“Every organisation has to take risk to survive, develop and grow,” says PwC Risk Assurance partner Andy Banks. “But it needs to be an acceptable level of risk, and they need risk functions which can proactively help them understand what is acceptable and unacceptable.”
To do so will require changes to the way in which the traditional risk functions operate as well as a fundamental shift in mindset on the part of boards, leadership teams and risk professionals.
“To put it in context, there is a view that the risk function hasn’t evolved at a level commensurate with the pace of change generally,” Banks adds. “Over the past five to 10 years and in the last two in particular, we have witnessed digital transformation gathering speed. We have also seen a marked increase in the cyber threat level, disruptions to supply chains, the increased importance of ESG and sustainability issues, growing geopolitical instability, energy shortages, and now the return of inflation.
“That’s a very challenging external environment, but if you look at the risk function, it hasn’t changed to respond both to these threats and to identify the opportunities for competitive advantage.”
More forward looking
The reason for this is both structural and cultural, Banks says. “Many organisations struggle to understand the value which can be delivered by the risk function. Part of the reason for this is that traditional risk functions tend to be backward rather than forward looking, with less attention devoted to what’s coming down the tracks. Organisations need to encourage the adoption of a forward-looking mindset in risk functions.”
There is also a perception of risk being predominantly compliance focused rather than a genuine support tool for strategic decision making, according to PwC Risk Assurance director Shane Walker.
“Organisations do appreciate risk,” he says. “They have the frameworks and reporting structures in place. But many key risk processes, such as risk taxonomy and risk register preparation and review, tend to be carried out as an annual exercise which captures past events, not at a real time level.”
Banks says that organisations need to involve the risk function in strategic decisions in real time. “This will enable them to look ahead to areas of concern and see opportunities they could be missing. In this way organisations also build greater resilience to respond to future events.”
Walker uses the analogy of a car-braking system to explain the required shift in mindset. “Almost counter-intuitively, they allow you to go faster because you know you are able to slow down or stop when necessary. The risk function can give boards and leadership teams confidence in their business decisions. It can be used as a strategic tool to enable growth.”
Banks points to a practical example where organisations are making acquisitions. “Bringing risk into the conversation earlier, when actioning strategic decisions, means organisations can get a much better understanding of the risks associated with that decision. It allows them to go into it with their eyes wide open.
“There is often a perception that risk just says no. That’s not the case. It explains the level of risk associated with a decision and it’s up to the board to decide whether it’s acceptable or not.”
Greater focus on skills and data
Becoming more forward looking is not the only change required. The skillsets of the risk team also need to be addressed. For example, a recent PwC study of the risk functions in the global banking industry found that climate change was seen as the top threat to banks, but climate change specialists only accounted for an average of half of 1 per cent of risk team members.
A dearth of data analytics, cybersecurity and other specialist skills was also uncovered.
“The traditional skills in risk teams are probably more associated with the accounting field,” says Walker. “Organisations need to strengthen their risk function by bringing in diverse skillsets. A strategic mindset is a key requisite for the risk professional going forward. Risk functions need dynamic and agile skills who can adapt and respond to the ever-changing risk landscape.
“Closing the digital skills gap is key. It’s about learning lessons from the past. If you get the analytics and data integrity piece right, giving confidence in key reporting metrics, you can tell what’s likely to happen in the future and prepare for it. The same applies to the broader ESG agenda. People are struggling to understand what ESG is and the risks it presents.
“Organisations need to bring in more specialists as well as develop the skillsets of their risk teams through learning and development. This will also help with the retention of key risk specialists.”
Communications often undervalued
Softer skills are also important. “One skill that’s really undervalued is communications – the ability to translate insights into clear business language and benefits,” says Walker. “Risk can be seen as negative and defensive. If it can be put into easily understood language you can get buy-in from the board and leadership and others in the organisation.
“We have a client who got their marketing team to put risk reports into the language used by the business. That proved to be a very simple and effective way of getting risk on the agenda for strategic decisions.”
A cultural shift is also required. “This must come from the top down, including the board and senior management supporting their people,” says Banks. “People must be encouraged to speak up about risk and join in the conversation. It’s not about eliminating risk. This is neither possible nor desirable. It’s about bringing the risk function to the table when strategic decisions are being made to ensure that the risks being taken are acceptable and appropriate.
“In summary, you want people to be risk aware not risk averse.”