Seize the opportunity through strategic risk management capabilities
PwC has shared with us the results of their 2022 Global Risk Survey.
It has some interesting stuff, although (as usual) doesn’t go far enough for me. Their food stuff includes:
- In this turbulent business environment, many executives find the need to revise and adapt their strategies and operating models at a rapid pace. They know that capturing opportunity and avoiding disruption requires speed.
- Organisations’ risk management and broader resilience capabilities need to quickly adapt to support business agility and to contribute proactive, robust and timely risk insights for decision-making. In an environment where change is constant, strong risk and resilience capabilities can provide an edge. Business leaders can make confident decisions in pursuit of their strategy that are informed by a panoramic view of risk.
- The organisations that have stood out from the pack in the past two years have not just managed risks. They’ve taken on risks, with confidence. These organisations have an agility advantage. They have the right resources engaged in making risk-informed decisions at the right time.
These are both excellent observations (in the midst of a discussion about the turbulent risk landscape).
Although an argument may be made that things are changing faster than ever before, the fact remains that if an organization is to be successful it has to do more than avoid disaster.
I congratulate PwC for recognizing this truth. I especially like the last excerpt above.
They sound a note of warning, reporting that only “39% of business executive respondents say they are making better decisions and achieving sustained outcomes by consulting with risk professionals”.
However, that is the highest percentage by far I have ever seen respond positively on this issue. Other surveys tell us that about 80% of executives see risk management as a “compliance activity. So I am taking the good news of 39% with a dose of salt.
Unfortunately, the greater part of their report still focuses on avoiding failures. For example, they talk about risk profiles (COSO-speak for risk registers), KRIs instead of KPIs, risk appetite (they would have done better by including a discussion of risk capacity), risk culture (instead of organizational culture), a common risk language (when we should be talking about performance), and a GRC platform (without saying it has to be objective and performance driven).
My advice:
Instead of talking about risk and trying to embed it into decision-making, make sure your decision-making processes consider all the events and situations that might happen. Then make the right business decision.
In the meantime, ask your executives whether “they are making better decisions and achieving sustained outcomes by consulting with risk professionals”.
I welcome your thoughts.
Leave a comment
Norman Marks on Governance, Risk Management, and Internal Audit 
I fully agree with you Norman, as so often before.
One small bite of food for thought from my side. If it is true, that the speed of change is higher than it has ever been before (I believe that is, and has “always” been true) then simple extrapolation will show that:
“The speed of change will never again be as slow as it is today”.
So, executives of the world, fasten your seatbelts and get going. Those of you who do not drive change in your company and your industry will be forced to be driven by change – and then, who is leading?
Another good piece, Norman, although I must question your final advice. You say “make sure your decision-making processes consider all the events and situations that might happen.” Of course, this is the whole problem, isn’t it?
We constantly work with incomplete and imperfect information so we’re never sure if we’ve considered “all the events” nor if we’ve identified the optimal plans to address those events. Almost every decision ever made or that will be made is based in imperfect information.
We do the best we can with the information available. It doesn’t matter whether it’s a question of a business merger, who to hire, or which movie to see.
Richard, I am using that language because it is business language, rather than talk about risk. Certainly, there are limits.
Norman,
As always, a great article. The line that particularly caught my attention:
“Although an argument may be made that things are changing faster than ever before, the fact remains that if an organization is to be successful it has to do more than avoid disaster.”
This is one of the biggest challenges in the mental models that exist among executives. The perception is that risk is always a ‘bad thing’. After more than 30 years I am still stumped by the fact that they don’t consult a risk professional on major decisions – so as to offer some impartial observations. The bigger issue is with the planning process – they seldom consider the conditions that are necessary for success to achieve the outcomes they so want (KPIs).
If only planning and decision-making could improve, we would likely see that change is always present – regardless of its speed. Being positioned to view risk as either a plus or minus in the equation – everything could be different.
Until next time . . .