Taking Risk Management seriously

As featured in Information Age, Risk & Compliance Magazine, and netimperative.com

There’s no doubt that risk management has become a primary consideration for meeting corporate governance objectives in recent years. Increasingly, investors and regulators expect business leaders to identify the principal risks to the business, articulate how these risks are measured and managed, and explain how their strategy aligns with the organization’s culture and appetite for risk. Adding value is fundamental to business success, but any attempt to create value also brings the risk of miscalculation—and this is where many businesses fail. Failure often stems from an inability to understand the risks they face or to manage these risks effectively. Put simply, effective risk management is essential for long-term success.

Yet businesses face the same challenge worldwide. Continuous change, coupled with new technology, new markets, and increased competition, has raised both the rate at which these threats emerge and their potential impact. Unfortunately, most American businesses remain poorly positioned to comply with new standards. Back in September, Deloitte reported: “For the majority of businesses, especially those in less regulated industries… the adoption of these changes will represent a significant challenge.” Fast-forward a year, and Deloitte found that “many [organizations] do not yet have a risk process in place that goes sufficiently beyond the identification of principal risks. The detailed work required to really understand these risks, how they are being mitigated and monitored, and whether the risk profile is changing, is often either absent or currently happening in an uncoordinated way… there is also limited integration of the risk management process into key business planning and decision-making processes.”

What does the FRC’s UK Corporate Governance Code entail?

Previously, the UK Corporate Governance Code stated that the board of directors is responsible for maintaining sound risk management and internal control systems, which should be reviewed at least once a year. The updated code goes significantly further:

• Assessment of principal risks: Directors must carry out a robust assessment of the principal risks facing the company, including those that threaten its business model, future performance, solvency, or liquidity. They should also describe these risks and explain how they are being managed or mitigated.
• Monitoring of risk management and control systems: The board should monitor the company’s risk management and internal control systems, reviewing their effectiveness at least once a year. This monitoring and review should cover all material controls, including financial, operational, and compliance controls.

Essentially, directors of any company wishing to comply with the code must implement a single, comprehensive process for risk identification and management, which is continually monitored and regularly reviewed. Furthermore, they must explain what actions have been taken to address any identified failings or vulnerabilities.

Meanwhile, updated auditing standards require external auditors to state whether they have anything to add to the board’s statements on principal risks and the results of their reviews. This means that internal controls, monitoring tools, and reporting structures must be clearly evidenced or demonstrated to satisfy auditors that adequate measures are being taken.

While companies with a premium listing on the London Stock Exchange are subject to the code, it nonetheless represents best business practice. Consequently, it is reasonable to expect that a more comprehensive and integrated approach to risk management will come to be regarded as the standard for well-run companies.

What should forward-thinking businesses do?

There is no off-the-shelf solution to this problem. Technology, people, and processes must be considered in equal measure. From a technology perspective, solutions like those offered by CoreStream GRC provide a platform for centralizing risk management across the organization, along with a range of sophisticated tools that support the maintenance and review of risk registers. This brings several benefits:

• Integration of risks with controls: Risks can be linked to internal controls, mitigating action plans, policies, and processes, enabling the company to demonstrate what measures are in place to manage or mitigate risk.
• Automated reviews: Periodic or recurring reviews of risks and controls can be initiated automatically, ensuring that the system is properly maintained and regularly updated.
• Streamlined reporting: With all content in one place, reporting is automated and efficient. Real-time reports make it straightforward to identify issues that need attention and to determine whether specific risks or risk types are causing concern across the business. It also helps solve the data problem.

Remember: technology is an enabler, not a solution. Poor risk management is primarily a matter of people and processes, and acquiring new tools alone won’t change this. However, once underlying problems are addressed, technology allows risk management to be more coherent, efficient, and less burdensome.

An opportunity for improvement

At the end of the day, the FRC’s updated standards provide an opportunity for businesses to improve. Embedding risk management within the organization and ensuring that it is integral to planning and decision-making processes simply makes good business sense. It focuses business leaders on the company’s core, value-adding operations and encourages them to address risk proactively. This approach produces better-quality, more timely management information, which, in turn, leads to better business decisions and an organization that is both more cohesive and far more responsive to change.

FAQ for risk management

What is the importance of risk management in corporate governance?
Risk management is critical in corporate governance because it enables businesses to identify and address risks that could threaten their operations, strategy, and financial stability. It aligns the organization’s risk appetite with its goals and helps maintain compliance with regulatory requirements.

What role does technology play in risk management?
Technology acts as an enabler by centralizing risk management activities, automating periodic reviews, and streamlining reporting. Platforms like CoreStream GRC help integrate risks with controls, policies, and action plans while improving efficiency and coherence.

What benefits do centralized risk management platforms provide?

Centralized platforms:

• Link risks with controls and action plans.
• Automate reviews and updates.
• Provide real-time, efficient reporting to highlight key issues.

How can businesses prepare for compliance with updated risk management standards?

Businesses should:

• Establish comprehensive risk identification and management processes.
• Regularly monitor and review these processes.
• Embed risk management into planning and decision-making.
• Ensure clear documentation to satisfy regulatory and auditing requirements.