Is your business too complicated to manage risk?

Share

Andy BallardCan you “articulate” your position?

Risk is part of all our lives; both in business and personally. We cannot make it go away. Indeed, in business many would argue risk (and the management or mitigation of risk) creates a culture that allows businesses to evolve, and develop. It is a tool to drive change and improvement.

In addition, the board must be able to “articulate” their position; particularly in discussions as part of an In-Depth Assessment (“IDA”).

All too often we think of risk as a negative but it can (and should) be a positive.

The Institute of Risk Management say:

“We need to make sure we manage risks so that we minimise their threats and maximise potential.”

For boards it means they should not only be able to identify risk and make sure that their organisation has in place systems to manage or mitigate risk; but also be able to “articulate” that risk.

Having said that, it does not mean getting involved in operational matters!

Paragraph C1 of the National Housing Federation (“NHF”) Code of Governance 2015 sets that under the section headed:

“Essential functions of the board and the chair”

… the board is responsible for:

“Establishing and overseeing a risk management framework in order to safeguard the assets and reputation of the organisation.”

Very often this will be done by way of Risk Map. Most organisations will have one.  Risks may be divided into two namely:

  • Strategic – for the most part board issues
  • Operational – for the most part management issues

Whilst clearly operational risks and their mitigation are of interest to boards – the primary function of the board is to work at a strategic level and to ensure that strategic risks are identified and mitigated.

So what are some of the strategic risks facing the sector? You may have on your Risk Map

  • Financial failure – breaking a banking covenant
  • Regulatory intervention – failing to meet the new Regulatory Standard
  • Universal credit – the potential for there to be a drop in income
  • Diversification – trading in non-traditional areas of business
  • Brexit – sources of new funding, land values and market downgrades
  • Unit costs – how do you costs compare with your neighbours and how do you “articulate” the difference?

As a board how do you prioritise these risks/ Is one or more of greater importance than another and why?

As with most Risk Maps, each risk identified should have, where possible, a plan to mitigate and the board must be satisfied and assured the mitigation is appropriate; the board must be able to “articulate” their position.

The Risk Map should help the board identify the:

  • Chance of an event occurring and
  • Cost for your organisation should that event occur

The big issue for more complex organisations is whether a risk identified at group parent level is properly mitigated by the time it is delivered at subsidiary level.

Some boards pass such tasks to a committee. Often this will be an Audit and Risk Committee with terms of reference from the group parent board.  My worry here is that in the current economic climate, risks of this sort should perhaps remain with the group parent board and the group parent board must make sure that each of the strategic risks identified and mitigated by it in the risk management plan are properly managed.

Should Audit and Risk Committees have their terms of reference “split” so that the committee deals with audit and the overall responsibility for risk is passed back up to the group parent board?

Should all board papers have a Risk Map summary attached to the cover sheet setting out both the risk presented by the paper being considered along with a note of how the new risk interacts with existing risks?

How often should a Risk Map be reviewed and by whom?

How much detail does the group parent board need without inadvertently becoming operational?

….and lastly can you “articulate” your position in an IDA?

These are some of the issues boards should consider.

Perhaps at a facilitated away day?

Don’t forget; everyone thought VW and Kids Co were fine and were managing risk until it was discovered they were not?

For more information, contact Andy Ballard Associate Director at Altair on andy.ballard@nullaltairltd.co.uk.