Is your risk management truly effective?

Assuming that, because you have well-established and a recognisable risk management process in place, it’s effective.  It may not be doing any harm (although there is a danger of false reliance) and it will most likely be doing some good (so we’re not suggesting it’s a waste of time and should be ditched).  But that doesn’t automatically mean it’s effective in helping the business perform better.

Thinking that the value of risk management should be blindingly obvious to everybody.  Some will see it as an imposed process which only merits a tick in the box.  Others will see it as a vaguely useful exercise but one which is just putting some structure around what they do anyway.  If you want it to stick, you have to try to think through the different mindsets and address them with a clear message.

Coming up with a list of “principal risks” that, at least in part, isn’t connected with what we must get right if we are to succeed.  How far do the risks tie in to the core drivers of performance?  Can you answer the question “how will this list help us to lead the business towards success better than we would otherwise do?” And then, of course, there’s always the possibility that management can’t put the assessment into a strategic context because they’re not sure what the strategy is… Now that’s a risk.

Avoid including so-called “risks” which are not best handled by risk mitigation.  “Our strategy might be inappropriate” is certainly something to avoid but the answer is to work on the strategy to ensure it isn’t, not to record the fact that there is a strategic planning process. “Customers might stop liking our products” would certainly be disagreeable but it’s not something you manage by including a few sentences in the mitigation column of a brightly-coloured spreadsheet.  And things which have already gone wrong are not risks, they are facts.

Adopting a Framework that simply sets out agreed processes without tying it into objectives and how it really needs to work in this particular business.  Or not adopting a Framework at all, relying on piecemeal polices and processes.  It’s up to the Audit (Risk) Committee to make sure the framework is compiled by management, is relevant and is communicated as a living document and tool, not becoming an optional “leave on the shelf” point of reference.

Assuming that, just because a well-designed process is in place and people have been told to follow it, that they’ll do just that.  There are many different factors in how people respond to a required process but the bottom line is – if it’s useful, it’s much more likely to get done.  So assessing opinions and working out how people are relating to the risk management processes and standards is a key aspect of working out whether risk management is effective.

Approaching the “risk management assessment” by limiting it to the risk management processes overseen by the risk function.  It goes much wider than that of course, with a core component being the “first line” activity and the “second line” management oversight.  The committee’s assessment needs to include looking at how risk assessment is built into first line processes and management.