The focus of a good risk management practice is the building of a high-performance operational culture which is baked-in to the business. Efforts to develop risk cultures cultures only serve to increase risk aversion in senior executives and calcify adversarial governance measures which decrease overall profitability. The right approach to risk management is a comprehensive, holistic risk management framework which integrates tightly with the business.
- The failure to link link risk to investment/project approval decision making. The aim of risk management is not to create really big risk registers. Although, in many organisations one could be forgiven for thinking that this is the goal. The aim of identifying risks is to calibrate them with the financial models and program plans of the projects so that risks can be comprehensively assessed within the value of the investment. Once their financial value is quantified and their inputs and dependencies are mapped – and only then – can realistic and practical contingency planning be implemented for accurate risk management.
- The failure to identify risks accurately and comprehensively. Most risk toolsets and risk registers reveal a higgledy-piggledy mess of risks mixed up in a range from the strategic down to the technical. Risks are identified differently at each level (strategic, financial, operational, technical). Technical and Operational risks are best identified by overlapping processes of technical experts and parametric systems/discrete event simulation. Financial risks are best identified by sensitivity analysis and stochastic simulation but strategic risks will largely focus on brand and competitor risks. Risk identification is the most critical but most overlooked aspect of risk management.
- The failure to use current risk toolsets in a meaningful way. The software market is flooded with excellent risk modelling and management tools. Risk management programs, however, are usually implemented by vendors with a “build it and they will come” mentality. Risk management benefits investment appraisal at Board and C-Suite level and it cannot be expected to percolate from the bottom up.
RISK MANAGEMENT IS COUNTER-INTUITIVE
All this does not mean that risk management is a waste of time but rather it is counter-intuitive to the business. It is almost impossible to ask most executives to push profits to the limit if their focus is on conservatism. Building a culture of risk management is fraught with danger. The result is usually a culture of risk aversion, conservatism and a heavy and burdensome governance framework that only adds friction to the business lifecycle and investment/project approval process. Executives, unable to navigate the labyrinthine technicalities of such a systems achieve approvals for their pet programs by political means. More so, projects that are obviously important to the business actually receive less risk attention than small projects. Employees learn to dismiss risk management and lose trust in senior management.
If risk management is to be an effective and value-adding component it must be a baked into the business as part of the project/investment design phase. If not, then risk management processes just build another silo within the business. The key is to forget about “Risk” as the aim. The goal must be a performance culture with an active and dynamic governance system which acts as a failsafe. The threat of censure is the best risk incentive.
Management has long been aware of risk but this does not always translate into true understanding of the risk implications of business decisions. Risk policies and practices are often viewed as being parallel to business and not complimentary to it.
Why is it that most businesses rate themselves high on risk management behaviours? This is largely because businesses do not correlate the failure of projects with the failure of risk and assurance processes.
In a 2009 McKinsey & Co survey (published in June 2012 “Driving Value from Post-Crisis Operational Risk Management”) it was clear that risk management was seen as adding little value to the business. Responses were collected from the financial services industry – an industry seen as the high-water mark for quantitative risk management.
COLLABORATION IS THE KEY
Risk management needs to become a collaborative process which is tightly integrated with the business. The key is to incentivise operational managers to make calculated risks. As a rule of thumb there are 4 key measures to integrate risk management into the business:
- Red Teams. Despite writing about collaboration the unique specialities of risk management often requires senior executives to polarise the business. It is often easier to incentivise operational managers to maximise risks and check them by using Red Teams to minimise risks. Where Red Teams are not cost effective then a dynamic assurance team (potentially coming from the PMO) will suffice. Effective risk management requires different skills and backgrounds. Using quantitative and qualitative risk management practices together requires a multi-disciplinary team of experts to suck out all the risks and calibrate them within the financial models and program schedules in order that investment committees can make sensible appraisals.
- Contingency Planning. Operational risk management should usually just boil down to good contingency planning. Due to the unique skill sets in risk management, operational teams should largely focus on contingency planning and leave the financial calibration up to the assurance/Red teams to sweep up.
- Build Transparency through Common Artefacts. The most fundamental element of a comprehensive risk process is a lingua franca of risk – and that language is finance. All risk management tools need to percolate up into a financial model of a project. This is so that the decision making process is based on a comprehensive assessment and when it comes to optimise the program the various risky components can be traced and unpicked.
- Deeper Assurance by the PMO. The PMO needs to get involved in the ongoing identification of risk. Executives try and game the governance system and the assurance team simply does not have the capacity for 100% audit and assurance. The PMO is by far the best structure to assist in quantitative and qualitative risk identification because it already has oversight of 100% of projects and their financial controls.
Traditional risk management practices only provide broad oversight. With the added cost pressures that businesses now feel it is impossible to create large risk teams funded by a fat overhead. The future of risk management is not for companies to waste money by investing in costly and ineffective risk-culture programs. Good risk management can only be developed by tightly integrating it with a GRC framework that actively and dynamically supports better operational performance.