'Risk managers must phase in the development and gradually increase the scope of ERM'

The economic and industrial boom in Qatar has had positive repercussions for local corporate risk management. Indeed, in the past few years, a new wave of expatriates – risk managers from risk-mature Europe – has moved to the country to build robust risk defence programmes and introduce complex and systematic ERM frameworks to the many new corporations and industries being established as the country seeks to diversify its economy.

Among them is French-born Frédéric Desitter, who has almost 20 years of risk management experience across several sectors, from oil and energy to airport installations.

A self-confessed missionary for the discipline, Desitter has been at the forefront of pioneering risk frameworks and promoting standards in the less risk-mature Europe of the 1990s and early 2000s when the concept of ERM first emerged. Of all his achievements during ERM’s formative period, his seven-year stint at UK-based consulting firm, Euro Log from 1997 and three years at Aéroports de Paris from 2008 are particularly telling of his ambition and passion for risk management.

At Euro Log, Desitter worked on billions of euros-worth of contracted deep offshore oil development projects for oil multinational Total. The project was to secure several massive floating oil platforms off the coast of Angola. Each project was worth upwards of $5bn (€3.67bn), with drills operating at sub-sea depths of 1,300m (BP’s disastrous Macondo oil well in the Gulf of Mexico operated at about the same depth). The project was the first of its kind and with a sound risk management plan, Desitter helped Total to meet its objectives. That risk plan eventually became the company standard and was spun out to Total’s contractors globally.

Before moving to Qatar, Desitter worked for Aéroports de Paris, which is responsible for developing and managing the Paris airports. He had to design and implement its ERM system from scratch. He drew up the company’s first risk map, established a collaborative and transparent risk culture, and led the 25-strong risk team to manage efficiently the myriad potentially costly risks that can affect international airports, from operational to strategic threats.

Now entering a new challenge in his career, Desitter will again face the onerous task of constructing a holistic and culturally compliant ERM structure for the developing Sidra Medical and Research Center in Qatar’s capital, Doha.

A new challenge

Desitter’s new position as Sidra’s director of enterprise risk management, will perhaps be the most challenging role of his career to date. This is not least because Sidra is a new company with an ambition to establish itself as a world-class medical centre that will set standards for patient care and help improve the region’s healthcare system, but because risk management and, in particular ERM, are in their infancy in the region. ERM in the Gulf Cooperation Council (GCC) countries has, until recently, existed only as a theory, discussed by insurance professionals, but with few corporations putting it in practice.

However, like Desitter, large and new corporates in Qatar are preparing an action plan to propel risk management from backroom discussions to the fore of company objectives, with fully fledged, integrated risk defence operations in the form of ERM. “There is a strong will among new and large businesses to establish ERM programmes to manage their portfolio of risks,” says Desitter.

“When I was considering moving to Qatar three years ago, numerous businesses were looking to hire risk professionals to lead their newly created risk functions and drive ERM. This was certainly the aim for semi-governmental organisations in aviation, energy and education, for example.

“Businesses here want to put in place what they consider is best practice in corporate governance and they want to adopt the types of governance and risk management principles found in many businesses in Europe.

“However, at the moment, ERM is new here. When I talk to business people in the region, conversations about ERM can often be rudimentary and much time is spent defining what an ERM framework is before getting onto the benefits and logistics of building such a programme.

“Businesses are more familiar with project risk management [practices used predominately in the construction sector], but not ERM.”

In simple terms, the difference between ERM and project risk management lies in the entity to be protected: a project or a business. For more context, the UK-based Project Management Institute defines project risk management as a framework that aims to prevent threats or uncertain events from bringing a project’s objectives to fruition, such as those that could harm, for instance, cost, quality or schedule.

ERM, on the other hand, is a system that protects the entire company from myriad risks and is defined by the US risk management association, RIMS, as: “A strategic business discipline that supports the achievement of an organisation’s objectives by addressing the full spectrum of its risks – [from financial, operational, reporting, compliance, governance, strategic, reputational] – and managing the combined impact of those risks as an interrelated risk portfolio.” ERM is known for bringing benefits such as a holistic view of risks and cultivating a risk-focused culture throughout the entire organisation.

ERM strategy

So what does it take to develop the latter in Qatar? From the many lessons Desitter learnt in Europe when ERM began to surface as a solution to enterprise-wide risk resilience, the key, he says, is to “keep the message simple”.

“When I started working as a risk manager in France, no one knew what risk management involved. The challenge in Qatar is the same as it was for Europe when ERM came into the limelight, namely convincing chief executives that a systematic and integrated risk framework is beneficial and will add value.

“Risk managers, even the most experienced, cannot arrive at an organisation in which a risk function does not exist and expect to go from nothing to having the best-in-class ERM programme in only a few months. The key is to keep the message simple and to start the ERM build by understanding the main areas of interest of the board and chief executives. This information should be used to make quick-wins, offering the board ERM solutions to its concerns.

“Risk managers should work on the board’s main business concerns and devise a risk plan to prevent and mitigate these risks first. Once the executives and other colleagues have seen that their concerns have been adeptly addressed, risk managers can then begin to work on other risks that were not originally on the agenda.

“Risk managers need to phase in the development and gradually increase the scope of ERM to embed it in the organisation’s operational and strategic processes.”

Having the opportunity to “phase in” ERM and “be involved in risk management early on in a new company” is part of the attraction of working in Qatar, according to Desitter. Local risk appetite is healthy and a new community of risk managers is taking advantage of every chance to drive forward the discipline. A formidable force in the making, these risk managers could, in years to come, be known as the risk professionals responsible for producing best practice in risk management. Perhaps the next step is to establish a Qatari risk management body to join the likes of RIMS in the US and FERMA in Europe. The opportunities are certainly there.