Evaluating the effectiveness of risk management programmes

Almost one in four companies in Asia-Pacific fail to measure the effectiveness of their risk management programmes.

This was one of the key findings to come out of the Reporting Risk survey of the StrategicRISK Advisory Panel last month.

When asked how senior management evaluate the success of risk management programmes, the most common response, cited by 46% of the panel, was “identify/ track the involvement of risk management within the organisation”.

Next on the list were “compare historical results from risk events against effectiveness of risk management programmes” and “compare historical results of safety and loss-control programmes”, chosen by 33% and 30% of respondents, respectively.

But 23% of risk managers said senior management did not evaluate the effectiveness of their programmes at all.

This is despite 69% of respondents identifying a greater commitment from the board to risk issues as the greatest internal driver to strengthening risk management within their organisation.

BPAY group risk manager Francesca Dickson said that as risk managers move away from managing operational risks to more strategic ones, the measurement of risk programmes becomes increasingly difficult.

“How do you quantify something that hasn’t happened before, and if it did happen would disrupt the company? It’s more nuanced than that, so risk has to be working more closely with strategy,” she said.

“When you’re looking at strategic assets that your company has, you want to take risks in terms of innovation, but if you take your eye off the ball, you don’t want the people who are protecting those assets to be taking risks. So from a cultural perspective, it’s quite challenging.”

It’s important to have an in-depth understanding of a company’s risk appetite, Dickson added.

“Often the stated risk appetite and the actual risk appetite are not the same within an organisation. You have to have actual conversations about it,” she said.