Align your risk appetite

We know that our individual responses to risk are shaped by our emotions. Is the same true for organizations?

The challenge for organizations is alignment. The culture of an organization shapes the organization’s “risk appetite” and its response to risk. That is decided by senior management with influence from the wider ecosystem, such as their customers or industry regulators. But it’s the actions of key individuals in the organization that shape the behavior of the company, and they may have a very different risk appetite. We’ve seen that happen in the banking sector, where risky actions by one individual can lead to significant financial losses.

How can organizations ensure that all their staff manage risks appropriately?

Good risk management should be integrated into an organization’s management systems. We call that enterprise risk management (ERM). Individuals work on projects or within departments, but the organization is interconnected, and the ERM system needs to account for that. For example, a single project in an organization might adopt a certain approach to manage the risks associated with a supplier. The approach might be very different if the same supplier provides critical parts for a dozen other projects across the business.

Organizations face a lot of scrutiny from governments, the public and other external stakeholders. Should they do a better job of communicating their approach to risk?

Transparency is fundamental to strong risk management. Some of the best examples of that come from the safety critical industries, like aerospace and the nuclear and chemicals sectors. These industries have rigorous processes and a culture where they continually try to learn from mistakes and share those lessons so that they are not repeated. Aerospace companies share details of incidents and accidents in public reports, for example, so the whole industry can benefit from the lessons learned. Other industries, such as the financial services sector, could consider following this example.

What role do new technologies have to play in effective risk management?

Technologies come with their own risks, such as increased susceptibility to cyber-attacks. But they can also be an enabler of better risk management. At its heart, risk management is about decisions. Digital technologies give you better data, and better tools to turn that data into information that supports effective decision-making.

What advice would you give to a CEO who wanted to improve risk management in their organization?

I would say, never forget that risk management is about people and culture. If the people in the organization don’t recognize that understanding and managing risk is an integral part of the decision-making process, then the organization will only ever pay lip service to risk management. Companies should establish a dedicated risk management office, with expert facilitators, coordinators, mentors and managers, whose job it is to help those in the rest of the organization develop the skills and culture they need to manage the risks they face.