RISK MANAGEMENT TAKING A BACKSEAT

       The global financial crisis has prompted a wholesale re-evaluation of risk management. But while companies admit that major change is needed, a significant proportion is unwilling, or unable, to make the necessary enhancements.
       A report published today: "Beyond Box-ticking: A new era for risk governance," written by the Economist Intelligence Unit and sponsored by ACE and KPMG, finds that a lack of financial resources will be the biggest barrier to effective risk management in the year ahead.
       Companies everywhere are conserving cash, cutting headcount and reining in expenditure. The report finds that risk functions are no exception, with the result that important improvements to risk management are pushed to the sideline.
       Asked about the biggest barriers to effective risk management in their organisations, the 364 risk professionals from around the world questioned for this study point to poor data quality, inadequate technology and a lack of expertise. But rather than tackling these issues, risk professionals say they are more likely to concentrate on process improvements and training.
       This suggests that, rather than addressing the key risk management issues, which also carry the biggest price tag, companies are instead opting for some quick wins, and trying to do more with less. While this will have some limited impact the underlying problems with risk management are likely to remain.
       "Companies are facing a difficult dilemma in the current environment," says Rob Mitchell, editor of the report. "On the one hand, they recognise the need to allocate greater time and resources to risk management so that serious short-comings with their current approach can be addressed. But, on the other hand, they are facing huge pressures to keep costs under control.
       Satisfying these competing objectives poses something of a conundrum, and this could prevent necessary fixes to risk management from being made."
       Oliver Engels, head of enterprise risk management Europe for KPMG, said that linking risk management to decision-making in the boardroom will be vital for further success.
       "This will require more knowledge of the risk appetite, the risk profile and the control environment compared with the past," he says.
       Andrew Kendrick, chairman and CEO of ACE European Group, adds that the survey reveals the potential disconnect between business strategy and risk management.
       "Senior management from board level down must place a greater emphasis on establishing a pervasive and robust risk culture or face the impact and consequences at every level of the organisation," he says.
       Other key findings from the research include the following:
       A lack of risk expertise at the top of companies is making it difficult to build a strong risk culture. More than half of respondents say they have no plans to recruit a chief risk officer, and slightly fewer than half say they do not intend to recruit a borad-level executive with overall responsibility for risk management.
       With a high proportion of respondents saying that a "risk culture" depends on strong direction from the top of the organisation, an absence of expertise at board level suggests that many companies will find it difficult to embed a greater awareness and understanding of risk in their business.
       Compliance, controls and monitoring are consuming a disproportionate amount of time and resources.
       Respondents point to the identification of new risks as the most important role and responsibility of risk management. But, asked how they allocate their time, it is compliance, controls and monitoring that consume the lion's share of their resources.
       With a disproportionate amount of time being spent on the more mechanical aspects of the role, risk managers may be neglecting the responsibilities they have identified as being most important.
       More needs to be done to ensure that risk information is finding its audience.
       Only around one-third of respondents think their organisation is effective at ensuring information about risk is reaching the right people.
       There is also limited confidence in the quality of risk reporting: only 30 per cent think it provides information that is tailored to its audience.
       Better risk reporting will depend on improved communication and understanding between risk functions and their intended audience. Only then can information be provided that is relevant, timely and pitched at an appropriate technical level.
       There is a window of opportunity for chief risk officers to take on a more strategic role.
       In the majority of companies questioined for the research, chief risk officers play on role in major strategic initiatives: just 44 per cent are actively involved in merger and acquisition (M&A) activity, for example, and just 36 per cent in product development.
       Yet, at a time when risk is dominating boardroom agendas, there is a rare and valuable opportunity for senior risk professionals to take a seat at the top table, and to make themselves an indispensable part of any discussion about the future of the business.