The risk management function has evolved from being regarded as a compliance function to being regarded as a business partner. This brings additional set of responsibilities and challenges. The spate of events across the globe wherein some of the highly regarded corporates, have faced a severe downturn for a plethora of reasons has highlighted the increasing need of effective enterprise risk management and corporate governance.
In the world of Volatility, Uncertainty, Complexity & Ambiguity (VUCA), Companies will not be able to protect their balance sheet and build on the theme of profitable growth, if they do not have ERM on their side. Regulators, customers, vendors, shareholders and other stakeholders expect, and very rightly so, that an organization will give them value added accretive returns, in all circumstances and the market leaders of the world have always done that. Hence, the onus to deliver is significant.
The world has increasingly seen the emergence of new risks. These new risks, be it reputation risk management, be it governance risks, be it cyber security & fraud related risks or for that matter geo political risks, have increasingly put an onus on the risk management function to continually evolve the risk management landscape and come up with risk mitigation measures which can accordingly protect an organization and build a sustainable Company, irrespective of the environment we operate it. It is challenging, but needs to be done.
Whilst there are many pre-requisites, I would like to mention three key areas which are of significant importance:-
- Risk Management is driven by the fundamental of Tone from the Top. Hence, it is extremely pivotal to ensure that every single senior management member is completely involved in the risk management process and eventually regards risk management as a key business partner to ensure long term viability of the function. The tone set by the senior management sends a strong signal to the middle management and other organizational stakeholders that risk management is being taken seriously and will be given foremost importance in assessing the overall performance and progress of the function.
This builds a culture of risk management in the Company and gradually everybody starts taking decisions which are within the overall risk framework of the Company and every employee starts regarding himself to be a RISK MANAGER.
- The second key aspect is integration of enterprise risk management with organizational strategy. The market leaders of the world are market leaders because they seamlessly execute and build on formulated strategies. Implementation of strategies is not going to be a smooth ride every time. There will be risk factors in the internal and external environment which may impact the successful achievement of strategies. In such a scenario, if risk management is integrated with strategy and risks to implementing a strategy are assessed at the time of formulation itself, then the Company stays protected since more often than not, it is mentally prepared and has the right plans in place.
Risk Management is equally about having Plan B in place and if a good Plan B is in place, you can be relatively certain than the organization will deliver. A good Plan B cannot be framed if the core fundamentals of risk management are not in place.
- The third critical aspect is knowing what you want as a Company. Risks will always be there and hence, not taking Risks is the biggest Risk. The other side of risk is opportunity. Losing an opportunity is equally a risk.
Hence, to be in a position to take calculated risks, organization must have a clearly defined organizational level Risk Appetite as well as Risk Tolerance for each area of risk.
If every stakeholder is clearly sensitized on the risk appetite and risk tolerances of the organization and its associated importance, we can be certain to see a new paradigm where the risk is understood, evaluated and mitigated right at the outset itself, in place of waiting for a thing to happen. And eventually that’s what we want – proactive risk management and not reactive risk management.
The above fundamentally requires a dynamic risk management function to continually assess the risk environment, keep undertaking regular reviews and assessments of the risk landscape and keep sensitizing stakeholders on doing the needful. If the assessment requires a change in risk appetite and risk tolerances - it is extremely important to be flexible as well to leverage on opportunities.
The Board of Directors and Risk Management Committees of organizations also derive tremendous confidence and comfort when they see a risk based culture in the organization, driven by the top management and a proactive risk management function which ensures that profitable growth is built on the core fundamentals of Effective Corporate Governance and Enterprise Risk Management