Today's business environment is challenging, and likely to become even more so over the coming months. Changes in the economic, political and regulatory environment have introduced significant risks and uncertainties that have the potential to materially undermine organisational performance.
While there is evidence suggesting that mature, more successful organisations tend to operate more mature risk management frameworks, evidencing whether this is a causal link or simply a correlation remains difficult.
In a recent Risk Coalition Risk Committee Chairs Forum (RCCF) , we explored the question, “What’s the value of risk management… and why hasn’t anyone been able to prove it?” This is the first time we have asked the same question of both our CRO Forum (CROF) and the RCCF, and the resulting discussions have been illuminating.
In this blog, we summarise the key points arising during the RCC Forum discussion. In a forthcoming blog, we will explore how perspectives vary between the two groups.
The absence of risk management and negative consequences
Instead of attempting to prove a positive link between risk management and organisational performance, several participants suggested that it’s possible to prove the value of risk management by highlighting the negative outcomes associated with its absence.
Post financial crash analysis by the regulators identified a lack of effective risk management arrangements as a common factor in failed organisations. Whether it is financial losses, operational failures, or reputational damage, the absence of risk management can have a detrimental impact on an organisation's overall performance.
However, others noted that several highly successful organisations operate without formal risk management frameworks. These organisations attribute their success to experienced senior management teams and boards who practice what they term ‘good management’. While these organisations may not have structured risk management arrangements as we would normally recognise, their management practices tend to encompass good practice risk management principles.
Preventive risk management and unseen outcomes
Drawing parallels to preventive medicine, one participant likened risk management to a proactive approach that prevents negative outcomes. By taking preventive actions and managing risks effectively, organisations can avoid potential pitfalls. While it may be challenging to assess the direct impact of risk management in cases where adverse outcomes are averted, it is crucial to acknowledge the unseen benefits of proactive risk management.
Risk management as a catalyst for innovation
An intriguing perspective emerged during the discussion, emphasising the role of risk management in fostering innovation. The notion that risk management enables organisations to take calculated risks, facilitating innovation and growth, challenges the common perception that risk management hampers progress. By effectively managing risks, organisations can identify and seize opportunities while ensuring a balanced approach to risk-taking. Risk management, therefore, acts as an enabler rather than an inhibitor, allowing organisations to explore new avenues and drive positive change.
Risk management and board culture
The discussion delved into the critical role of organisational culture and governance in ensuring the effectiveness of risk management activities. Roundtable participants emphasised the importance of an open and accountable culture that supports open dialogue, challenges assumptions, and promotes a proactive approach to risk is critical.
The board's role in setting the right culture and being open to discussing unthinkable risks – including those that emanate from the board itself – was highlighted as a crucial factor in effective risk management.
Challenges and lessons learned
The conversation touched upon challenges faced by organisations in implementing risk management practices. One challenge identified was the tendency to prioritise short-term gains over long-term risks. Examples were cited where organisations failed to address questionable practices or behaviours due to concerns about potential negative impacts on profitability.
Another challenge mentioned was the potential gap between what appears effective on paper, such as having comprehensive frameworks and policies, and what works in practice. The importance of embedding risk management within the organisation's operational processes and culture was emphasised.
The value of reporting and frameworks
Participants recognised the importance of reporting and frameworks in risk management. Reporting provides management with the necessary information to understand their organisation's risk profile and make informed decisions. While seemingly bureaucratic, frameworks, such as risk appetite statements and enterprise risk management frameworks, help align stakeholders and establish common understandings of risk.
Conclusion
Proving the value of risk management remains a complex task, as it involves assessing both the positive and negative impacts of risk management practices. While some organisations demonstrate success without formal risk management frameworks, evidence suggests that mature risk management practices contribute to overall organisational resilience and the ability to seize opportunities. The discussion highlighted the importance of fostering a risk-aware culture, where challenging assumptions and discussing risks openly are encouraged. Boards play a crucial role in setting the right tone from the top and ensuring effective governance.
Ultimately, risk management should be integrated into everyday management practices, enabling organisations to navigate uncertainties, exploit opportunities, an,d achieve their strategic objectives. While the quantification of risk management's value may be challenging, its significance cannot be underestimated in today's dynamic business environment.
Chris Burt is a co-founder of the Risk Coalition and a principal at Halex Consulting. His blog is based on a recent roundtable discussion of the Risk Committee Chairs Forum (RCCF). The RCCF was established by the Risk Coalition to provide an opportunity for board risk committee chairs to exchange views and discuss matters of common concern. To find out more about RCCF, please contact the Risk Coalition Team.