The future of risk - Protecting and enabling performance

The future of risk Protecting and enabling performance Contents Introduction .............................................................................. 1 The risk landscape is changing .................................................. 2 Maturing of risk management practices .................................... 4 Recognizing opportunities......................................................... 6 Focus areas for improvement .................................................... 8 An improved future state of risk ............................................. 10 Summary ................................................................................ 13 Survey approach ..................................................................... 14 Contacts ................................................................................. 16 Introduction Albeit painful, progress ultimately results from crisis. The Considering the events of the past 12 months, it is not surprising current downturn is causing companies to challenge their risk that 96% of our recent survey respondents believe that their risk management processes and ask how they can further improve management programs could be improved. Furthermore, only 1% their risk management efforts. Against this backdrop, we of companies intend to reduce their risk management resources. conducted a survey to provide a snapshot of the current risk Given the current cost-conscious mentality, the fact that nearly all environment and to understand organizational attitudes toward companies want to improve their risk management efforts and intend enterprise risk management. We were also interested in to maintain or increase their current levels of investment underscores understanding how recent events have impacted approaches to the growing awareness of the value of sound risk management. risk management and organizations’ abilities to identify and Moreover, 46% agreed that committing more resources to risk manage different types of risk. Never has there been a more management would help to create a competitive advantage. critical time to define a path forward for the “future of risk.” Clearly, organizations recognize the importance of risk We believe that the recent economic challenges were, in part, more management. Leading organizations acknowledge that risk difficult to predict and manage due to the increasing complexity of management is more than simply protecting existing assets; it is risk management processes. Over the past few decades, the number also about enabling performance to create future value. of risk management functions has grown to the point where most However, the reality is that most risk functions will be asked to do large companies have seven or more separate risk functions — not more with the same or limited additional resources. There is a counting their independent financial auditor. This has created strong drive to improve risk coverage through better use of existing inefficiencies and resulted in a degree of fatigue on the business. resources and to deliver more value from their respective As the number of risk functions increases, coordination becomes functions. The challenge for most organizations will be to find more difficult and often results in coverage gaps and overlapping increased efficiencies in the way their risk management functions responsibilities. The demands and various reporting requirements operate and define the improvements that create the greatest placed on the business by these risk functions can become significant value. We believe the answer to these challenges can be found by and burdensome. The number of risk functions and the various carefully considering how best to balance risk, cost and value communications from these functions can be a challenge for across the enterprise. Companies that effectively address this executives and the board of directors to manage and understand. challenge are more likely to outperform their competitors. As complexity has increased, so has company spending on risk management. Based on a previous survey we conducted last year of Fortune 1000 companies, we estimate that the average company spends about 4% of revenue on risk management activities. Risk Value We believe the answer to these challenges can be found by carefully considering how to balance risk, cost and value across the enterprise. Cost The future of risk: Protecting and enabling performance 1 The risk landscape is changing Risk management priorities continue to shift in the wake of global operational risks have increased. Very few organizations indicated economic challenges. Some organizations have been faced with a decrease in any of the four risk areas. Eighteen months ago, financial crisis. In response, they are intensifying efforts to manage few organizations would have placed financial risk at the top of costs and improve performance. Fifty-two percent of our respondents their list or anticipated that it would increase at the current pace. indicated that their financial risks have increased during the past The question organizations face now is, “Do our risk management 12 months; 42% said that strategic risk has increased; 40% believe efforts help us understand which risks will emerge in the next their compliance risks have increased; and 39% indicated their 12 months?” Over the past 12 months how has risk increased or decreased for your organization in the following risk areas? Overall financial risk 9 43 39 7 2 Overall strategic risk 4 38 46 12 Overall compliance risk 4 36 47 11 2 Overall operational risk 5 34 49 12 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% Significant Significant Increase No change Decrease increase decrease 2 The future of risk: Protecting and enabling performance Organizations have recently been criticized for their limited views comprehensive plan to identify and address all key risks across on possible sources of risk, their inability to anticipate the impact their organization. We also find it is common for companies to have of risks or their slowness to respond to risks. We asked respondents a higher level of confidence in their ability to effectively manage to indicate how effective their organizations are at managing each risk than their risk activities would suggest. of four key risk areas: financial, strategic, compliance and operational. Leading organizations have expanded the scope of their risk Respondents were more comfortable with their effectiveness in assessment efforts by scanning the broader business environment managing compliance and financial risks than they were with their to identify emerging risks. Through more comprehensive risk capabilities in managing strategic and operational risks. assessments, these organizations are examining their entire value We believe this reflects a historical focus on compliance and chain — including suppliers, customers, competitors, business financial risks, which we expected based on traditional investments partners and key stakeholders — to define emerging risks and in internal control and risk management. This is further validated identify opportunities.