Re-think, Enable, Execute – a modern approach to risk management

The main objective of any chief risk officer (CRO) or head of risk should be an attempt to “work him/herself out-of-a-job”

Building an effective risk culture throughout the organisation and building a radical risk management process to support that will drive personal accountability, better decision-making and ultimately add value and ensure sustainable competitive advantage.

I fail to understand how organisations spend millions of dollars to hire outsiders to design and implement or “enhance” ERM frameworks and policies. These outsiders know nothing about your business and your corporate culture and as such, the result is mostly a “cut-and-paste” job from some previous engagement or some kind of consulting “blueprint”; like the useless and outdated “Three-lines-of-defence” concept or an attempt to “provide assurance” of compliance with ISO31000.

There is no one-size-fits-all and you can thus never “implement” the management of risk in any organisation. The effective management of risk comes from the awareness, knowledge and skills every employee has and uses to take the best decision in every situation to drive risk optimisation for the reward of adding value to the organisation.

Having lines of policemen in different trenches for defence is a strategy that leads nowhere; no war was ever won from the trenches, the only way forward is to actually get out of the trench and advance. There is no time for innovation in today’s global marketplace, the disruptors are here! If you try to apply innovation to the way you manage risk, you are in reverse, will be left behind and it is only a matter of time before you go-out-of-business. The world is moving on, trying to innovate in an environment of disruption is similar to suicide.

It is time to re-think what you are doing to optimise risk, add value and get business rewards. If your focus is on control and mitigation, you will just take less-and-less risk and the result is less-and-less reward.

It is time to enable all your employees to take well-informed risk decisions by training all of them risk management skills. It is time to start all meetings with “How much more risk can we take?”

It is time to execute your business strategy away from a focus on compliance, risk mitigation, and lengthy discussions on whether something should have been Red, Amber or Green…