4. Confirm whether the company’s risk- managment system—including people and processes—is appropriate and has sufficient resources.
Too often, the risk-management system runs parallel to the overall decision-making processes of the company. For example, the 2009 Financial Times/Oliver Wyman report “Emerging Risks: Strategic Decision-making in the Face of Uncertainty” indicates that a key risk-management challenge is developing risk data that aligns to strategic and operational planning. Another major challenge cited is obtaining management focus and resources to develop the necessary analytical capabilities.
Companies must ensure that the risk- management system is geared to supporting the overall management of the company. Many companies will need to redesign processes to better integrate and utilize risk- management information in decision- making processes, requiring enhancements to existing risk assessment and evaluation methods. Boards and management must consider the most appropriate risk methodologies and measures (qualitative or quantitative); how risk analysis will be integrated into the financial and strategic planning and reporting processes; and how management will communicate risk to stakeholders.
5. Work with management to understand and agree on the types (and format) of risk information the board requires.
Currently, board-level risk reporting may consist of an annual entity-level risk-assessment process resulting in a list of risks and high-level assessments of potential risk impact and likelihood, presented in the form of a register or heat map. These one-dimensional tools do not illustrate how a given risk will affect the corporation’s ability to achieve its strategic goals and objectives, the volatility in performance that the risk represents, or the impact of different risks in aggregate.
Organizations need to fundamentally redesign risk analytics and reporting to support risk-adjusted decision making to enable management and the board to:
- Consider a portfolio of strategic choices and the associated risk profiles and differing risk/reward trade-offs of each alternative.
- Identify key risks and how the risks contribute to the overall risk profile and volatility of operational and financial performance.
- Identify how risks interact and aggregate under alternative scenarios.
- Measure and track performance against defined risk tolerances.
Where to Start?
Risk and volatility are explicitly integral to any discussion of strategy and growth. It’s time for boards and management teams to put in place processes that support dynamic risk-adjusted decision making against a clear understanding of their company’s risk appetite. Common starting points for improving risk governance include:
- Creating board training and orientation on how the organization integrates risk management into strategic decision making.
- Developing a clear and consistent understanding of the risk-adjusted performance of the current portfolio.
- Improving strategic and operational risk reporting to reflect uncertainty in performance under different operational and externally driven scenarios.
- Developing a clear risk appetite for the organization.
- Understanding how the risk profile of the organization is positioned relative to competitors, to create positive, competitive advantage.
Alex Wittenberg is the managing partner in the Corporate Risk Practice at Oliver Wyman.
Pages: 1 2