Risk Management and the Value Proposition

3-D Risks Require a 3-D Approach

On paper, risks may seem one-dimensional, but they can be far more complex in reality. A one-dimensional approach to three-dimensional risks won’t suffice. Especially at a time when risk management is undergoing a global transformation, organizations must ensure ERM is creating value for the organization.

If you haven’t noticed lately, risk management is going through a global transformation wherever you look!

The COSO ERM framework is being revised with a new tagline, Enterprise Risk Management – Aligning Risk with Strategy and Performance.  Dennis Chelsey, PwC’s Global Risk Consulting leader and lead partner for the COSO ERM effort recently stated, “Enterprise risk management has evolved significantly since 2004 and stands at the verge of providing significant value as organizations pursue value in a complex and uncertain environment.” Chelsey goes on to state, “This update establishes the relationship between risk and strategy, positions risk in the context of an organization’s performance and helps organizations anticipate so they can get ahead of risk and embrace a mindset of resilience.”

Additionally, the ISO 31000:2009 risk framework is being revised.  “The revision of ISO 31000:2009, Risk Management – Principles and Guidelines, has moved one step further to Draft International Standard (DIS) stage, where the draft is now available for public comment,” according to the International Organization of Standardization’s website.  As explained by Jason Brown, Chair of ISO’s technical committee ISO/TC 262, Risk Management, “The message our group would like to pass on to the reader of the Draft International Standard is to critically assess if the current draft can provide the guidance required while remaining relevant to all organizations in all countries.  It is important to keep in mind that we are not drafting an American or European standard, a public or financial services standard, but much rather a generic International Standard.”

And finally, the Basel Committee on Banking Supervision is rolling out in phases its final updated reform measures (Basel III) to ensure bank capital and liquidity measures provide resilience in financial markets to systemic risks.  The magnitude and breadth of these changes may feel overwhelming depending on where you sit on the spectrum of change impacting your business.

Likewise, more complex and systemic risks such as cybersecurity, prompted the National Institute of Standards and Technology to revise and update its Cybersecurity Framework, not to mention changes to Dodd-Frank, health care and a host of other regulatory mandates.  So where does the value proposition happen in risk management?  Given the increasing velocity of change in business and regulatory requirements, how does a risk professional in compliance, audit, risk and/or IT security demonstrate an effective and repeatable value proposition while struggling to keep pace?

To begin, we must first acknowledge that, like risk management, the term “value” has very different meanings for different stakeholders. A shareholder’s definition of value will most likely be different than a customer’s definition. Given this context, we can focus on the “value” proposition derived from the role of a risk professional’s contribution to each stakeholder. However, we need more information to fully understand how a risk professional might approach this topic.  If you are an internal auditor, you may take a risk-based approach during the audits you perform.  If your role is that of a regulatory compliance professional ensuring the effectiveness of internal controls, ethics and awareness are used to derive value. The same is true for the contributions each oversight team makes. In studying other risk professionals, I have begun to learn that I need to expand my definition of value to incorporate disciplines beyond my own skill set.

Sean Lyons, author of “Corporate Defense and The Value Preservation Imperative,” focuses on key strategies to preserve value by expanding the Corporate Defense model from three to five lines of defense, creating an enterprisewide risk approach.  Andrea Bonime-Blanc, author of “The Reputation Risk Handbook,” has developed a focus on the importance of understanding the difference in Reputation Management and the role of Reputation Risk.  Dr. Bonime-Blanc makes a compelling argument for understanding the strategic importance of developing clear steps to manage key risks within a firm that pose the greatest potential of damage to a firm’s reputation by adopting an enterprise risk approach to reputation risks.  In thinking about where my practice adds value, I have proposed a Cognitive Risk Framework for Cybersecurity and extended the model to include enterprise risk management.  The basis for a cognitive risk framework is derived from decades of research in behavioral economics, cognitive/decision science and a deep look at the human-machine interaction as a way to infuse human elements into risk management much the same as automobile manufacturers, NASA the aerospace industry have redesigned the interior of their respective vehicles to account for human behavior in making the travel experience safer.

What is exciting about these and many more new developments in the risk profession is that “value” can be derived by each of these approaches.  In fact, while each practice may seem uniquely different, the differences complement, because risk is not one-dimensional.  The complexity of the risk profile of many firms has changed and evolved in ways that require more than one view on how to manage the myriad of threats facing them. The permutations of risk exposure will only expand given the velocity of change in technology and the speed of computing power being acquired by and expected of our competitors, customers and adversaries alike.

The challenge for organizations is to not assume that a one-dimensional approach to risk management is sufficient for dealing with three-dimensional risks with a great deal of uncertainty.

The value proposition of risk management viewed from this perspective suggests that a cross-disciplinary approach is needed.  Even greater value can be created by risk management through thoughtful design, value preservation and sustainable practices and behaviors.  By this standard, risk management informs and supports the strategic plan through the value it [risk management] creates for each of its respective stakeholders.  The lesson is that organizations should not get stuck in one dogmatic approach to managing risks while assuming it is sufficient for today’s risk environment.  What we learn from others is simply another way value is created for the organization.