Achieving integrated risk management

Performance-driven risk management is a key characteristic of some of the world’s most successful companies. Integrated risk management is an essential step in achieving performance-driven risk management.

In general, the more integrated an organization’s approach to risk management, the more tightly it will align risk management to strategic goals and high performance. In addition, integrating risk management enables an organization to:

• Reduce its exposure to unidentified, unmeasured or unmanaged risks
• Allocate more resources to critical risks and fewer to less important ones
• Minimize inefficiencies generated by overlapping or incomplete solutions
• Control the cost of governance, risk management and compliance (GRC)
• Address emerging and evolving risks—and regulatory mandates—more effectively
• Achieve competitive advantage and generate greater value

Of course, managing compliance efficiently, preventing losses and maintaining appropriate insurance remain key risk management activities. Yet risks—and gains to be realized by navigating risks—have risen to a point where more integrated approaches are necessary.

Few organizations have gotten there. Grant Thornton’s 2017 CFO Survey found that only 14 percent of respondents completely agree that their risk management program is integrated across business functions. Nearly a decade after the global financial crisis exposed the interrelatedness of risks, risk management often remains fragmented.

Integrated risk management is still misunderstood. Some organizations see it as combined compliance and risk management functions. Others approach it as connecting risk related systems and tools or as placing all risk-related activities under one executive. But those definitions are too narrow and fail to make a positive case for integrated risk management. That positive case stems from the many opportunities to drive higher performance that risks present when they’re properly managed.

Identifying the pieces

In practice, truly integrated risk management will:

• Identify and assess all risks. An intense focus on narrowly defined risks can obscure management’s view of the full range of risks to assets and processes. An integrated approach identifies, assesses and addresses all risks to the organization, particularly risks that could undermine performance.
• Recognize the interrelatedness of risks. As the financial crisis and several highly public incidents since then have shown, a single risk event can trigger or amplify other risks. An integrated approach recognizes dynamic relations among risks and potential knock-on effects of risk events.
• Align risk management with the business strategy. Integrated risk management begins at the highest levels— aligning risk management with the organization’s value proposition and business strategy. Grant Thornton research shows that executives rate strategic risks more important among general risks, yet rate their monitoring and mitigation of them the lowest.
• Enhance cyber risk management. Technology is integral to every business activity. This creates exposures not only from cybercrime, but also from external innovations, bad bets on technology and failure to adopt. An integrated approach coordinates management of all cyber risks across the organization.
• Establish risk-related infrastructure. Integration means going beyond risk-specific solutions (which have their place) to strengthen risk management and governance structures. This calls for clear roles and accountabilities for risk and well understood risk appetite, tolerances and responses.
• Apply advanced analytics. Organizations generate massive internal data and can access unlimited external data. Yet most fail to capture, analyze and act upon all relevant data. An integrated approach proactively uses data to increase visibility into risks and enhance risk management.
• Optimize resource allocations. Companies tend to overinvest in some risk-related areas and underinvest in others, particularly when they lack data-driven approaches to risk. An integrated approach optimizes allocation of risk management resources. The above steps support business strategies, enhance efficiency, reduce risks and accelerate responses to risk events. When implemented together, these activities drive higher performance.

The above steps support business strategies, enhance efficiency, reduce risks and accelerate responses to risk events. When implemented together, these activities drive higher performance. This is not integrating risk management for its own sake but to protect and generate value and boost performance.

Relatively few companies rate themselves highly on integrated risk management: Grant Thornton’s 2016 GRC survey found that only 7 percent of respondents rated their governance, risk management, and compliance as “value-adding” and “integrated” while 22 percent rated theirs as “integrated” with “some value adding activities.” That 7 percent is the cutting edge, with the 22 percent close behind. However, that leaves some 70 percent racing to catch up.

Risks are becoming even more pervasive, multifaceted and dynamic. This partly explains why risk management has become so fragmented. In trying to address myriad risks, many companies purchase tools and implement solutions without proper coordination and governance. In addition, focusing mainly on loss prevention can cause an organization to miss opportunities to drive performance by understanding which risks to take and how to mitigate them.

Problems arise whenever management has been scrambling to respond to rapid change. Yet the pace of change is not about to slow down, which is why integrating risk management has become so important. It’s a proven method of consolidating gains, rationalizing solutions and pursuing growth. Given the risk landscape, now would be a good time to integrate risk management across your organization.

Source: Grant Thornton library articles

We are committed to keep you updated of all developments that may affect the way you do business in Puerto Rico.
Please contact us for assistance in relation to this or any other matter, we will be glad to assist you.