Risk management might be enjoying an unprecedented level of visibility in the wake of the financial crisis, but companies that take a genuinely strategic approach to their risk management remain few and far between.
They might acknowledge the importance of good strategic risk management, but a new report from the Economist Intelligence Unit reveals that most companies remain reluctant to make significant financial investment in their risk functions or to integrate risk management into the heart of their day-to-day activities and culture.
The report, Fall guys: Risk management in the front line, suggests that many companies have still not grasped strategic risk management. Senior executives regard the identification of new and emerging risks – such as weak demand and market volatility – as the key goal of risk management. But only around a third felt that their company is effective at anticipating and measuring emerging risks.
This problem is compounded by the fact that most companies fail to involve risk functions in key business decisions. Few companies even expect risk functions to play a support role in decision-making, with just four out of 10 saying they expect risk managers to provide analysis to help management set corporate strategy.
And instead of helping business managers to achieve their objectives, the bulk of the risk manager's job appears to be taken up with compliance, controls and monitoring.
"In the wake of the financial crisis, there were plenty of stories about risk managers whose legitimate concerns about the business were ignored and regarded as a brake on growth," said Iain Scott, senior editor at the Economist Intelligence Unit.
"Three years on, the incentive to ensure that there is a clear and consistent approach to managing risk across the enterprise has never been greater. But while strategic risks dominate companies' concerns about the year ahead, many clearly find it difficult to link risk management with overall company strategy. Often, the barriers to effective strategic risk management appear to be corporate culture and poor communication."
The report points to a lack of investment as another reason for this failure to integrate risk management into the strategic decision-making process. Despite its greater prominence, risk management has not generally attracted significant financial investment over the past year. In fact fewer than half of companies have invested in risk processes and fewer than a quarter have allocated funds to boost headcount or training of risk managers.
As result, there is a danger that the authority and importance of risk management will decline when the good times return – a danger that is exacerbated, the report argues, by a lack of risk expertise among non-executive directors who ought to be playing a crucial role in setting the tone from the top and instilling a broader culture of risk awareness in the business.
According to Andrew Kendrick, Chairman of ACE European Group, who sponsored the report, said that the risk management profession had arrived at a crossroads
"If it allows itself to be side-lined into the purely technical aspects of risk management and fails to take the steps necessary to engage colleagues and build a risk culture within their business, it will lose its relevance as better economic times return.
"If, on the other hand, risk managers concentrate on proving their worth as positive and proactive contributors and demonstrate that they can help their businesses take advantage of risk, they will strengthen their position. Ultimately this will not only secure their future as an invaluable corporate resource but will also help ensure the long-term success of their organisation."