If you were to ask senior management at a typical financial services firm where they would rank their risk function in terms of its importance to the business and its attractiveness to people who may want to work there, how would it fare, up against all the other component parts of the business?
Not well, I would suggest. I believe that – for the sake of the organisation’s well-being - it should be in the top three on both counts. Yet I guess that, typically, it won’t even be close.
That’s a sorry state of affairs, especially as I think there is so much scope for turning risk management from a cost centre into a value creator; if handled with a bit more care.
First things first though; I fear that risk management is struggling to do what it needs to do because its processes were designed to be inflexible and its current structure is the by-product of a far more settled set of economic circumstances.
Such a steady state no longer exists. Businesses have changed but risk management processes have not. As a result, risk management now needs to adapt to become more flexible and commercial. It needs to evolve from something that was fit-for-purpose once upon a (distant) time.
Change creates risk (and there is plenty of change in the air at the moment) yet a strong risk management culture can be a pillar of stability in such times. If more importance was ascribed to creating an appropriate culture of risk, then I think that we would begin to appreciate how risk management is part of everyone’s role, not just the dedicated function.
Increasingly, I think that best practice risk management within financial services may entail only a small, efficient risk function – but with the right culture and risk management processes embedded throughout the organisation in everyone’s role, not just in the risk function.
We could probably learn a lot from the manufacturing sector and apply lean principles to the aggregation of processes within risk management. Manufacturers view potential product defects as a risk which is everyone’s responsibility, not a single employee’s.
Returning to our sector, if risk management is to change, it needs to attract more dynamic and commercially minded people. Current incumbents are, typically, fantastic technicians but we can no longer rely on technical expertise alone. Broader business experience and problem solving capabilities will be paramount in coping with today’s shifting risk landscape.
So where does the scope exist for turning risk management into more of a value creating competency? Well, once processes evolve and more commercially minded people are in place, I believe that risk management needs to become a core behaviour and therefore naturally be a part of the commercial decision-making within the business.
This is where risk management needs to find its own distinct point of view and voice; a voice which is challenging – but not just for the sake of being challenging. That voice needs to be properly independent and commercial, espousing value-based judgements, not just process-driven judgements.
Upon hearing that voice more clearly, what needs to follow is an acknowledgement that there is plenty of scope for creating value through making better, more risk-aware judgement calls.
The idea of the risk function being distant from that commercial core now appears anachronistic. After all, actual risks arise within the business, not within the risk function.
Plus, the days of single risk events are behind us. In our more connected world, one risk event can create a domino effect of other risk events. Think of Super-storm Sandy’s knock-on effect in terms of shutting down the New York Stock Exchange and how that affected businesses thousands of miles from the storm as a recent prime example.
In the midst of all this, poor decision making which arises from ignorance around risk is potentially crippling. If that sounds like scare-mongering, remember that the reverse is also true: that sound decision making based on an absolute understanding of the risks in play can be value creating.
Much of the problem here is that few yet know what good looks like in this regard. What I know for sure is that what we currently have in many cases is not that great.
The financial services sector has gone through so much change in the past decade and the next challenge is arguably one of the most difficult. If management can ascribe the risk function the top three ranking I feel it deserves, the changes to process, culture, personnel and decision making will come – and that’s when risk management will be transformed from a cost centre into a value creator.
Michael Crawford is Head of Insurance Risk & Capital at KPMG in the UK
This article represents the views of the author only, and does not necessarily represent the views or professional advice of KPMG in the UK.