The value of Risk Management

Dear all,

Thank you for a great discussion on the question about identifying and measuring the value of risk management and is it fit for purpose. As noted in the introduction these two questions, while being separate are in fact linked as if we cant show value then maybe we aren’t fit for purpose. This raises the two obvious questions

• What is value?
• What is purpose?

I think one clear conclusion about this discussion is that we needed more time and this will be considered for the next call in January.

So summarising the exchange:

• There was a general consensus that we are getting by with what we have currently but certainly aren’t capturing the full value RM can offer. RM seems to work (can work) fairly well for delivering on projects, lessening surprises, but it is a struggle to be engaged before and during decisions rather than just in the execution after. This highlighted the overlap between strategy and risk management where a project has clear targets and is basically risk management where as strategy has no such clear end point and therefore more grey. There is also a belief from customers /stakeholders that they do embed risk management but not in the way that we envisage raising the question what could be the possible gap between what management currently do and what can we offer as value? Risk managers will always have a “yes but…” and so what is the value of the “but..”
• In the emerging business world we will need to value the entire ecosystem of risk management.  ( https://en.wikipedia.org/wiki/Ecosystem_management) This poses a challenge as we currently cant value future value very well using the current economic models. Additionally, in the risk management world, the continued use of the 4 category approach (an example :- https://www.nibusinessinfo.co.uk/content/types-risk-your-business-faces ie strategy, finance, operational, compliance) raises certain elements to a higher level than others. This weight is changing with sustainability and ESG being now on the agenda and a possible review of hierarchy is required. This need to monitor value also needs to take into consideration the speed and velocity of risk and opportunity. We need to add value to the agility and adaptability part of organisations and be faster in responding. (In my terminology include acceleration, amplification and resistance to the calculation). This can help identify tipping points and help us differentiate ourselves from strategy. 
• What makes RM sparkle? we look broader and deeper but there is a large overlap with strategy. Basically, strategy looks at opportunities and RM looks at risk or that’s how it appears. This needs to change. If, as stated below, we need to help understand uncertainty but we currently do well in achieving project completion then the gap appears to be in defining the unknown. Meaning projects have a defined end point but strategy has none that is so clear as its dynamic. If we can help define the purpose, target more succinctly then would this help? If yes then is it about weak signals and timeline? 
• Linked to the idea of speed, velocity and agility is the time horizon under consideration. One aspect of value brought could be to clarify any mismatches between time horizons (e.g. 0.25-1 year for profit guidance, 3-5 years for current strategic plan, 7 year average CEO tenure, 40+- year company lifetime,…) 
• To get a seat at the table we need to highlight the gap that is currently there and then, if our boss is the CFO, highlight the need for change. (we cant be there and the CFO if they are our boss) As we move forwards there is a bigger need for more skill sets on the c-suit, same as we see on the board with constant change and skill sets being brought in. Is it cast in stone that only CEO, CFO and COO are permanent members and CIO, CTO, HR etc are invitees? If they are permanent also then where is sustainability? Who challenges the model? Is the real management structure a matrix or pyramid as it always appears that CEO,  CFO and COO have more weight. 
• What is our (RM function/profession’s) distinctive weapon/tool? (What's our sparkle?) It’s not specific elements of the RM toolkit but (I hope) our expertise in helping navigate uncertainty (as 2^nd line of defence), and (hopefully but not universally) our ability to play our “special card” to go to CEO and/or Board

Underlying it all was a feeling that many risk managers are not the right people for the job of risk management but are fit for the purpose that has been set for them.