Positioning Risk management at the C-Level

In 2010 it's not uncommon for a Board to give their management team a mandate to implement a risk management capability.  I'm seeing it more and more.  In this situation the internal or external consulting team engaged to implement the mandate will need to approach the management team in a very specific way.

Firstly, expect that the CEO or CFO may not fully understand the benefits of risk management and may interpret this as a challenge to their corporate governance.  It is important to communicate the benefits of an ongoing risk management process upfront.  Clarifying to management that this is a value sustaining or value creation activity is critical. Here are several key benefits:

• Increase the likelihood that your organization will achieve its objectives (by integrating risk management with the strategic plan)
• Lowering business volatility by increasing visibility on events that can derail your performance
• Treating risk as "neutral" so that opportunities can also be identified and pursued
• Creating a centralized view or risks and creating efficiencies in risk identification and treatment
• Closing the gap between risk management and capital allocation
• Etc...

Secondly, position it as a process, as opposed to a project.  Processes get dedicated resources, projects don't!

Thirdly, demonstrate how a well run risk management program creates a culture of accountability across the organization for identifying and managing risk.  This will result in higher product/service quality, fewer incidents, and better planning overall.

Finally, show your CEO how the market rewards companies with sound risk management practices.  Ratings agencies, capital markets, and creditors are all starting to differentiate risk-informed companies from the rest of the competition.

These are just some of the tangible benefits that you should communicate to your management team to ensure they are supportive of your risk management program.

[Rich]
richard.m.wilson@ca.pwc.com

Don't Confuse Risk Assessment with Risk Management

Let me overstate the obvious.  Risk management is about managing risk. But if it is so obvious, why do many risk management professionals focus primarily on the assessment side of the equation?

Perhaps they are treating it as a project, as opposed to implementing an ongoing process. It could result because the consulting resources engaged to help with the up front risk identification and assessment often don't participate in the follow-on risk treatments.  Or finally it could result from the challenge of harnessing the necessary internal resources to treat risks thoroughly.

Remember that all the work that leads up to the risk treatment phase, albeit important, is only providing you with business insights which you will use to prioritize your risks.  Schedule the appropriate time and resources to develop and execute your risk treatments.  Only once your risks are addressed will you derive the desired link between risk management and corporate performance.

[Rich]
richard.m.wilson@ca.pwc.com