Crisis drives risk management in too many Malaysian companies

“Only when there is a puncture do they realise it is needed,” explains MARIM treasurer Bernard Lee (pictured).

This is a common complaint of risk professionals in Malaysia, together with the belief that, as Lee puts it, “crisis drives risk management in many companies, as if these are not managed well, they become disasters”.

Lee, who is head of business continuity and insurance at telecoms company Maxis Communication, explains: “To get the board to sit up and take notice, a problem needs to happen – although some companies are starting to become more proactive; for example, through the way in which they deal with social media”.

Faisha Shahriman of Malaysia Airports Holdings’ risk-management division believes the general level of engagement by boards of Malaysian organisations has increased primarily owing to the implementation of the revised Malaysian Code of Corporate Governance 2012 and ISO 31000.

“In addition, the Statement on Internal Control – Guidance for Directors of Public Listed Companies was introduced to further assist the board in making disclosures concerning risk management in the internal controls of the company, hence requiring commitment and engagement by the board related to risk management,” he says.

MARIM chairman Mohamad Bin Mohd Zain agrees corporate governance is now part of the boardroom agenda for all publicly listed companies.

“Most companies will either have their own board risk committee or run risk management as part of the board audit committee,” he says.

Senior manager of the risk management division of Malaysia Airports Zalina Jaflus believes most directors are more aware of their responsibilities with regards to risk management, especially after Bursa Malaysia Securities issued the Statement on Risk Management and Internal Control – Guidelines for Directors of Public Listed Issuers.

“This greatly assists in propelling the importance of risk management practices throughout the organisation,” she says.

Powerful formula

Having a board that understands and can act effectively on risk management is a powerful formula for success, argues Patrick Abdullah, Pan-Asia Risk and Insurance Management Association board member and vice-president of enterprise risk management at Malaysian media company Astro Overseas.

“Boards should also be constituted appropriately, with knowledgeable members who have the right expertise for risk management to enable the process to gain strong traction,” he advises.

“Boards also need to instil these values and influence senior management that tying risk management requirements and corporate governance to performance and rewards is important.”

Principal officer and chief executive of JLT Malaysia Michael Leong says that although he sees a strengthening of risk management on the back of stronger engagement from the boards of Malaysian organisations, some firms still perceive risk management as being relevant only to major corporates.

“Every business needs risk management; they must not leave everything to chance and think bad things will not happen,” he says.

“Firms need to be proactive in reviewing all the risks affecting their business mechanisms and be prudent in managing the risks.”

Leong adds that education is central to developing future risk professionals. “Training provides continuous learning and industry updates, and helps in the role-switching from insurance manager to risk manager.”

Jaflus takes it a step further, suggesting that risk managers should be required to have licences, “so that eventually only licensed risk managers are authorised to head the ERM divisions or be called chief risk officers”.

Zain, who in addition to his MARIM responsibilities is also vice-president of group business assurance at Telekom Malaysia, says there is a shortage of people in Malaysia with the appropriate skill set to be truly effective risk managers.

“There are still big gaps in risk management education – hence a great opportunity for trainers in this area,” he adds.

The next significant step is to attract a new generation of people from a diverse range of backgrounds, with the talent and skills to develop a robust, technologically savvy and business relevant risk culture for the future, he says.

“Indeed, risk management faces a serious challenge: talent. Do we have enough, and where will the next generation come from? We can all debate standards and training, but if we can’t attract young people, that will be a sterile debate.”

Because there is a critical shortage of people who can manage new business risk, retention of risk managers with five to 10 years’ experience will become a problem for many companies as other firms begin to establish their own risk management units, Zain predicts.

“Rather than building the expertise in-house, buying over staff from other companies will continue because of the limited supply of qualified ERM practitioners,” he adds.

Shareholder value

Lee rates ERM maturity in Malaysia as “moderate to good”, especially among listed companies. Marsh Malaysia chief executive CB Lim agrees, adding that shareholder value is the main driver for ERM adoption.

“The mid-market sector is beginning to look at ERM more frequently, as it understands the benefits of taking a holistic risk-management approach, such as volatility reduction, which is especially important for companies with smaller balance sheets.”

Malaysia Airports’ Shahriman believes ERM processes are well-defined across most large Malaysian corporates, with “continuous efforts between companies in Malaysia to embed the ERM culture by way of benchmarking visits between companies, forums, seminars, conference and training” – which is where you’ll find a feeling of relative optimism for the future of risk management in Malaysia.

As Lee says: “I see risk management standards and practices becoming more ingrained within organisations to help management to better handle new challenges. Risk management is going to play a more crucial advisory role within the corporate structure.”

You can read more about the risk landscape of the third largest economy in South East Asia in StrategicRISK’s upcoming 2014 Malaysia Risk Report, sponsored by Zurich and supported by the Pan-Asia Risk & Insurance Management Association (PARIMA).

All our country reports are available here.