An effective, Enterprise Risk Management (RM) strategy has become widely recognized as a key contributor to the achievement of objectives within an organization, regardless of the size of the organization, or the industries they ply their trade in. As opposed to just putting a risk management policy in place, or compiling and assessing a list of risks, RM is dependent on a co-ordinated effort throughout the various departments, divisions or business units to manage the organization’s risks in a holistic, synchronised fashion, including responding to these risks, and the opportunities or threats that arise. Combining risk information across the entire organization, as opposed to the traditional silo approach focused on individual departments, has been proven to assist in meeting objectives, powering growth and augmenting performance, enabling more effective strategic and operational planning, thus inspiring greater confidence in decision making.
Let’s take a closer look at some of the potential benefits of implementing an enterprise-wide risk management strategy:
Effective strategic and operational planning
Strategic and operational planning is measurably more effective when aligned with the objectives and risks of the organization. This integration of risk and strategy, taking into account corporate capabilities and flexibility, ensures that strategic and operational plans are adaptable and more resistant to uncertainty. Remember, risk management is not meant to impede initiatives, but should encourage constructive dialogue focused on enhancing the upside whilst mitigating the downside.
Greater stakeholder confidence
Are your internal and external stakeholders aware of your risk management efforts? Questions often asked by stakeholders in the business are “Is the organization a riskier prospect than it was yesterday?” and “Is the organization going to become riskier in the future?” Effective RM paints a clear picture of the risks facing the business, as well as the strategies to be followed in the event of risks materialising. High performing entities more often than not incorporate risk management tools across all business processes with detailed techniques regarding risk analysis, treatment and reporting, which aids considerably in defending and preserving the long term reputation of the organization with its stakeholders, thus inspiring confidence.
Proactive management of risk
For RM to be truly effective, organizations must make a concerted effort to shift their focus to being proactive, as opposed to simply reactive, and driven by events. Using indicators as a measure of how risky an activity is (both for upside achievement or downside mitigation) assists in providing an early warning of a potential event. Clever judgement backed by reliable data, with good old common sense thrown into the mix are essential tools in executing the company’s strategy and achieving objectives. Proactive management of risk will assist in ensuring a meaningful return on resources invested, as well as decrease the amount of time spent on the management of crises. In this way, strategies can be developed that augment and develop the organization’s opportunities.
Evidence of a structured / formalised approach in decision making
A structured, formalized approach should not be confused with multiple layers of bureaucracy or “analysis paralysis”. Although executive leadership should be responsible for driving a consistent strategic decision making process, integrated through various enterprise initiatives, it is vital that the primary stakeholders affected by these plans are involved in and committed to the strategic direction followed. People’s roles and contributions to the decision making process should be clearly defined and governed by unambiguous procedures.
Greater confidence in decision making and achievement of operational and strategic objectives
The gathering and analysis of RM data in a co-ordinated, formalised fashion facilitates and promotes efficient and effective decision making, enabling the business to fly even faster towards achieving their objectives by leveraging the obvious risk management strategy benefits. RM should not only be used as a mechanism to mitigate the impact of uncertainty in the organization, but also as a powerful ally in the recognition and taking of opportunities, and influencing the decisions made in the achievement of operational and strategic objectives.
Early warning system
A hands-on, pre-emptive RM strategy provides an early warning system of potential impacts, contributing significantly to strengthening controls (detective, preventative and corrective), increasing resilience, escalating the organization to a position of greater visibility and making sure that unpleasant surprises are substantially reduced and managed in a beneficial way.
Cost effective internal controls and control strategy
In order for a control strategy to be successful, it needs to be accurate and timeous, realistic yet compatible with organizational standards, flexible enough to adapt to changing circumstances, and closely intertwined with the objectives of the organization. These controls should be implemented at every level, and focused on inputs and outputs, and the processes in between. At the same time though, the costs of these controls need to be balanced against the benefits they provide. An effective RM strategy makes it a lot easier to ascertain whether the benefits offered by a control outweigh the costs of implementing the control.
Regulatory compliance and director protection
Understanding the environment (legal, contract, accepted practices, etc.) in which you operate is key to mitigating regulatory risks which could have noteworthy impact on the organization. Compliance demands have become spread across not just legislators and regulators, but also investors, customers, employees and other stakeholders. At the same time, compliance costs are escalating and unless these compliance demands are fully incorporated into the RM strategy, risk rated, and attention paid to the areas of highest risk, it can become a daunting task, bordering on impossible. Factoring regulatory compliance into the RM strategy greatly assists in reducing incidents of compliance failure and the resultant penalties, going a long way to solidifying director protection and increasing organizational durability.
In conclusion, it becomes glaringly obvious that for risk management to achieve maximum efficacy, ongoing monitoring (involving all stakeholders from the board to the customer and everything in between) and in-depth reporting (based on accurate and reliable data) are critical factors. The basic principles of RM should be made available to all company stakeholders, so that everybody understands why RM is important, and why it should be embraced at all levels of the organization. Although this is obviously challenging, especially in large corporations, the benefits are without a doubt extremely valuable, and as a result RM should be seen as quite possibly the most critical and valuable management tool available to the business.
Please click on the following link to download our practical guide to Selling Enterprise Risk Management to the Board and the Executive:
https://api.barnowl.co.za/selling-enterprise-risk-management-erm-to-the-board-and-the-executive/
Author – Paul van der Struys
May 2016