As companies deepen their investment in emerging markets, extend their supply chains and face increasing pressure from regulators, investors and other stakeholders to increase transparency and disclosure, the executives tasked with risk management assume an ever-greater responsibility for the smooth running of the business. Once largely associated with insurance, compliance and loss avoidance, the risk management function has been transformed in recent years and is now firmly entrenched as a board-level concern.
The focus of the discipline has changed, too. Although more traditional risks, such as credit risk, market risk and foreign-exchange risk, remain fundamental considerations, companies from every industry and sector are now recognising the need to quantify and assess risks that lurk in areas such as human capital, reputation and climate change. The objective of this report is to assess how effectively companies think they are managing these risks, and how they are changing their approach to risk management in order to keep pace with developments in the ever-evolving business environment.
Key findings from this research include the following:
Risk permeates the organisation. The risk management function has evolved to become a core area of business practice, driven by the board but embedded at every level of the organisation. The aim is no longer simply to avoid losses, but to enhance reputation and yield competitive advantage.
Dangers lurk in non-traditional risks. Risk managers consider their organisations to be handling the traditional areas of credit, market and financial risk well, and reputational risk fairly well. In other areas, such as human capital risk, regulatory risk, information technology (IT) risk and tail risks, such as terrorism and climate change, confidence is weaker.
There are many drivers to strengthen the function. Efforts in risk management are being driven by internal and external factors. Principal among the first is the board, but a more complex value chain also figures prominently. The main external drivers are the demands of regulators and investors.
Awareness of risk is the key. With the battle for support from the board largely won, the key determinant of success in risk management has become the need to ensure that a strong culture and awareness of risk permeates every layer of the organisation. Setting a clear risk appetite and establishing well-defined systems and processes to monitor ongoing risks are also crucial.
Companies create a figurehead for risk. The practice of appointing a Chief Risk Officer (CRO) to carry responsibility for developing and implementing the risk management framework is reaching maturity, with most of those companies that favour the approach having already adopted it. The approach is most popular in the financial sector, where two-thirds of firms have appointed, or plan to appoint, a CRO.
An increase in investment is predicted. Firms of all sizes and in all areas of the world are planning to increase investment in most areas of risk management over the coming years, suggesting that this business discipline, although evolving rapidly, will continue to expand and deepen its reach within organisations.
