“We manage risk so that we can grasp opportunity,” stated Ramesh Pillai, IERP® Chairman, at the start of a recent Institute Tea Talk, held online. The subject of the Talk was how risk professionals could consider opportunity when simultaneously managing risk. “There are hazards and threats to risks but opportunities in tandem. We apply ERM to grasp opportunities along the way.” He cautioned, however, that in order to succeed, businesses have to “dare to fail” and if they have to fail, they should fail fast. “Fail hard! – but recover fast,” he added.
To seize opportunities, risk has to be managed; and with ERM, there is a return on risk – so the controlling of risk, i.e., risk management, is one of the main tasks when running a business. “ERM is about creating a balance between risk and reward,” Ramesh continued, stressing that there was a need to go beyond mindset restrictions when it comes to viewing risks as hazards. The organisation itself needs to be motivated and able to innovate, and must realise that the management or handling of risk hazards is, in effect, risk management.
The word “risk” carries negative connotations, but risk does not always have negative results – although risk itself should never be taken lightly. For most businesses, the major challenge with regards to recognising opportunity in risk lies in being able to identify and manipulate the upside of the risks which confront them. They need to find ways of managing risk because the opportunities connected with risk become more obvious in the course of mitigation. Hazards may turn into opportunities, and the organisation may find leverage through first mover advantage.
Citing some examples of risk – social, human resources, innovation and business continuity – Ramesh said that risks need to be properly identified before they could be appropriately manipulated to access the opportunity within. He urged risk professionals to identify and leverage on opportunities as part of their ERM programme. There was a need for a good risk management function for this to be effective, and to develop the ability to see risk and opportunities simultaneously. “This allows for flexibility, and for value protection and creation,” he said. “A change in mindset is critical, to help the organisation benefit from the opportunities offered by risk.”
Because risk management is not exclusively about managing the downside of risk but also about manipulating its upside, risk professionals need to have the capability of analysing opportunities. For this, they should use available standards. Organisations which successfully identify and leverage on such opportunities to create value for themselves, or “ambidextrous organisations” usually have systems which identify, manage, measure and monitor both risks and opportunities. While having such systems are necessary, organisations also need to have appropriate strategies.
Depending on their risk appetite, they may choose a “Play To Win” or “Play Not To Lose” strategy. Companies which decide on a Play To Win (PTW) strategy usually adopt an aggressive course of action that includes upgrading their technology or innovative capabilities so that the competition finds it hard to keep up. Risks are taken but are effectively managed; their risk management strategy usually drives their innovative capabilities. Their decisions have the effect of creating value for the company. However, in some environments, there is no need for aggressive strategies.
Firms may take a less aggressive approach – the “Play Not To Lose” (PNTL) option – and choose to preserve their value as a defensive strategy, although this is not as effective as PTW and cannot be sustained over the long term. “If companies have been doing robust ERM and have been preparing to the best of their abilities, there are a lot of opportunities to be had,” Ramesh reiterated. The important thing when applying either PTW or PNTL is to have formal systems of analysis to support risk management, while identifying and capitalising on opportunities.
Detailing the risk and opportunity management process, he pointed out that it actually builds on the risk management process by including tools and methods that, when correctly applied, can improve decision-making. “The opportunity eventuates in the way the risk is managed,” he stressed. Presenting several examples of how firms can turn risks into opportunities, he said that accurately identifying risks was crucial to identifying opportunities. “You cannot manage opportunities if you don’t manage your risks.”
Citing an example of how identifying supply chain risks could be turned into an opportunity to cut the cost of materials for instance, he remarked that bulk-buying from fewer suppliers could result in more favourable terms, as opposed to smaller purchases from a wider range of suppliers, which could turn out to be more expensive. In an example of how the risk of losing customers could be turned into the opportunity of increasing profits, he briefly discussed how a product makeover that changes a dated product design, or the use of different material could reposition it as a premium item, making it more sustainable over the long term, in a niche market.
Applying automation to processes required by regulatory compliance cuts the risk of non-compliance, especially when an organisation has subsidiaries in many jurisdictions, and compliance is complicated. The opportunity here arises when regulatory compliance assessment can be standardised across the organisation. It makes auditing easier, and can reduce audit time and costs, while increasing auditors’ productivity. Even the risk of overexposure on social media can be turned to an organisation’s advantage if it understands how to identify trends and issues that are potential risk areas. This helps in the management of reputational risk
Effective management of social media also creates a better understanding of the concerns of its competitors and stakeholders. “First to market is good but second to market allows improvements to be made to the product,” Ramesh said. “Value can be created.” Emerging risks could also be identified, allowing the firm to put mitigative measures in place. Reiterating that firms cannot manage opportunities if they do not first manage their risks, he said the right processes need to be in place but cautioned against adhering stringently to these, as this could give rise to risks as well. “Risk managers need to be good at managing business too,” he concluded. “Risk management is also about analysing risks for potential opportunities which will ultimately benefit the organisation.”
