk. It is important to distinguish between risk communication to individuals and to groups -- their attitudes and behaviours are quite different.

Respondent

• “Communication is very important. However, to a large extent, ‘risk’ is not taught in business schools, and organisations abhor allocating capital and other resources to properly respond to risk and avoid losses.”

• “It's important that risk management is established as part of the everyday business processes. Communicating the upside of good risk management and obtaining buy-in is essential.”

• “The problem is that non-risk professional colleagues and clients do not believe that risk is a matter that affects them directly. Therefore they need to have their awareness of these issues raised, and regular communication is an excellent way of achieving this.”

• “Not everyone is as well informed as others and sharing of information, internally and with shareholders, on what we do and why is paramount to business ethics and good practice.”

On the subject of whether the executive board provides sufficient information on its proposed strategies and risk appetite, 23% of respondents considered their top-down communication to be clear and effective, while 47% felt that it was fair but could be improved. However, a quarter of respondents considered that top-down communication could be a lot better. On the subject of bottom-up communication from line managers and shop floor staff regarding potential problems, gaps in knowledge and emerging risks, while 10% considered this was robust and comprehensive, 63% said that, while fair, it could be improved, and 22% felt it should be a lot better. Additional comments here included:

• “The individuals working with risk at the lowest levels truly understand the role risk plays, but often do not quite know how to articulate it. When they do, management often doesn't want to hear about it, because if they do, they will have to do something about it, or risk criticism if something goes wrong. I have seen this countless times.”

“Not everyone is as well informed as others and sharing of information, internally and with shareholders, on what we do and why is paramount to business ethics and good practice.

Respondent

• “Top-down messages must be worded in terms that the shop-floor can understand. They don't have the big picture, so they must be shown 'why' a decision is made. Shop-floor and middle-managers need to communicate succinctly and to the point to senior management.”

• “Communication committees, in addition to management meetings, which bring together individuals below senior management and board level have had some success in our own organisation and improved the communication both bottom-up and top-down.”

• “I am at the top end. Bottom-up only appears in the form of complaints.”

While the majority of respondents (53%) said that shortcomings in risk-related communication had not resulted in any claims against their organisation, 25% did not know. However, 22% said that claims had resulted from communications shortcomings. In respect of the channels mainly used for risk communication, most valuable were face-to-face meetings, staff meetings/briefings, training courses, company intranet and emailed messages. Comments here included:

• “Risk communication is most effective in small workshop groups of like-minded individuals where the exercise is tailored around their functions and responsibilities.”

• “The company intranet is a great resource as you can place a variety of useful information on it for people to use. Unfortunately, they do not use it enough.”

“The individuals working with risk at the lowest levels truly understand the role risk plays, but often do not quite know how to articulate it. When they do, management often doesn't want to hear about it, because if they do, they will have to do something about it, or risk criticism if something goes wrong. I have seen this countless times.

Respondent

Three quarters of respondents said that their organisations did not have a formal process in place for monitoring and evaluating the effectiveness of their internal risk communications, while three per cent did not know. Those formal processes that were in place included:

• mandatory annual web based tests

• annual or monthly reporting from business segments on their own identified risks

• quarterly corporate and divisional risk meetings

• feedback questionnaires

• regular audit of the risk process including testing understanding across the business.

While 70% of respondents said that they had a formal written risk communication plan for crisis management, fewer (58%) had a formal communication plan for normal operations.

There was one point, however, on which all our respondents agreed – the need for a risk manager to be a good communicator. Indeed, 82% described this as 'absolutely crucial'.