Opportunity for risk management to deliver more value: RIMS/Marsh survey

Despite greater alignment in how senior executives and risk professionals view the role that risk management should play in strategic planning, there is room for improvement and certain opportunities have yet to be realized.

Those are among the findings of the 10^th annual Excellence in Risk Management survey – based on online responses from more than 1,200 risk managers, C-Suite executives and others involved in risk-related functions – released by Marsh and RIMS during this week’s 2013 RIMS Annual Conference & Exhibition in Los Angeles.

One area of opportunity relates to findings that 80% of C-Suite respondents and 75% of risk professionals say they do not aggregate risk at the portfolio level, notes the report, Delivering Strategic Value Through Risk Management. This demonstrates an immediate opportunity for risk management to deliver great value by co-ordinating information into a portfolio view.

“A portfolio view allows information to flow more naturally into an [enterprise risk management] framework and provides improved views for an organizational risk profile,” the report notes.

Building organizational risk capabilities through education, providing greater risk input into strategic planning/execution and establishing key risk indicators (KRIs) to guide the overall risk framework within organizations are desired by the C-Suite, notes a joint statement from Marsh and RIMS.

“There must be multiple measures to test both successes and failures,” adds the report. “Single measures may not be strategic or substantial enough to tell a meaningful story or guide decision-making within the organization. Through effective training and organizational awareness, risk professionals can frame the dialogue that will best guide the organization’s success.”

Risk professionals and senior leaders are certainly on the same page when it comes to using data and analytics for developing risk management capabilities in 2013. The former ranked use of data and analytics as the number one focus area; the latter ranked it as number three.

“Data analysis of key risk, financial and performance indicators that will support the organization’s overall risk strategy will help risk professionals close the gap between being an insurance cost center and a strategic thought center,” Yvette Connor, Marsh’s director of client engagement, notes in the statement.

The report indicates 74% of respondents say organizations need to conduct deeper analysis on their risk-related data. “This includes using data for a closer evaluation of the organization’s KRIs, functional benchmarks, variances from expected outcomes and forward-looking predictive indicators. It will also improve the ability to make effective risk finance decisions,” it adds.

“Gathering information internal and external to your firm, being able to build a meaningful portfolio view that tells a story to senior management that describes what’s happening, what the recommendations are, and the prioritization around those recommendations requires some, what I call, business case analysis,” Connor noted at a press conference releasing survey findings. “Certainly within the context of that business case analysis, you would want to utilize analytics and have a quantifiable decision-making framework as you walk your senior management team through those options.”

Carol Fox, director of the strategic and enterprise risk practice at RIMS, added that providing interpretation of data is essential so that senior officials do not feel that they are receiving a lot of data, but little information. “I think what they’re looking for the risk professional to do is to bring reason to all of it, the data that is out there,” Fox said, as well as to outline “what’s important and what’s relevant to the objectives of the organization.”

Survey findings show an improved alignment of what role risk management plays in strategic planning among senior executives and risk professionals. Of those polled, 46% of C-suite and 40% of risk professional respondents agree the risk function should provide strategic risk input to the strategic planning process.

That said, “there is still much room for growth, and gaps remain between what senior leaders and risk professionals expect from the risk function in its delivery of strategic value,” Fox says in the statement.

Only 15% of the risk professionals and 20% of the C-Suite respondents say the risk manager is a full member of the strategic planning and/or executive teams, suggesting that risk management has yet to be fully integrated strategically.

There is also a significant gap in the definition of “value” between the C-Suite and risk professional respondents. For example, when asked about key performance measurements, the transactional (risk transfer) response is highly valued by risk professionals, and yet falls very low on the list for C-Suite respondents.

“This suggests that focusing on the response – risk transfer – without a strong tie in to a risk framework and overall business objectives leaves a sizeable disconnect in value determinants between the C-Suite and risk professionals,” notes the report.

Fox told reporters another disconnect exists around risk-bearing capacity, “which really is the engine. That’s the driver to take on opportunities. How much risk can we bear?”

Asked if the organization includes risk-bearing capacity as a measurement of risk appetite/risk tolerance, survey results indicate 26% of C-Suite respondents said yes compared with 50% of risk professionals and 49% of chief risk officers.

“With a view on forward profitability, growth and, in some cases, related key performance indicators, an organization can use risk bearing capacity as a cornerstone for developing an enterprise-wide view of risk and risk allocation to satisfy organizational performance measures,” the report notes.

“Risk management is in an evolutionary period. There remain pressing business needs to better understand and prepare for hazard risks, and there are emerging needs to identify, quantify and manage strategic, operational and financial risks that may impede organizational performance,” the report adds.