Risk management is a C‑suite issue

The siloed roles of the tra­di­tion­al risk man­age­ment approach are no longer enough to deal with broad risk expo­sures faced by com­pa­nies.

But should top man­age­ment be involved with the risks their com­pa­ny faces or should they be focus­ing on run­ning the busi­ness? Ide­al­ly the two should go hand in hand. Recent research about risk lead­er­ship, con­duct­ed by Har­vard Busi­ness Review Ana­lyt­ic Ser­vices in asso­ci­a­tion with Zurich, the Fed­er­a­tion of Euro­pean Risk Man­age­ment Asso­ci­a­tions (FERMA) and the Pub­lic Risk Man­age­ment Organ­i­sa­tion (PRIMO), has iden­ti­fied key areas of risk man­age­ment that respon­dents felt need­ed more empha­sis.

The Lead­er­ship in Risk Man­age­ment research will be released lat­er this year and reflects the results of a Har­vard Busi­ness Review Ana­lyt­ic Ser­vices web-based sur­vey con­duct­ed with 217 glob­al respon­dents from both pri­vate and pub­lic-sec­tor organ­i­sa­tions involved in risk man­age­ment for their com­pa­ny.

Of those sur­veyed, 84 per cent cit­ed finan­cial risk as an area requir­ing input from the C‑suite when asked which areas they felt need­ed top man­age­ment lev­el atten­tion. This was close­ly fol­lowed by strate­gic risk at 79 per cent, and legal and reg­u­la­to­ry risks came in third receiv­ing 70 per cent of the respons­es.  These results sug­gest that risk man­age­ment is assum­ing a broad­er and more strate­gic role with­in many organ­i­sa­tions, and hints that some busi­ness lead­ers are real­ly start­ing to engage with risk man­agers on risk issues.

Chief exec­u­tives should dis­cuss risk man­age­ment when­ev­er they talk about mar­kets or cus­tomers, as all are equal­ly crit­i­cal to suc­cess

Con­cerns about busi­ness­es’ expo­sure to cyber risks, com­mu­ni­ca­tion on the inter­net and social media were also under­lined by respon­dents as key areas of wor­ry. There was great con­cern on IT or data pri­va­cy and tech­nol­o­gy, which each received 60 per cent and 52 per cent of the respons­es respec­tive­ly.

The amount of risk present in the mod­ern busi­ness envi­ron­ment is arguably only exceed­ed by the need for greater com­mu­ni­ca­tion about poten­tial chal­lenges and opti­mal treat­ments. It is encour­ag­ing to see that in the major­i­ty (62 per cent) of com­pa­nies sur­veyed, there was a bi-direc­tion­al approach to risk com­mu­ni­ca­tion. In oth­er words, com­mu­ni­ca­tion about ris­ing and emerg­ing risks flowed in both direc­tions between the C‑suite and oper­a­tions.

The sur­vey also sug­gests that risk man­age­ment is being tak­en more seri­ous­ly than before in respon­dents’ com­pa­nies. Not only is there bi-direc­tion­al com­mu­ni­ca­tion, but key risks are com­mu­ni­cat­ed to the C‑suite reg­u­lar­ly at 70 per cent of com­pa­nies sur­veyed, the board reviews risk man­age­ment poli­cies and pro­ce­dures annu­al­ly at 59 per cent of respon­dents’ com­pa­nies, and reviews top risk expo­sures and treat­ment actions at least bi-annu­al­ly at 73 per cent of par­tic­i­pat­ing organ­i­sa­tions.

The results speak for them­selves, but do they rep­re­sent a busi­ness real­i­ty? Lin­da Con­rad, direc­tor of strate­gic busi­ness risk at Zurich North Amer­i­ca, believes there is more work to be done.

“Today, risk can be a com­pet­i­tive advan­tage if com­pa­nies are ‘risk smart’, inno­v­a­tive and ready for change. The fig­ures are encour­ag­ing, and I have seen some improve­ment in com­mu­ni­ca­tion about risk and oppor­tu­ni­ty between busi­ness heads, chief risk offi­cers (CROs) and the board.

“Ide­al­ly, chief exec­u­tives should dis­cuss risk man­age­ment when­ev­er they talk about mar­kets or cus­tomers, as all are equal­ly crit­i­cal to suc­cess. Yet many com­pa­nies still strug­gle with how to embed risk acu­men through­out their enter­prise and proac­tive­ly address risk issues.

“The blind-side of risk can cost you mon­ey and pre­vent you from tak­ing advan­tage of oppor­tu­ni­ties that can dri­ve growth. But when risk man­age­ment is linked to strat­e­gy and bud­get, a firm can more clear­ly artic­u­late their opti­mal bal­ance between risk and reward to deliv­er improved results.  For this to hap­pen, the C‑suite must con­tin­ue to pro­mote a risk cul­ture shift and encour­age dia­logue that can improve risk aware­ness, account­abil­i­ty and, ulti­mate­ly, achieve­ment.”

Train­ing in risk man­age­ment is on the rise in some organ­i­sa­tions, as more than half (56 per cent) of the com­pa­nies sur­veyed have increased the resources they devote to risk-relat­ed edu­ca­tion and train­ing over the past three years at least at the CRO lev­el and high­er.

While the impli­ca­tion may be that it is only top man­age­ment who are get­ting the nec­es­sary train­ing and edu­ca­tion, there are results which show they are lead­ing respon­dents’ com­pa­nies in cul­ture change. For exam­ple, more than three-quar­ters (79 per cent) of the respon­dents said employ­ees are encour­aged to call atten­tion to new risk expo­sures and busi­ness changes, and anoth­er 52 per cent said that, over the past three years, their board has strength­ened codes of con­duct and pro­tec­tions for inter­nal whis­tle-blow­ers.

“It can only be good news that top man­age­ment are becom­ing more risk-aware,” says Vini­cio Cel­leri­ni, Zurich’s chief exec­u­tive of glob­al cor­po­rate in the UK. “This research clear­ly shows that the C‑suite and the board are work­ing with CROs to bring about sig­nif­i­cant change in some com­pa­nies.

“Risk aware­ness and a tru­ly enter­prise approach to risk man­age­ment could help busi­ness­es cut costs and iden­ti­fy their risk appetite more eas­i­ly.

“It is fun­da­men­tal for every busi­ness to have the cor­rect process­es and mea­sures in place to pro­tect their com­pa­ny, and effec­tive­ly man­age risk. But some­times that is eas­i­er said than done, and com­pa­nies need an out­siders’ per­spec­tive on their approach to risk man­age­ment, risk trans­fer and risk finance. This is when com­pa­nies should engage with their insur­er.”

This research was cre­at­ed in col­lab­o­ra­tion with Har­vard Busi­ness Review Ana­lyt­ic Ser­vices, Zurich, FERMA and PRIMO, and data was col­lect­ed between Jan­u­ary and Feb­ru­ary 2013.

You can sign up to watch the Lead­ing Risk Cul­ture Change webi­nar, which pro­vides an overview of the research, by going to www.krm.com/hbr/RiskCultureCL

The siloed roles of the traditional risk management approach are no longer enough to deal with broad risk exposures faced by companies.