By Claire West
Events such as the financial crisis and the Gulf of Mexico oil spill have boosted the importance of good strategic risk management. But companies that take a genuinely strategic approach to their risk management remain few and far between, according to the findings of a new report. Fall guys: Risk management in the front line, published by the Economist Intelligence Unit.
The report, sponsored by ACE and KPMG, finds that although risk management is currently enjoying an unprecedented level of authority and visibility, appetite for investment in risk is limited. Communication between risk functions and the broader business can sometimes be fragmented, while an enterprise-wide culture and awareness of risk can be difficult to achieve.
To assess the current state of this transition, the Economist Intelligence Unit conducted a global survey of senior executives, from both the risk function and general management. This report presents the highlights of those survey findings, along with related additional insights drawn from interviews with industry experts and commentators.
Key findings from this research include:
•Many companies have still not grasped strategic risk management. Senior executives regard the identification of new and emerging risks — such as weak demand and market volatility — as the key goal of risk management. But just 35% say that their company is effective at anticipating and measuring emerging risks.
•Only a minority of companies involve risk functions in key business decisions. Risk managers have long hoped to play a more prominent role in strategic decision-making, but our survey suggests that this aspiration is still unfulfilled. Few companies even expect risk functions to play a support role in decision-making, with just 41% saying they expect risk managers to provide analysis to help management set corporate strategy.
•Risk managers want to spend more time on the constructive aspects of the role. The risk function needs to spend more time on the “enabling” aspects of the role, such as helping business managers to achieve their business objectives. Currently, though, the lion’s share of the risk function’s attention is dedicated to “preventative” activities, such as controls and monitoring.
•There is limited appetite for investment in risk. Despite rising to greater prominence in many companies, risk management has not generally attracted significant financial investment over the past year. Less than one-half of companies have invested in risk processes, while less than one-quarter have allocated funds to headcount or training of managers in the central risk function.
•Risk functions have increased in authority, but there is a danger that this will not be a permanent change. The financial crisis has placed risk management under the spotlight. Just over one-half of the survey respondents believe that risk management has increased in authority as a result of the downturn–but a similar number agree that the authority of risk management will inevitably decline when the good times return.
•There are doubts about non-executive directors' risk expertise. The board plays a crucial role in setting the tone from the top and instilling a broader culture of risk awareness in the business. However, although confidence levels in the knowledge of executive management are reasonably high, many respondents worry that the technical risk knowledge of non-executive directors is lacking.
"In the wake of the financial crisis, there were plenty of stories about risk managers whose legitimate concerns about the business were ignored and regarded as a brake on growth," said Iain Scott, senior editor at the Economist Intelligence Unit. "Three years on, the incentive to ensure that there is a clear and consistent approach to managing risk across the enterprise has never been greater. But while strategic risks dominate companies' concerns about the year ahead, many clearly find it difficult to link risk management with overall company strategy. Often, the barriers to effective strategic risk management appear to be corporate culture and poor communication."