At which risk management maturity level do you stand and in which direction do you want to head? As risk managers, we strive to continuously improve the way we manage our risks. This could mean we update our risk registers, or entirely upheave our risk management processes. Nonetheless, it’s an ongoing effort as we get better at understanding our risks and smarter about the techniques that work best for our organization.
Risk Management Maturity
Many factors can play a role in determining the extent to which we manage our risks. Perhaps, we experienced a significant loss, which in hindsight could have been avoided. Or maybe, our customers, society or regulator have recently been critical about processes. Or we have found that our current approach is not rigorous enough or too cumbersome to achieve the benefits we seek. Regardless, some level of risk management is better than no risk management at all.
ADVERTISEMENT
Before undertaking changes to your risk management processes, it is helpful to understand your current level of maturity. Consider these four fundamental pillars for sound risk management practices to help assess your risk management maturity level: business strategy and risk culture; framework and policies; risk appetite; and risk profile.
Business Strategy and Risk Culture Maturity
Your business strategy and risk culture pertain to your consideration of risk when formulating your business strategy and your culture around risk-taking and risk awareness.
You may want to strive from having no stated risk culture or governance structure in place to having risk management considerations that are fully integrated in the running of your business. This includes clear messaging from the highest level of your organization regarding the importance of risk management. Additionally, it includes clear accountability for managing risks in accordance with that messaging.
Framework and Policies Maturity
Your risk management framework and policies articulate your expectations for the management of your risks.
Progressing from having no framework or processes in place to ultimately having a well defined and functioning risk management framework does not happen overnight. So be prepared. It takes time to fully design the playbook elements that work best for your organization. Furthermore, it takes even more time to embed them in your business as living documents.
ADVERTISEMENT
Risk Appetite Maturity
Your risk appetite statements express the amount of risk you are willing to accept or tolerate in the pursuit of your objectives.
These statements are powerful tools as they can convey many messages such as: (1) the risk level you are willing to accept or tolerate to meet your business objectives; (2) what that means for the internal controls you will put in place to achieve this level; and (3) the responsive action you will take if the actual level of risk falls outside that level. When risk appetite statements are functioning optimally, there is a process in place for detecting whether you are operating outside of these levels in sufficient time.
Risk Profile Maturity
Your risk profile is your assessment of adherence with your risk appetite statements.
Your risk profile should provide a point in time, aggregated view of your business’ risk management status. You can equate your risk profile assessment to determining the risk management pulse for your organization. However, this is difficult to determine when risk assessments are not conducted in a timely and optimal manner. Moreover, risk assessments should be comprehensive, capturing your entire risk universe. And, their status monitored at a frequency that will enable the accurate determination of your risk profile.
Time for a Change?
At which maturity level do you stand for each of these risk management pillars and in which direction do you want to head? Admittedly, there is cost associated with implementing sound risk management. However, this cost should align with your perceived benefit. At the very least, determine your minimum bar and strive for that – always taking into consideration the size and complexity of your business.
