Increasingriskintelligence

 Risk management systems and processes need to be highly automated, strategic, and transparent, people can see what the outcome will look like throughout the risk management process.

In business, every day is a risk, generic risk management includes how organizations manage economic, legal, political, social and human risks, and how to build up business resilience. 

Enterprise wide risk management intends to manage enterprise risk systematically and effectively; risk management permeates across organizations and should not be a separate function at all, but rather taken as guidelines of business best-practices executed in this larger portfolio management to improve organizational effectiveness and maturity.

The discipline of integrating risk management into the everyday business model helps to move you a couple of steps forward in business excellence: Under enterprise risk management, people look at the things they essentially do not want to happen. Risk management needs to be integrated into multiple management disciplines such as strategy management, performance management, change management, information technology management, culture management, etc. For leading organizations, corporate risk management is already an integral competency and top priority for C-Suite executives, providing them a holistic process for connecting the dots on risk across the organizations for achieving the vision and mission of the company.

Often a big risk is that the risk management system is detached from the real management of the business. Risk management is very useful for achieving business results. In a sense, if the business cannot manage risk effectively, then all the good work done by it so far can be tarnished by a silly mistake which can turn out to be a costly affair. On the other hand, it's a bit of a paradox really if the organization gets obsessed by risk and ongoing governance, organizational management needs to overcome change inertia. Technically, the most time-consuming part of a risk management professionals job is gathering, identifying, cleaning and then assessing data; determining the ROA on risk management programs should enable the reduction in the "preliminary" risk work and an increase in actual risk management actions.

Embed risk management into business process management: To survive and thrive for the long term, organizations should deal with different types of risks skillfully and grasp business opportunities timely. It’s important to integrate risk into investment prioritization and planning processes to improve strategy management effectiveness. The robust process means that there's risk management embedded into the process, to make the process and business as a whole more resilient. Robustness takes more than a single process owner, everyone has a vested interest, it usually means the whole organization and not some silo or functional entity either.

It was always about discipline, consistency and streamlining your processes to ensure you have right risk management controls, and there's always a "known element" in what you do, and over a period of time, enterprise risks management program would be making continuous improvement based on the feedback from the risk management process and what would be left is what is unknown. Assume that in any risk management program, all the known and potential risks would have been covered and managed, and over a period of time, you are able to manage uncertainty and avoid the business pitfalls on the way.

The risk management needs to lift up from risk control to risk intelligence, manage risks and opportunities smoothly: Often, risk and reward are proportional. Every risk has opportunities in it; every opportunity has hidden risk and potential pitfalls. The enterprise risk management has to be expanded into enterprise opportunity management. Statistically, the majority of today's business value is based on their ability to embrace complexity, identify the potential business growth opportunities, understand the future, opportunities, roadblocks, decide which one to go after and which one they will not go after and clearly articulate forward the way value will be created.

The premise of trying to quantify the value in a monetary sense is only relevant to the extent you want to evaluate options to mitigate the identified risk. It’s very important for any high performing organization to leverage the systematic understanding of risk management, make better alignment of resources, process, talents to improve risk intelligence. By understanding the business value of risk management holistically, the approach to manage risk is to look at the effectiveness of the risk management strategy, not just its financial value, capture growth opportunities and unleash the full potential of the company. For an organization embarking on a GRC journey, there is a growing number of organizations shifting their risk management orientation from bottom-up to top-down, with more senior management and board involvement, to take charge of the risk evaluation and management.

Risk management systems and processes need to be highly automated, strategic, and transparent, people can see what the outcome will look like throughout the risk management process, and then, there should be a consideration for a balanced scorecard that measures the progress of the goals you want to achieve for improving overall business effectiveness and maturity.

Posted in: Business Intelligence,GRC