August 2009
Among the many weaknesses and fault lines exposed by the world’s economic meltdown has been the inability of most major enterprises to manage risk effectively enough. Traditional approaches were overwhelmed by the speed and scope of the crisis as the situation spun out of control. But are companies learning the lessons of past failures to create new risk management processes, tools and training equal to the challenges ahead?
To answer that question, Accenture recently conducted its 2009 Global Risk Management Study. The research involved a survey of the risk management attitudes and capabilities of more than 250 of the world’s largest enterprises, represented by their chief financial officers, chief risk officers and other risk executives.
The survey results show a strong commitment to using the lessons of past failures to create a new generation of risk management capabilities that can drive greater business value. The surveyed executives were close to unanimous in their belief that current risk management practices must be substantially improved both to correct deficiencies and to capitalize on emerging opportunities.
One widespread perception that can be seen in survey responses is that risk management has been overly isolated and not fully a part of the rest of the organization. Executives believe the risk function must be better aligned with the company’s strategy and goal-setting process, as well as more fully integrated into the company’s business units, culture and performance management processes.
The required changes will require a long-term commitment by executive management, supported by associated investments. The good news emerging from the Accenture survey is that although executives recognize that they will need to make new investments in their risk management processes, they also expect the changes to deliver positive bottom-line results.
Major findings
The Accenture 2009 Global Risk Management Study found evidence for eight primary lessons to be learned from the manner in which most current risk management functions performed against the current economic crisis.
-
Risk management capabilities are not currently equal to the challenges ahead. The current financial crisis has underscored the fact that significant improvements in companies’ risk management capabilities are required. More than 85 percent of respondents indicated that changes must occur in their risk management capabilities if the lessons from the economic crisis are to be not only learned but leveraged to produce better business results.
-
Risk management is inadequately aligned with business strategy and poorly integrated into business operations. Asked to name the biggest challenge they face over the next two years in developing more rigorous risk management capabilities, survey respondents highlighted two goals in particular: better alignment with the overall business strategy and more effective collaboration with their business units.
-
Integration of risk management and performance management is lacking. The risk management function in most organizations plays an important role in strategic decision making—but at this point, the function is less involved in objective setting and performance management. Only 27 percent of survey respondents indicated that the risk management function is involved to a great extent with objective setting and performance management.
-
Increased regulation is expected. Companies expect a more stringent regulatory and compliance environment in the coming years. Almost half of the survey respondents across all industries believe that regulations will become more stringent. More than one-third say they are already experiencing such an effect.
-
The costs of effective risk management are increasing. The cost of risk management has increased significantly over the last three years, driven primarily by increased business complexity and by inefficiencies in systems, data and processes.
-
Outsourcing of parts of the risk management function is being used to improve efficiency. Outsourcing of selected processes and systems is being used to increase the efficiencies of the risk management function. Sixty-three percent of survey respondents stated that some portion of the overall risk management function can be outsourced.
-
Companies are investing to improve their risk management function. Despite the current crisis and shrinking budgets, firms are increasing their investments in their risk management capabilities. More than 70 percent of respondents have either increased or are planning to increase investments to improve risk management capabilities.
-
Optimism still exists about the ability of strong risk management to drive business performance. Executives continue to believe in the ability of strong risk management to support profitable growth: 61 percent of executives stated that an improved risk management capability can support and sustain business profitability.
Implications
Based on the Accenture research study, the following are especially important keys to achieving high performance through improved risk management.
Develop integrated risk management capabilities.
Risk management must be institutionalized, integrated and aligned with the operating model of the business. To be effective, risk management must be a normal and expected component of the meetings and reviews that are held and the questions that are asked. Risk issues must inform governance and decision-making processes, the training people receive, the management and leadership cultural behaviors expected throughout the organization and the reward structures in place.
Improve the quality of information and the frequency of risk reporting.
Companies that are more competent in managing risk have a higher frequency of risk reporting to different stakeholders. They are also more likely to have standardized risk reporting procedures.
The quality of information and data is also critically important. Effective risk management and internal controls depend on the information provided. In our experience, companies that are more advanced in their risk management capabilities provide highly detailed risk data that supports their information reporting.
Risk-adjust the company’s performance management processes
The purpose of risk management is to support, not stifle, the entrepreneurial spirit of a company. If inadequate coordination exists between risk management and performance management, executives may be improperly rewarded for the risk/return outcomes of their decisions. Therefore, it is important to employ risk-adjusted performance metrics—assessing potential rewards with some adjustment for risks. Combining risk-adjusted metrics with traditional asset-liability management and profitability-performance measurements can provide a company with a more balanced view of its business performance.
Increase the involvement of the risk function in driving value creation
Accenture believes that companies have an opportunity to employ risk management as a competitive differentiator to create value while also protecting the interests of shareholders and other key stakeholders in a cost-effective manner. Improved compliance is an important goal, but higher purposes must also be pursued.
Today, effective risk management is also a matter of using the information derived from risk assessment and analysis to make better decisions and drive growth. In this way, risk management becomes more than just a reactive exercise in protecting value or guarding against failure; instead, it becomes a proactive, ongoing initiative tasked with creating value.
Joining risk management with performance management
Taken as a whole, the survey results and recommendations constitute a road map for developing the next generation of risk management. The ability to manage risk effectively can be a competitive differentiator. It is critical, however, for risk management to be integrated throughout the operating model of the business, including its culture and incentives as well as investment, finance and operational decision making.
In fact, risk management and performance management are really two sides of the same coin, and they need to be held together in a kind of constructive tension. This tension frequently tests the limits of the entrepreneurial spirit each company needs to drive growth. To be sure, those limits must be firm and unambiguous. But there are times when a strong risk management capability should encourage a company to probe those limits. With closer integration, the risk and performance sides of the organization are kept in sync, working together toward a common goal: supporting a company’s risk appetite while also protecting the interests of shareholders and other key stakeholders in a cost-effective manner.
The ultimate results of the effective coordination of risk management and performance management can be higher economic returns, sustainable shareholder value and increased stakeholder confidence in spite of an uncertain global economy. Achieving these goals is a critical part of driving toward high performance in extraordinary times.
About the authors
Daniel T. London is the managing director of the Accenture Finance & Performance Management service line.
Eva Dewor leads Accenture’s global Risk Management group.
To Top