Revisiting the Five Pillars of Risk Management

In the drive towards risk management maturity, leadership, culture, and capabilities are foundational. Leadership is critical because it sets the tone and direction and drives risk management. An ERM (Enterprise Risk Management) mature organization has embedded risk management leadership at all levels of the organization, not just at the top. That is, when everyone is a risk manager. The chief executive officer is (or should be) the ultimate risk manager. Leadership accounts for up to 80 per cent in variance in organizational performance

Leadership creates and shapes culture. Yet, culture, in turn, influences who becomes leaders and how things get done. It can be facilitative or resistant to leadership initiatives and desired change. Culture is the shared mental models, assumptions, and belief system that animates organizational attitudes and behaviours. When people in an organization say to a leader that is not how things are run here, that is culture in action. A culture that treats risk management as a separate and stand-alone work is different from a culture that treats risk management as an integral part of work, whether big or small.

According to a study, organizational culture accounts for up to 40 per cent in organizational performance. Ninety-two per cent of executives believe culture drives business successes.

Thus, it is strategically important to develop an organizational culture conducive to the thriving of risk management. This can be achieved through persistent and consistent risk management communication, leadership modelling, employee involvement, training, feedback loops, celebrating small wins, and recognizing risk management contributions. Ongoing conversation on risks in meetings, undertaking basic risk management training, and adoption of a employee performance risk management goal are parts of risk management culture building.

Yet, it is one thing to be asked and wanting to do something and another to be able to do it. People may have been fired up to practice risk management, but they cannot do it unless they know how and have the tools to do it. Thus, basic training and tools are critical.

When the foundation of leadership, culture, and capabilities are present, integration of risk management in management practices and business processes and better reporting and control come as "natural" offshoots. Financial and non-financial information are generated and harnessed in integrated ways to inform risk management, which in turn ensures optimal organizational success. Risk management, even risk management goals and objectives, is not the end goal. It is actually a means to achieving organizational goals which, ultimately, is providing service or product in the right quantity, quality, and timely manner.