Positioning Risk management at the C-Level

In 2010 it's not uncommon for a Board to give their management team a mandate to implement a risk management capability.  I'm seeing it more and more.  In this situation the internal or external consulting team engaged to implement the mandate will need to approach the management team in a very specific way.

Firstly, expect that the CEO or CFO may not fully understand the benefits of risk management and may interpret this as a challenge to their corporate governance.  It is important to communicate the benefits of an ongoing risk management process upfront.  Clarifying to management that this is a value sustaining or value creation activity is critical. Here are several key benefits:

• Increase the likelihood that your organization will achieve its objectives (by integrating risk management with the strategic plan)
• Lowering business volatility by increasing visibility on events that can derail your performance
• Treating risk as "neutral" so that opportunities can also be identified and pursued
• Creating a centralized view or risks and creating efficiencies in risk identification and treatment
• Closing the gap between risk management and capital allocation
• Etc...

Secondly, position it as a process, as opposed to a project.  Processes get dedicated resources, projects don't!

Thirdly, demonstrate how a well run risk management program creates a culture of accountability across the organization for identifying and managing risk.  This will result in higher product/service quality, fewer incidents, and better planning overall.

Finally, show your CEO how the market rewards companies with sound risk management practices.  Ratings agencies, capital markets, and creditors are all starting to differentiate risk-informed companies from the rest of the competition.

These are just some of the tangible benefits that you should communicate to your management team to ensure they are supportive of your risk management program.

[Rich]
richard.m.wilson@ca.pwc.com

Where do you look for risk?

There is a simple question to use when you are identifying risk in your organization.

"What may prevent you from achieving your objectives?".

It is an effective question because it focuses on the risks that are most important to the performance of your company.  It also gives your respondent a context to discuss risk.  If your head of manufacturing has 4 key objectives this year then you simply ask them this question four times, once for each objective. I also find it very helpful to have a list of risk categories to show someone who is identifying risks to help them consider all the risks related to a given objective.

Remember that risks are events.  Therefore as people describe risky situations ask them to clarify what events may occur as these will be your risks.

Taking this approach to risk identification will be very appealing to management and your Board.  They will see the direct connection between your risk management efforts and the performance of your company.  That's a very good thing.

[Rich]
richard.m.wilson@ca.pwc.com

ISO 31000 Risk Management

Every once in a while you feel like you have a jump on something good. In Q4 of 2009 I had the pleasure of conversing with Jan Mattingly, one of Canada's foremost experts in all things related to risk. Jan was one of the delegates chosen from an international list of risk experts to draft the ISO 31000 standard. Jan announced with excitement that the new standard was close to release and that it was going to bring a new level of excellence to Canada's risk management environment. She was right!

Recently, I had the honour attending the first public ISO 31000 training session in Canada. It validated my understanding about how they are approaching operational risk management. It is an objectives-oriented approach (risk = The effect of uncertainty on objectives.). In my opinion this is crucial. After all, businesses exist to achieve their objectives, there is nothing more important. So risk management needs to be oriented around the achievement of objectives or else it will only be regarded as an academic exercise by management.

There are well articulated principles of the standard as well, but none stands so tall as the first - "Risk management creates and protects value". Again, business is about value creation, so risk management should pursue the same goal. Managing risk is not a defensive strategy, it's part of your offense. As a member of a Board of Directors, this principle should be your first filter when assessing the effeciveness of a risk management strategy.

I expect that there will be a lot of excitement around this standard. It is not a "check-the-box" certification, but rather a sound process that will lead companies in the right direction. Any company who is managing ambiguity around risk is well advised to head down this path.

[Rich]
richard.wilson@bpsresolver.com