Turning risk into results

Senior executives advised to apply a broad ‘risk lens’ to the businesses

From Enron and WorldCom to the more recent financial crisis, events of the last decade have fundamentally shifted how organizations think about risk. Companies around the world have made substantial investments in personnel, processes and technology to help mitigate and control business risk.

Historically, these risk investments have focused primarily on financial controls and regulatory compliance. However, these investments have often not addressed more strategic business risk areas. As a result, senior executives may not perceive risk management as strategic to the enterprise.

Senior executives also may not have sufficient confidence in their ability to identify and address the risks that could impact the financial performance ― or even the viability ― of their organization.

A strategic question presents itself: ``Do organizations with more mature risk management practices outperform their peers financially?’’ And Ernst & Young’s research and experience tend to suggest: ``Yes!’’

Fueling financial performance

In its latest thought leadership publication, ``Turning risk into results,’’ Ernst & Young has identified that the level of risk investment can impact on the financial performance of an organization.

The study identified that companies in the top 20 percent of risk maturity, where maturity was defined by the number of risk management practices applied, generate three times the level of Earnings Before Interest, Taxes, Depreciation and Amortization (EBITDA) as those in the bottom 20 percent.

Previously, senior executives may not have perceived risk management as strategic to the enterprise, or lacked sufficient confidence in their ability to identify and address the risks that could impact the financial performance, or even the viability, of their organization. This is no longer an option.

``Making a move from being risk-averse to risk-ready may require a significant shift,’’ Ernst & Young Advisory Global Risk Leader Randall Miller says, commenting on the findings. ``It is about changing the lens through which leaders view the decisions they make.’’

Using a global, quantitative survey, based on 576 interviews with companies from sixteen countries and information from 2,750 analyst and company reports, the study assessed the maturity level of risk management practices versus financial performance.

The study identified the leading risk management practices that differentiated the various maturity levels, and organized them into specific risk components. The results revealed that while most organizations perform the basic elements of risk management, top performers do more; and certain risk practices were consistently present in the top performers:

• Enhance risk strategy:

For effective strategy and governance, proper oversight and accountability at the board and executive levels is critical. Ownership of risk throughout the organization is also needed and at the management level, executives play a crucial role in assessing and managing risk.

• Embed risk management:

Organizations that embed risk management practices into business planning and performance management are more likely to achieve strategic and operational objectives. Conducting an enterprise risk assessment can help to prioritize and identify opportunities for improvement.

• Optimize risk management functions:

By aligning and coordinating risk activities across all risk and compliance functions, organizations can reduce their risk burden (overlap and redundancy), lower their total costs, expand coverage and drive efficiency.

• Improve controls and processes:

By optimizing controls around key business processes, harnessing automated versus manual controls and continuously monitoring critical controls and key performance indicators by leveraging Governance, Risk management and Compliance (GRC) software tools, organizations can improve performance and reduce the cost of controls spend.

• Enable risk management, communicate risk coverage:

Moving an organization from being risk-averse to risk-ready requires executives who lead by example and tone-from-the-top support. For maximum benefit, regular and open communication with all stakeholders, third-party assurance and the leveraging of technology are required.

Ernst & Young Advisory Global IT Risk and Assurance Leader Paul van Kessel concludes: ``Companies that succeed in turning risk into results will create competitive advantage through more efficient deployment of scarce resources, better decision-making and reduced exposure to negative events. Now is the time for senior business executives to begin applying a broad `risk lens’ to the business.’’

This article was contributed by Ernst & Young.