Ten questions every board should ask itself about risk management

Risk management has become a cornerstone of a board’s duties in the early 21st century. There are many explanations for this, including the lessons of the global financial crisis, ever-intensifying regulatory pressure and the need to navigate a business landscape increasingly defined by mounting complexity and rapid change.

What companies require from this exercise is a strong, informed, top-down sense of direction. This is especially valuable at a time when the most successful enterprises are characterised by a commitment to innovation and entrepreneurship and when firms are required to be more fleet-footed and flexible than ever before.

Yet the reality is that many businesses equate risk management with risk aversion. In other words, they habitually frame risk purely in terms of threats rather than in terms of opportunities. This much is clear from our recent research, which involved interviewing dozens of board members in the UK to build a rich picture of boardroom-level risk management in an age of unprecedented technological disruption, breakneck transformation, relentless churn and “creative destruction”.

It could be argued that a propensity to default to the “safe” option makes a lot of sense in such challenging circumstances. After all, why shouldn’t a board strive to deliver as much certainty as possible when uncertainty is raging all around? Why not seek solace in a conservative outlook when chaos seemingly abounds? To employ a well-worn phrase: what could go wrong?

The perils of playing too safe

 The problem is that certainty and conservatism can have a price. This is because they ignore the risk-management process’s ability to aid corporate performance. What many boards seem to have overlooked – or have chosen to forget – is that good risk management is as much about generating gains as it is about avoiding losses.

Moreover, taking no risk whatsoever frequently constitutes the biggest risk of all. The history of business contains many tragic illustrations of this fact – chief among them the sorry saga of Kodak, which invented digital photography, spectacularly failed to capitalise on it and was eventually killed by it.

According to our research, several factors fuel boards’ proclivity to play safe. These include insufficient time, a tendency to concentrate too much on the past and too little on the future, organisational complication and – perhaps most worryingly of all – a suspicion that criticism and dissent aren’t welcome in the boardroom.

Another major reason why many boards don’t regard risk management as a business enabler is the perception that this is just another box that needs ticking to keep regulators and compliance departments quiet. Such a mindset virtually guarantees that any hope of blue-sky thinking is strangled by the perceived spectre of red tape.

Benchmarking your board

 So what steps might boards take with a view to striking a healthier balance between attempts to create certainty and attempts to create value for their organisations and stakeholders? What changes could they make to prevent slipping ever further behind competitors whose risk-management strategies are more innovative and entrepreneurial?

We propose a number of measures, including greater board diversity, a less “backward-looking” focus, a broader array of perspectives and the appointment of “critical friends” who aren’t afraid to voice the contrarian opinions that many board members seemingly think is best left unaired. First and foremost, though, we recommend that board members ask themselves a few searching questions…

1. How often does your board review and enhance its risk-management activities?
2. Does your board consider from the outset the risk implications of different strategic options?
3. What are the strengths and weaknesses associated with your board’s position?
4. How do you review and address any gaps in the diversity of risk intelligence, skills, knowledge, experience, education and training across your board?
5. How often and in what circumstances do you consider the composition of your board?
6. Do you create a “safe zone” atmosphere for the discussion of risk-management issues and are board members encouraged to challenge the status quo?
7. Are board members and non-executives in particular encouraged to get out into your organisation and understand its people and culture?
8. Do non-executives act as a critical friend for your executive and wider senior management team, helping them to exploit opportunities and avoid downside losses?
9. How much time do you devote to risk management at board meetings?
10. How effective are your board’s sub-committees in enabling you to focus on strategic risk-management issues?

These questions may offer a useful starting point for any board that feels its risk management could be improved. We believe they provide a helpful benchmark for efforts to identify areas where existing approaches might be less than optimal. Try answering them and see if you feel your own board’s philosophy could be somehow lacking, ripe for enhancement or, worst of all, ill suited to the myriad demands of today’s business world.

Author

Dr Cormac Bryce is a member of the Centre for Risk, Banking and Financial Services and the Centre for Research in Behavioural Sciences at Nottingham University Business School. The report discussed here, ‘Risk and Performance: Future-Proofing the Board’, was co-authored with Dr Simon Ashby, of the University of Plymouth, and Dr Patrick Ring, of Glasgow Caledonian University, and is available for download from the ACCA website – please visit http://www.accaglobal.com/uk/en.html.

Dr Cormac Bryce