Can the value of risk management be evidenced?

Sword GRC Blog

Can the value of risk management be evidenced?

It may not be easy to assess and communicate the value of risk management, but according to Dr Ariane Chapelle, risk expert and Managing Partner at Chapelle Consulting who explored the theme in a Sword GRC Webinar entitled ‘Assessing the Value of Risk Management’, it’s not impossible! If you missed the webinar, this short post shares highlights from her presentation (or watch the On Demand Recording).


THE IMPORTANCE OF POSITIVE RISK MANAGEMENT
Positive risk management is a concept that Chapelle started developing a couple of years ago to shed light on a discipline that she believes is not always well accepted. Her suggestion is that positive risk management involves three key elements: firstly, recognising that risk-taking can be a good thing, in light of the opportunity costs of not taking enough or taking too many risks. The second aspect of positive risk management is learning from successes and positive outliers. And the third element, Chapelle believes, is to position risk management as “an empowerment or a means to achieve higher performance.”


OPPORTUNITY COSTS – MAKE THE INVISIBLE VISIBLE
Opportunity costs arise from inefficiencies: not being fast enough, not being operationally efficient, losing time through the over control of or under-taking of risk and wasting time on remediation, post incidents. “It’s a case of striking the right balance. If you are a risk manager or risk champion, trying to convince your colleagues of the value of risk management, even if risk-taking seems counter intuitive, you should take risks in a calculated manner,” Chapelle advises.

She asserts that positive risk management involves encouraging constructive dialogue between the business and risk management and recognising the value and rewards of risk taking.


RISK MANAGEMENT SHOULD BE PROPORTIONATE TO YOUR BUSINESS GOAL
“If you are very ambitious, if you are dealing with high-risk operations, if you want to be the best in your sector, if you want to be good at taking operational risks… the more ambitious the goal from an operational perspective, the more important your risk management is, because that’s what stabilises your performance to achieve your goal.”


VALUABLE RISK REPORTING
To demonstrate value, Chapelle recommends that you are insightful in your use of risk data, you engage by being relevant, doing so by listening to what people need, and you strive to be inspiring, by detailing risk management success stories.

“Salient reporting in operational risk should focus on what are the key messages you wish to convey; what are the decisions you wish to be taken and, are you sure that people understand what needs to be done.”


3 GOLDEN RULES FOR REPORTING
For cost benefit analysis, Chapelle recommends that you collect information only:

  1. If its value exceeds the cost of its collection
  2. When you know how you will use the information
  3. If this information influences decision making

Feeding information back to the business is vital. “Asking the business to report centrally, without feeding them back the results, is like typing on a keyboard without a screen; you will have typos and everyone will be discouraged to type.”


ACHIEVING BETTER DECISION MAKING
In conclusion, Chapelle believes that risk management can be turned into a positive narrative, recognising the value of risk taking and performance. The aim should be to build a partnership between optimists and pessimists as this can “create a powerful engine for business growth, without booms or busts.”

If you would like to watch the full ‘Assessing the Value of Risk Management’ webinar, the recording is available free of charge here.