What should organisations be looking at, if they want to integrate risk management principles into their business processes? One of the main aims of integrating risk management into the organisation’s business processes is to enable it to identify and address the risks which confront it at all levels. Achieving this requires proactive management of the firm’s resources, and high-level, professional management expertise. Additional benefits include waste reduction, increased efficiency and more sustainability and competitiveness overall, for the organisation.
Identifying business and environmental dynamics; tracking and monitoring
While the dynamics of the business and industry landscape have a substantial effect on the direction to take and will affect the risk posture of the firm, there are some basic risk management principles that do not change. For instance, one basic principle is that the organisation identifies what risks it faces, and tries to establish the odds of such events happening. The extent of how this could disrupt business objectives and performance, also has to be determined. It then develops mitigation plans based on the information available. All this requires the appropriate data, and skill sets that can analyse the information to support subsequent decision-making.
Putting risk management plans into effect also means establishing a context for the respective risks, and analysing what, where, when, why and how they may happen. Analysis, assessment and evaluation may run interatively and concurrently but risks are dynamic and can change fairly quickly in terms of intensity, severity and velocity. A comprehensive understanding of the organisation, its core business(es) and the environment in which it operates, is therefore critical. Risk managers will have to have broad horizons; they will need to keep a finger on the pulse of many industries, not just their own.
One of the most important parts of the integration process is risk monitoring and mitigation. Changes in the general business environment may have an impact that may not be obvious initially. But this may build up and start to affect the firm. Close monitoring will determine if there is a shortfall in the efficacy of existing risk management processes, and if realignment is necessary. By this time, the organisation will have determined how much risk it is willing to consider in the course of doing business, and would have set its risk appetite accordingly. It would also have evaluated its risks, and developed mitigation processes, risk prevention, risk manipulation and contingency plans.
Integration is for the long term
Risk management is a long-term activity; the risk management process should be regularly reviewed and updated. The process of integration should be similarly reviewed for effectiveness, and if it should be beefed up further. Feedback from stakeholders is important as integrating risk management principles into business processes involves both the physical work environment and stakeholder groups such as employees, shareholders and the wider community which may be affected by the organisation’s operations. The process of questioning and collection of data from several points should be an ongoing one.
Feedback is also a means of measurement; it indicates the level of understanding of risk management in the organisation. The information derived can be applied to improving risk management or aligning it for greater acceptability throughout the firm. Such information also helps risk managers better support the first line of defence within the organisation. Employees may thus be empowered, increasing their potential for more responsibility and greater accountability. It also heightens overall awareness that not all risk is bad; some may lead to opportunities that in turn could increase the value of the firm.
Improving transparency and governance
Among the many benefits of integrating risk management into business processes are improved transparency and governance. When risk management is properly applied, many processes become clear; doubt about “how things will turn out” is lessened. This has the effect of increasing confidence in the way the organisation is being managed as well as the ability and professionalism of its Board and management. Trust grows, as will the value of the company, as it becomes evident that the correct strategies, policies, frameworks and processes have been set in place.
Integrating risk management into business processes can sometimes be painfully slow, with many hiccups along the way. These can range from apathy, poor attitudes, having to operate with outdated technology, to human resources without the necessary skill sets. It is worth noting that although quality data is necessary to support the decision-making process, turning this data into usable information that will aid decision-making, can sometimes be a challenge. Applied correctly, however, it can be relevant and reliable, and help the organisation manipulate opportunities, anticipate changes and manage disruption.
Many companies have been able to avoid serious damage to finances and reputation, by having access to the right kind of information at the right time. Knowledge of a possible shortage of building materials, for instance, may spur a company to look for alternative suppliers so that they can carry on construction and deliver their products or project on time. Integration needs to be customised to the particular requirements of the organisation; hence the need to understand the firm in-depth – a must for risk managers.
They then need to draw the “big picture” for Board, management and staff, and demonstrate how it is do-able. Operational or market risk management is more often the focus, but communication builds a foundation; start the conversation so that everyone can move towards being on the same page. It does take time to build awareness of the need to integrate risk management principles and business processes, and put the structures in place to achieve it – but the results will be worth it.
