‘Time for the C‑suite to take a fresh look at risk’

The mes­sage that risk man­age­ment is not just about nasty things, but also what busi­ness peo­ple real­ly want – oppor­tu­ni­ty, new mar­kets, enter­prise – has clear­ly been around for at least 24 years. How­ev­er, has it got through to our col­leagues and above all to the C‑suite?

The frus­trat­ing truth for those who care pas­sion­ate­ly about the ben­e­fits of risk man­age­ment is that the sub­ject remains a turn-off for too many board mem­bers and oth­er senior exec­u­tives. While the pro­file of risk man­age­ment is prob­a­bly high­er than ever, it still has neg­a­tive con­no­ta­tions. In foot­ball par­lance, we are seen as the defend­ers who stop goals rather than the cre­ative mid-field­ers who hold the team togeth­er or the strik­ers who set the crowd alight.

And, if we are hon­est with our­selves, we are part­ly respon­si­ble for allow­ing this mis­lead­ing per­cep­tion to devel­op.

Our mes­sage is that a robust risk cul­ture will nour­ish the entire organ­i­sa­tion, pro­vid­ing the board with vital infor­ma­tion and cre­at­ing the plat­form for it to be enter­pris­ing and inno­v­a­tive. Roads to Resilience, pub­lished by Air­mic in 2014 and based on research by the Cran­field School of Man­age­ment, estab­lished a clear link between sound enter­prise-wide risk man­age­ment and com­mer­cial suc­cess, includ­ing long-term prof­itabil­i­ty.

Risk man­agers can be a uni­fy­ing force, enabling an organ­i­sa­tion to achieve its ambi­tions. To be a strate­gic risk man­ag­er is to be an accom­plished net­work­er and to have an overview of the enter­prise. This means under­stand­ing its strengths, its weak­ness­es, its cul­ture and its objec­tives. It means using risk man­age­ment explic­it­ly to sup­port cor­po­rate strat­e­gy in a pos­i­tive way, and talk­ing and behav­ing like a busi­nessper­son.

This type of exec­u­tive does not even have to have the word “risk” in their job title, but for simplicity’s sake let’s call them the chief risk offi­cer or CRO. Such a per­son should be the eyes and ears of the board, and a key sup­port for the chief exec­u­tive.

Non-finan­cial CROs are extreme­ly rare in the UK, though they are more com­mon on the Con­ti­nent and in North Amer­i­ca. This deficit needs to be made good if risk man­age­ment is to ful­fil its true poten­tial to help UK plc.

How, then, do we improve under­stand­ing of risk? At the heart of the prob­lem is that “risk” is what my old Eng­lish teacher used to call a lazy word, like “nice”. It is used in so many ways that it los­es its pow­er to improve under­stand­ing and to change per­cep­tions. Peo­ple need to make their mes­sage rel­e­vant, time­ly, new and nuanced. By sim­ply using the word “risk”, with­out explain­ing where it fits into the val­ue chain, it can sound old and tired.

Risk man­agers often shy away from talk­ing about the val­ue of their work because so much of what they do is to pre­vent things from hap­pen­ing. The trick is to move beyond some­thing that did not hap­pen and that, in any event, col­leagues would rather not think about. Talk as well about the trust­ed char­ac­ter­is­tics of a brand that build up over time.

Dis­cussing objec­tives is a good first step, but it goes fur­ther than that. Risk man­agers must align their mes­sage with the pur­pose of the organ­i­sa­tion, its lan­guage, cul­ture and objec­tives. Telling peo­ple that, in the worst-case sce­nario, the end of the world could be nigh does not win friends or gain you influ­ence.

Young risk man­agers in par­tic­u­lar are keen to embrace and indeed help shape the new busi­ness world. Air­mic is work­ing with its mem­bers to build on their already for­mi­da­ble tech­ni­cal skills, and to pre­pare for the most senior and strate­gic risk roles. At the same time, it is very much in the inter­est of the C‑suite to take a fresh look at risk and how it can become an even greater force for good.