Suffering from skin deep Risk Management?
Most firms of any size have now developed a risk register and regular reports are being made to the board or a Risk Board Committee. The challenge for most risk professionals is to gain buy in from the people who are really managing the risks, operational and business managers.
In reality an understanding of this fascinating discipline is skin deep and any questioning or discussion about what risks are managed and how quickly discloses this. The FSA quickly discover quite how embedded risk management in the business really is by asking:
- What is the process for risk management? Quickly followed by
- What are the current highest risks you are managing closely?
It is the second question that tests the degree to which the risk register is really used and the awareness of managers of their risk “hot spots”.
In reality, most managers who bring experience to their role are unconsciously competent. They know what the main risks are (but may have lost this information in the mists of time) and they manage them but the information is buried in their subconscience. They may often feel that the whole risk management process is an unnecessary and useless exercise for the benefit of risk professionals.
Language, language. A real barrier to embedding risk management is the language used by risk professionals. Such terms as :
- Volatility
- Correlation
- KRI
- Utility curves
- Risk appetite
- Remedial controls
will cause a line manager with urgent priorities to glaze over and an opportunity to spread the immense usefulness of risk management techniques to be missed again.
How we can help
To embed a real recognition of the value of risk management we run workshops where managers can explore the concepts and relate them to their day-to-day work and priorities. Using the workshop approach we achieve an output that:-
- validates and adds to the current content of the risk register
- enables managers to identify risks they may not have thought of and recognise their importance
- provides the organisation with a common language of risk that everyone understands
- recognises the value of risk management to them as managers and the business as a whole
|