Embracing Risk for Improved Business Performance

Barings Bank rogue trader (1995), LTCM hedge fund failure (1998), Enron bankruptcy (2001), Parmalat accounting fraud (2003), AIG accounting scandal (2005), Lehman Brothers bankruptcy(2008), Bennie Madoff ponzi scheme (2008), Toyota unintended acceleration recalls (2009) , BP Deepwater Horizon oil spill (2010), Fukushima tsunami and nuclear accident (2011), Libor-fixing scandal (2012), JP Morgan $14.6 billion regulatory fines (2013), Rana Plaza collapse (2013) and General Motors recalls (2014) are a few examples of risk management failures we have witnessed over the years.

Although the number of risks affecting the business and list of risk management failures continue to grow year-on- year, organizations are not doing enough to reduce exposure to negative events. This fact has also been highlighted in a recent 2015 Report on the Current Sate of Enterprise Risk Oversight: Update on Trends and Opportunities published by the ERM Initiative at North Carolina State University. Of the surveyed respondents, only 25 percent have mature enterprise-wide risk management process in place, 30 percent have only a partial process, addressing some but not all risk areas and 45 percent have no enterprise-wide risk management process in place. These findings are worrying, especially in today’s volatile, uncertain, complex and ambiguous business environment.

Management of risk is a fundamental and essential element in decision-making at all levels across the organization. Organizations need to rethink the way they look at risk. Instead of only looking at the downside of risks, there is also need to look at the upside of risks. This means moving beyond financial controls and regulatory compliance and spending time assessing, managing and monitoring operational and strategic risks for improved business performance. Risk management is not only about protecting the business but also about enabling business performance. Risk management must therefore be integrated with organization’s performance management activities. There is a positive correlation between financial performance, risk management and performance management. For example, a study by EY found out that companies with more mature risk management practices integrated with strategic planning processes outperform their peers financially.

Implemented properly, enterprise risk management (ERM) helps organizations create value and reduce costs. Today’s volatile economic environment is not making it easy for CFOs. They are being challenged by the board to do more with less, help the business survive and achieve targets. Faced with this challenge, the CFO has no other option but to find cost efficiencies. By implementing robust risk management practices, CFOs will be able to improve the organization’s cost structure. For example, ERM helps management to assess, manage and monitor enterprise risks holistically. Such an approach in turn helps reduce costs by eliminating duplicate risk activities and the savings gained from risk management activities can be used to fund strategic corporate initiatives and create value.

In order to embrace risk for better business performance, organizations must:

  1. Strengthen the Organization’s Risk Governance and Oversight

Enhancing risk strategy enables organizations to more effectively anticipate and manage risks proactively. In order to enhance the organization’s risk strategy, the board or the management committee must strengthen its risk governance and oversight and increase transparency and communication with stakeholders. Developing a risk governance structure includes establishing the organization’s risk appetite, defining the risk universe, determining how the business would measure risk and establishing enabling technology to help manage risk. If the board or management committee is unable to clearly define risk management objectives, this will automatically make it difficult to adopt and implement a common risk framework across the organization. Risk must be aligned to strategy. This helps identify and understand the risks that matter, invest in the risks that are mission-critical to the organization and effectively assess risks across the business and drive accountability and ownership.

  1. Make Risk Management an Everyday Part of the Business

To successfully achieve strategic and operational objectives, organizations must embed risk management practices into their business planning and performance management processes. Current information about risk issues must be included into the organization’s business planning and strategic planning cycles. By linking risk to the business planning and strategic planning cycle, the organization is able to prioritize and link the key risks to its operations and performance indicators.

  • Do you understand how the different parts of your organization fit together and the risks inherent? Risk is everywhere within the organization. You must be able to identify the connection between business, technology, processes, people and risk strategies and coordinate all the risk functions.
  • Is there a formal method of defining acceptable risk limits within the organization? Stress tests must be used to validate risk tolerances
  • How committed to embedding risk management is the organization’s leadership team? Leadership must drive the adoption of the risk management program across the organization and ensure it is effective.

Unfortunately in some organizations risk conversations are done once in a while. Risk is not embedded as part of the organization’s DNA. This must change if the organization is to become agile and respond effectively and efficiently to materialized risks.

  1. Coordinate Risk Activities Across All Risk Functions

Organizations go through various changes during their lifecycle. Some grow and diminish at an alarming rate and others remain stagnant for considerable periods. During the growth phase, various activities (risk, control and compliance) often become fragmented, siloed, independent and misaligned. The result is a negative impact on both the governance oversight and the business itself. Very often, because of this lack of coordination, costs spiral out of control and there is duplication and overlap of risk activities. When this happens, management must act promptly and address these problems to reduce risk burden, lower total costs, expand coverage and drive efficiency.

  • Monitoring and control functions must be aligned to the risks that are mission-critical to the organization.
  • Risk technology must be integrated to create visibility to risk management activities across the organization and eliminate or prevent redundancy.
  • Individuals must receive risk-related training in order to enhance their skills and promote efficiency. You need to continuously evaluate the skills gap in your organization and invest in skills development.
  • Risk consistent monitoring and reporting methods and practices must be applied across the organization to ensure all the risk functions are speaking the same language.
  1. Improve Financial Controls and Processes

Management must build optimal controls and processes that that balance cost with risk. These controls must be optimized to improve effectiveness, reduce costs and support increased business performance. If the environment is over-controlled (costs of control are too high) this hinders finance’s ability to effectively respond to changes in the competitive landscape. In this case, a review of current controls is necessary. This helps highlight duplicate and ineffective legacy controls. Investing in technology is also assisting organizations minimize the use of manual detect controls, automate controls and drive a more efficient, effective and paperless controls environment.

  1. Change the Organization’s Risk Culture

Effective risk management requires the right tone from the top. If there is no commitment or drive from the executives to create a risk aware culture, the program is bound to fail. A risk champion is required to change the way people view risks – from business protection to business support. The chosen individual must have great people and influential skills to ensure successful buy-in. During the change process, a decision might arise to invest in new technology for maximum benefits. Care must be taken that the change process or risk initiative is not technology-driven. The chosen technology must act as an enabler of change and the IT strategy must be aligned with the broader risk and business strategies.

It is critical that executives operating in today’s volatile economic environment periodically evaluate existing risk investments, move beyond compliance and focus more on strategic issues that will increase or decrease the value and performance of the business.

Thanks for sharing:

Leave a Reply

Your email address will not be published. Required fields are marked *

Subscribe to get notified of new posts by email

Recent Posts

Categories

The Art of Risk Management

This is the title of the article by BCG published a few years ago. The article discusses the principles that should govern the approach to risk management by companies of all shapes and sizes.

The authors make several points with which I agree. Here are some excerpts:

  • Risk management is essential in today’s volatile economy. In a continuously changing economic environment, companies cannot assume a stable risk landscape.
  • Stop thinking of risk management as primarily a regulatory issue. Embed risk management in the mindset of the broader organization.
  • Risk management is a value-creating activity that is an essential part of the strategic conversation inside the company. The goal of that discussion should not be to eliminate or minimize risk but to use it to create a competitive advantage.
  • Risk management starts at the top. The organization needs to demonstrate that it has made risk management a high priority and an integral part of the decision-making process by appointing a dedicated risk leader who reports back frequently to the CEO and the board to discuss the latest trends and any changes in the company’s risk scenarios.
  • Risk cannot be managed from an ivory tower. Risk Management should not exist in isolation from the rest of the organization, with an insufficiently granular understanding of the actual business-specific risks the company faces. To avoid this outcome, integrate risk management into the company’s entire routine management processes, including planning, capital allocation, controlling, and reporting.
    • Understand the scope of the risks the company faces.
    • Plan for how the company will manage those risks.
    • Act to mitigate the risks or take advantage of strategic opportunities.
  • Avoid relying on black boxes. Although sometimes appropriate, over-reliance on complex metrics or models can muddy the risk management process, turning it from a transparent management activity into a frustrating black box. The appropriate level of complexity is company-specific and depends on the industry, business model, availability of data, level of experience, and mandatory legal requirements.
  • Align risk management with a company’s overall business strategy. Companies need to identify all relevant risks – not just those that can be easily quantified. Some of the relevant risks for a company may be those that are qualitative and especially difficult to quantify.
  • Risk management is more than a policy; it is a culture. The objective of a company’s risk-management system should be not only to enforce new policies but also to create a risk-aware culture that addresses risks proactively, not reactively, and manages them to create new sources of competitive advantage.
  • Effective risk management depends on the free flow of information throughout the organization. Unless employees at all levels of the organization are actively involved in the risk management process, it will be difficult to maintain the unrestricted flow of information. This can result in the most important data getting buried in one part of the organization unavailable to other parts of the business.
  • Risk management deals with uncertain futures. As a result, the goal should not be to develop precise metrics or future outcomes but to strive for a general understanding of the probabilities and potential impact of various trends or scenarios on business performance and enable decision-makers to confront the uncertain nature of risk and act accordingly.
  • Risk management is never about finding “the answer.” Rather, it is about continually refining the organization’s assumptions about the future and its understanding of the implications of those assumptions for the company’s business. Assumptions about risk often change quickly, so the relevant parameters, probabilities, impacts, and correlations should be revisited frequently.
  • It is possible to prepare for unknown risks by building an organization that so excels at crisis management that it is resilient even in situations in which it is blindsided by unprecedented challenges. For example, through developing the ability to detect, capture, and exploit information patterns as well as to think outside existing frameworks and risk landscapes.
  • Avoid the downside, but don’t forget the upside. Companies should use risk management also to identify new opportunities and to exploit them systematically. For example, scenario planning should be used to define not only worst-case scenarios but also best-case scenarios. Think in advance about how a company can make the best use of the latest market developments and trends and ultimately make the right decisions.

I enjoyed reading the article and highly recommend it.

Thanks for sharing:

Leading in Uncertain Times

One of the biggest challenges facing business leaders today is making the right decisions that will ensure their organizations succeed, survive, and remain competitive in an increasingly uncertain and complex environment.

A recent post, The best way to lead in uncertain times may be to throw out the playbook, by Strategy+Business has several good points.

The article is about the COVID-19 pandemic, how global companies navigated through the crisis, and how best to prepare for future disruptions. Here are some key points and my comments.

  • Rather than follow a rigid blueprint, executives must help organizations focus on sensing and responding to unpredictable market conditions.
    • Comment: Senior leaders play a vital role in providing clarity about the organization’s strategic direction, creating alignment on key priorities to ensure the achievement of enterprise objectives, and ensuring the business model is continuously evolving to create and capture value in the face of uncertainty. They must not rest on their laurels and stick to the beliefs and paradigms that got them to where they are today and hope they will carry them through tomorrow. Regulatory changes, new products, competition, markets, technologies, and shifts in customer behavior are upending many outdated assumptions about business success. Thus, the businesses you have today are different from the ones you will need in the future hence the importance of continuously sensing changes in the global economy. Employees and teams often feed off the energy of their leaders and tend to focus their attention where the leader focuses attention. If the leader is comfortable with current business practices and rarely embraces the future or challenges the status quo, then the team is highly likely to follow suit.
  • When it became clear that supply chains and other operations would fracture, organizations began scenario planning to shift production sources, relocate employees, and secure key supplies.
    • Comment: Instead of using scenario planning to anticipate the future and prepare for different outcomes, it seems most of the surveyed organizations used scenario planning as a reactionary tool. Don’t wait for a crisis or a shift in the market to start thinking about the future. The world is always changing. As I wrote in The Resilient Organization, acknowledge that the future is a range of possible outcomes, learn and develop capabilities to map out multiple future scenarios, develop an optimal strategy for each of those scenarios, then continually test the effectiveness of these strategies. This does not necessarily mean that every change in the market will impact your business. Identify early warnings of what might be important and pay closer attention to those signals. In other words, learn to separate the signals from the noise.
  • The pandemic forced the organization’s senior management team to re-examine how all decisions were made.
    • Comment: Bureaucracy has for a very long time stood in the way of innovation and agility. To remain innovative and adapt quickly in a fast-changing world, the organization must have nimble leadership and an empowered workforce where employees at all levels can dream up new ideas and bring them to life. Identifying and acting on emerging threats and potential opportunities is not the job of the leader alone but every team member. To quote Rita McGrath, in her book Seeing Around Corners, she writes, “Being able to detect weak signals that things are changing requires more eyes and ears throughout the organization. The critical information that informs decision-making is often locked in individual brains.” In addition to the internal environment, the leader must also connect with the external environment (customers, competitors, regulators, and other stakeholders), looking for what is changing and how.
  • It’s worthwhile for leaders of any team to absorb the lessons of sense-respond-adapt, even if there is no emergency at hand.
  • Sensing: Treat the far-flung parts of your enterprise as listening stations. The question leaders must ask is, “What are we learning from our interactions beyond the usual information about costs and sales?” Train your people to listen for potentially significant anomalies and ensure that important information is not trapped in organizational silos.
    • Comment: Cost and sales data are lagging indicators that reveal the consequences or outcomes of past activities and decisions. Although this information can help leaders spot trends by looking at patterns over time, it doesn’t help understand the future and inform what needs to be done for the numbers to tell a different story. In addition to lagging indicators, pay attention to current and leading indicators and understand the relationship between these indicators and outcomes.
  • Responding: Improve communication across intra- and inter-organizational boundaries. Leaders should view business continuity as an essential function that acts as connective tissue for the enterprise.
    • Comment: In addition to creating mechanisms that allow the free flow of information both inside and outside the organization, decision-makers should also be comfortable receiving information that challenges their personal view of the world, even if it’s not what they want to hear. Create a culture of psychological safety where people are not afraid to share bad news for fear of getting punished, but rather are acknowledged and rewarded for speaking up. Leveraging the diversity of thought enables leaders to anticipate the future as an organization, decide what to do about it collectively, and then mobilize the organization to do what’s necessary.
  • Adapting: Challenge assumptions, and question orthodoxies. There’s always the temptation to mitigate threats simply by applying existing practices harder and faster. One way to get at those deeper issues and encourage double-loop learning is to ask, “What needs to be true for this to be the right approach?”
    • Comment: In an increasingly uncertain environment, it’s difficult to survive and thrive with an old business model or outdated technologies. Many businesses fail because they continue doing the same thing for too long, and they don’t respond quickly enough and effectively when conditions change. As a leader, stay curious and connected to the external environment, look for market shifts, understand what needs to be regularly refreshed and reimagined, adopt new technologies and capabilities, and adapt in ordinary times but also during times of transition. Unfortunately for many leaders, it’s just more convenient for them to continually downplay the fact that conditions are changing than take the appropriate course of action that drives business success.

How are you preparing your organization for potential future disruptions?

Thanks for sharing:

The Collaborative Organization

These days the term collaboration has become synonymous with organizational culture, creativity, innovation, increased productivity, and success.

Let’s look at the COVID-19 pandemic as an example. At the peak of the crisis, several companies instructed their workers to adopt remote working as a health and safety precautionary measure.

Two years into the pandemic, they are now asking their employees back to the office full time or are planning to adopt a hybrid model.

The need to preserve our collaborative culture and accelerate innovation are two of the top benefits being cited by organizational and team leaders for bringing workers back.

Collaboration is indeed essential for the achievement of team goals, functional objectives, and the overall success of the organization.

Today’s breakthrough innovations are emerging from many interacting teams and collaborative relationships.

When teams, functions, and organizations collaborate, the whole is greater than the sum of its parts; group genius emerges, and creativity unfolds.

But, what makes a successful collaboration? What are the key enabling conditions?

  • It extends beyond the boundaries of the organization. Business success is a function of internal and external relationships. Instead of viewing your business in vacuo, understand that you are part of an ecosystem. External to your organization, who do you need to partner with to enhance your value creation processes, achieve/exceed your objectives, or successfully execute your strategy?
  • Ensure the objectives are clear and there is shared understanding by everyone. Unclear objectives are one of the topmost barriers to team and organizational performance.
  • Foster a culture that encourages opinions and ideas that challenge the consensus. People should feel free to share their ideas and not hold back for fear of others penalizing them or thinking less of them. Collaboration is hindered when one or two people dominate the discussion, are arrogant, or don’t think they can learn anything from others.
  • Groups perform more effective under certain circumstances, and less effective under others. There is a tendency to fixate on certain topics of discussion amongst groups which often leaves members distracted from their ideas. To reduce the negative effects of topic fixation, members of the group should be given periods to work alone and switch constantly between individual activity and group interaction.
  • Effective collaboration can happen if the people involved come from diverse backgrounds and possess complementary skills to prevent conformity. The best collective decisions or creative ideas are often a product of different bodies of knowledge, multiple opinions, disagreement, and divergent thought processes, not consensus or compromise.
  • New technologies are making collaboration easier than ever, enabling us to increase our reach and broaden our network. Although new technology helps, it will not make your organization collaborative without the right culture and values in place. First, define what you want to achieve through collaboration then use these tools to promote creative collaboration.

How else are you championing collaboration within your organization to create value and succeed?

Thanks for sharing: