Part I of this article provided an overview of the results of the 2019 risk management survey conducted by The Risk Institute at The Ohio State University’s Fisher College of Business. Part II of this article focuses on the role of leadership and the integration of risk management throughout the enterprise, including day-to-day decision-making.
Philip Renaud - Executive Director, The Risk Institute at The Ohio State University Fisher College of Business Let’s start with some statistical findings. Keeping with trends reflected in The Risk Institute’s 2018 Survey, the Chief Executive Officer (CEO) is again the senior leader most likely to be in charge of risk management (about 30%), followed by the Chief Financial Officer (CFO) in about 15% of firms (collectively 45% or almost one-half the companies we surveyed. The next most likely person is the Chief Risk Officer (CRO) – about 10%. That number jumps to over 30% for financial firms who are much more likely to put a CRO in charge of risk management. CROs also typically report to the CEO.
“Tone at the top” matters for both resource allocation and focus. Interestingly, no firm in our survey decreased financial support for risk management and almost half of the surveyed firms allocated more funding of risk management resources whether such resources were internal or external. Clearly, senior leaders are viewing risk management as a priority.
Integration is a matter of perspective. Not surprisingly, the majority of surveyed firms think of risk management in negative terms with its core function to be a shield or strategy that is defensive or reactive. An example would be a risk management objective to protect or enhance the company’s brand. A minority of companies, particularly financial firms, think of risk management in more positive terms and see the function as a tool for adding value and growth to the company. Which mindset a company has will be evident from how it may approach the current COVID-19 pandemic. We think that companies that take the time to be proactive and develop a well-thought out response plan are more likely to be successful.
Integration is also a matter of business process. More than 20 of surveyed firms indicated that they got better business results by integrating risk management into their business processes such as strategic planning, compliance, quality control, operational business planning and management, and audit. Particularly with negative risk, integration generates more organizational awareness of risk and what should be identified, treated, monitored, and reviewed as needed.
This is especially important for companies that operate in environments that are volatile or highly regulated. About 24% of financial firms reported an “exceptional improvement” in their ability to meet regulatory and compliance requirements when they integrated risk management to achieve corporate objectives. 21% of the surveyed financial firms also reported “exceptional improvement” in avoiding operating losses or litigation and protecting customers and clients.
Finally, getting the risk management function to better integrate with Human Resources remains a challenge for many companies. We will turn to that discussion in Part III of this article.
“Tone at the top” matters for both resource allocation and focus. Interestingly, no firm in our survey decreased financial support for risk management and almost half of the surveyed firms allocated more funding of risk management resources whether such resources were internal or external. Clearly, senior leaders are viewing risk management as a priority.
Integration is a matter of perspective. Not surprisingly, the majority of surveyed firms think of risk management in negative terms with its core function to be a shield or strategy that is defensive or reactive. An example would be a risk management objective to protect or enhance the company’s brand. A minority of companies, particularly financial firms, think of risk management in more positive terms and see the function as a tool for adding value and growth to the company. Which mindset a company has will be evident from how it may approach the current COVID-19 pandemic. We think that companies that take the time to be proactive and develop a well-thought out response plan are more likely to be successful.
Integration is also a matter of business process. More than 20 of surveyed firms indicated that they got better business results by integrating risk management into their business processes such as strategic planning, compliance, quality control, operational business planning and management, and audit. Particularly with negative risk, integration generates more organizational awareness of risk and what should be identified, treated, monitored, and reviewed as needed.
This is especially important for companies that operate in environments that are volatile or highly regulated. About 24% of financial firms reported an “exceptional improvement” in their ability to meet regulatory and compliance requirements when they integrated risk management to achieve corporate objectives. 21% of the surveyed financial firms also reported “exceptional improvement” in avoiding operating losses or litigation and protecting customers and clients.
Finally, getting the risk management function to better integrate with Human Resources remains a challenge for many companies. We will turn to that discussion in Part III of this article.
RSS Feed