Carried out adequately, risk management can be effectively integrated with wider business goals. Risk management has traditionally been a peripheral concern for several organizations. The formal consideration of risk was considerably eliminated from crucial decision-making as organizations focused on the avoidance of physical and economic loss at an operational level.
However, latest high profile corporate failures have proven thait failure to determine and adequately manage risk at a strategic level has a far larger potential effect on company fortunes than insured or lightly controlled operational risk.
According lo the International Federation of Accountants report (Enterprise governance: getting the balance right), the problem is that there has traditionally been little appetite at board and executive management levels to overly formularize decision making — most see it as a sure fire way of increasing bureaucracy and obsstructin performance This is is not to mention that risks were never considered in relation to strategic decisions — no business would have lasted long if this had been the situation — but it was usually an informal and typically unconscious decision.
Central to the requirements of enterprise governance is a clear connection between the management of risk and the fulfilment of business objectives: profits and growth are, in part, reward for successful risk taking. It is the acknowledgement of a performance-driven strategy to risk management — one that is completely in alignment with the spirit of good enterprise governance — that has given rise to theprinciple of enterprise risk management.
As a result of its work association with a few companies that take enterprise risk management critically. KPMG has defined a framework strategy for theessential components of risk management.
The 1st step is the creation of a corporate strategy that is supported by an acceptable structure. The delivery of the strategy is supported through the procedures in place to generate a risk portfolio for the firm. Once risks have been identified they are required to be monitored, or optimized, based on willingness or capacity to accept risk. Lastly, the measuring and monitoring of the risk portfolio includes the establishment of measuring criteria and management reporting.
In using this best practice framework with enterprises, KPMG has established a few important insights into the development of risk management.
- Introducing a risk management framework brings a number of changes to a firm. Those that do not handle this appropriately will fail to fully embed risk mangement into their operations. At best you get two chances at implementing risk management; at worst, just one. Corporations that are successful in dealing with change swiftly create a steady knowledgeacross the corporation of what risk management entails and continually engage and energize their management and staff.
- Recognize what you have and what you require. All firms have components of risk management already in place, some that work well, others that don’t. In recognizing your position, you can identify obstruction to execution as well as obstruct your corporation from reinventing the wheel. Current behaviour, culture, level of buy-in and practical support for risk management are important in this evaluation.
- Business strategy and risk strategy need to be aligned. For many enterprises, risk management has generally been established to handle the meeting of compliance specifications and as a consequence, frequently lacks any real relevance to the overall performance of the business.
The 1st step for any corporation looking toimprove the alignment of its risk management activity with its important decision-making is the formal definition of the amount, and form, of risk that is acceptable in the chase of its business targets. This is its risk appetite.
For the development of an appropriate performance-focused strategy for risk management at board and executive management level, the chosen risk appetite should be formally deemed as part of the setting of business strategy, with investment plans, acquisitions, divestments and other strategic decisions reviewed against it as they arise.
In more decentralized organizations there will most likely be different levels of risk appetite for different operations or individual businesses and a portfolio view of risk and return will be taken. Even in less diverse corporations, certain ventures or activities are looked to for providing future growth and are consequentlymost likely to hold greater associated risk, whereas other activities may be core to the enterprise’s current performance, offering a platform for growth elsewhere, and consequently there will be less appetite for risk in these areas.
The meaning of risk appetite can be as complex or as simple as corporations want to make it. But somewhere in the discussions of corporate goals, and the setting of the strategy to deliver those aims, there should be the formal acceptance of what the pursuit of these goals will mean in terms of the acceptability or otherwise, of the risks connected.
A well-defined appetite for risk will influence the setting of the overall business strategy. The strategy documents that go to the board of directors for approvalought to include commentary on thecritical risks associated with the business strategy and their acceptability in line with the predetermined risk appetite.
The setting of firm strategy constitutes how a firm will make priority its focus and allocate its resources to exploit known opportunities. Supporting strategies will also be developed (or the allocation of resources and investment in areas such as human resources and information technology. The allocation of risk management resources and investment is no different in this regard.
Management and the board will typically look at the environment in which their enterprise functions, the risks inherent to that environment and the amount of risks they are inclined to acknowledge in that environment.Nevertheless, without an articulation of this position, decisions are not likely to be consistent and the ability of the board to challenge the recommendations of management will beconstrained. Neither outcome isparticularly healthy, whether or not seen from a conformance or performance point of view.
In most cases, risk appetite is defined by a mixture of quantitative and qualitative components. Quantitative elements are usually not easy to outline with any accuracy and most corporations arrive at an estimation of, for example, the quantity of capital investment they are ready to risk in the pursuit of their targets. Qualitative factors reference to the more intangible measurements of the enterprise’s value (for instance, reputation and stakeholder relations).
Risk appetite refers to the amount an organization isprepared to bet in the chase of its objectives. Risk capacity refers to the amount a enterprise is capable of losing before it endangers its own sustain ability or, as is more often thecase, market sentiment becomes irreparably damaged.
In general, a risk management strategy should include the followingimportant areas:
- Statement on the value proposition for risk management — particular to the firm and in connection to its business goals and the risk environment in which the company operates;
- Definition of the agreed risk appetite of the firm;
- Definition of the objectives for risk management based on firm goals and supporting business strategy;
- Statement on the essential organizational culture and behavioural expectations in connection with risk taking;
- Definition of firm ownership for the risk management strategy at all levels;
- Reference to the risk framework or system being used to supply the above specifications; and
- Description of the performance criteria used for reviewing the effectiveness of the risk management framework in delivering the risk management objectives.
As with any aspect of corporate strategy, how a corporation targets its risk management resources to manage risk both properly and adequately to deliver performance should be reviewed and revised often in line with its total business strategy.
So what else do organizations require to do in the practical application of risk management? First, the board of directors needs to spend more time on risk. For a risk management framework to be helpful, the board needs to understand the company’s risk management strategy and framework and adapt them as essential in line with the all round business strategy, objectives and direction.
Second, the board should rely a lot more on its risk management resource to understand how the corporation is performing. This means a risk specialist can assess the company’s performance against the agreed strategy and supporting framework more accurately than the board of directors would be able to in isolation. The risk management function needs to:
- Continue to support the embedding of risk via a coordinated and uncomplicated method;
- Increase the advancement and formalization of the risk management corporate strategy and engage leadership.
Where the route of risk management activity, collectively coined as a management framework, is designed to help the delivery of corporation performance objectives, it is more able of providing assurance that the business is monitored responsibly.
