Business Value of Risk Management

You cannot be managing risk, or for that matter, build a risk management capability without first understanding the "business value of risk management."

Digital brings unprecedented opportunity and risk for organization today, it becomes one of the significant management disciplines to deal with them effectively. What is the business value of risk management in tangible terms? What is the bottom line impact of risk management, specifically enterprise and operational risk? What real, tangible value does enterprise and operational risk management frameworks and processes really bring?

In-depth understanding about business value of risk management: Quite simply, you cannot be managing risk, or for that matter, build a risk management process without first understanding the "business value of risk management." Since there are numerous value propositions, it’s the ones selected that influence how risk management gets done. The value could be in better management decisions, improved operations, greater resilience, improved reputation, increased confidence in management, etc. Risk management is very useful for achieving the business results. In a sense, if the business does not use it, then all the good work done by it so far can be tarnished by a silly mistake which can turn out to be a costly affair. So programs carried out in field should be able to achieve highly tangible benefit.

Integrating risk management into operation management: The discipline factor of integrating risk management into the everyday business model helps to move the organization a couple of steps forward in business excellence. But, as always, the challenge of managing human change and adoption is tough, and those firms that can accomplish this feat will have the ability to tackle other challenges. It is important to identify vulnerability in the control (via risk assessment, after action, or table top) and determine the potential range of consequences ($, business interruption, reputation, etc.). Estimating the threshold of loss potential vs. testing for capability of detection and response makes for a key measure of control effectiveness.

Regarding internal control systems, the key controls in the organization address multiple risks at the same time for practicability reasons. The controls help bring the risks down to an acceptable level. It is worthwhile looking at the Internal Controls and mapping them back to your risks. If you find that you can't map a particular control to a risk, then you should question the purpose of the control. There should be a many-to-many relationship with the risks and the controls. One control will be linked to many risks. And one risk will be linked to many controls. You can increase the sophistication of the model by weighting the controls, allowing to give greater or lesser importance to a particular control’s effects on the management of the risk. Controls are not free-floating agents across the process; they are there to serve a purpose which is to ensure that the process operates in a desired way or to let us know when it isn’t. The controls need to manage the risks inherent within the process. When look at the Risk - Control relationship, you need to remember that they are independent variables working together.

By understanding the business value of risk management, the approach to manage risk is to look at the effectiveness of the risk management strategy, not just its financial value, the premise of trying to quantify this value in a monetary sense is only relevant to the extent you want to evaluate options to mitigate the identified risk. Quantifying the benefit in monetary terms will then assist in an NPV calculation of the benefit-cost of alternative actions. The reason you implement a risk management strategy (from risk mitigation to risk intelligence) is to manage the risk and opportunity as well. If the focus is just on assessing financial value or cost, the broader strategic risks will never be properly addressed! Hence, risk management is not just a tactical task or practice, but a core business capability to run today's overcomplex businesses.

Posted in: GRC