A study by the Harvard Business Review released today stated that two in three business executives report their company’s focus on risk management has increased since the 2008 financial crisis. But only one in 10 said that their executive management is successful in creating a strong risk management culture.
1,419 executives worldwide were surveyed. Almost half of the companies with 10,000 or more employees have a chief risk officer vs. 11% three years ago.
Respondents were asked to identify the risk management capabilities they consider most critical to the performance of their organization and their company’s success in achieving them. Thirty-four percent of respondents said their company performed well at linking risk information to strategic decision-making, while the same percentage said they consider their companies successful at embedding a risk-aware culture at all levels.
Thirty percent said their companies performed well at embedding risk management practices and responsibilities within strategy and operations. Twenty-eight percent of respondents said their organizations performed well at ensuring that all decisions remain within the organization’s risk tolerance, while the same percentage said their companies were successful at driving risk-mitigation activities and proactively indentifying current and emerging risks.
Risks rising in importance
Participants in the survey were asked to identify the top ten risks of the most important in the past three years. The majority cited natural disasters, next in popularity was the continued slow recovery, and lastly, human resources issues, such as talent retention and acquisition. Half of the respondents said brand reputation had grown in significance over the past three years, while 49% cited business continuity planning, 48% legal risks and 46% new regulations/more enforcement. Almost 50% of respondents also cited capital scarcity as a risk that had grown in importance. Electronic/data communications/information security risks were cited by 42%.
Conclusions
- The past three years have seen more companies recognizing the importance of enterprise-wide risk management and, often for the first time, adopting practices to implement it.
- 41% of companies say they are deepening and extending the ties between risk management and strategic planning.
- A good risk management group should operate like a boutique firm, with everyone an expert in a particular area who can be asked to do deep-level work.
- A truly successful risk management culture is focused on driving sustainable and profitable growth rather than simply protecting against downside losses and operational risks.
