How to get risk management into the boardroom

“The problem that faces this profession,” according to Alison Quinlivan, global client advocate at Willis, “is that we are not valued enough.”

Quinlivan was speaking to Airmic members at an Airmic Academy workshop hosted by Willis addressing the challenges of getting risk firmly on the boardroom agenda. “And yet we offer huge value. So the purpose of today is to identify ways to bring risk into the corporate spotlight – for positive reasons.”

But why are risk managers so important, especially in a time of increasing reliance on data and sophisticated models? According to Andy Smyth of Willis’ analytics team, it’s the human factor. He said that major corporate crises happen more often than you might think – about once in every eight years. But the sources of crises are varied and with all the modelling in the world, cannot be predicted.

“You can use the past to inform thinking, but in my opinion, it’s not always a good predictor of the future,” Smyth explained. He said that historical data can be useful but it can also be dangerous – because the next crisis is unlikely to be in that data. “That is where we – humans – come in. Judgement is what they want from you the most. That is our challenge.”

And the way to rise to that challenge, the Academy heard, is not just to understand what the risks are, but to be innovative in coming up with solutions. Buying insurance is all very well, according to Quinlivan, but for some risks, management is the only solution. And if you can do that in a way that is proactive and contributes to business opportunities, you will start getting the attention of the board. 

For example, the most successful technology firms do not restrict themselves to production of core IT products, but aim to solve some of the world’s biggest problems by breaking technological frontiers, from poverty to medical disease. As a result, we have inventions such as Google Glass and have made huge strides in areas such as driverless cars. And these all have the same starting point, according to Quinlivan: asking the question how can we solve this problem? These companies live and breathe innovative thinking.

Clearly, this level of innovation is several steps removed from the work of a risk manager. “But we too need to make this shift in mindset. As a risk manager, you have to think through all solutions: and it requires creativity.”

She gave the Airmic members a more grounded example of a risk manager of a national supermarket who took a simple step to safeguard the company’s reputation. The supermarket found itself in the close proximity of a murder scene, resulting in national news outfits reporting on the crime against the backdrop of the supermarket logo. The risk manager, recognising the potential for negative association, promptly handed out free donuts to the camera crew and quietly asked them to point their camera in a different direction. A small move, but a smart one.

Nevertheless, the speakers acknowledged that it is challenging to get the ear of senior management and to change the perception of risk management so it is seen as a business enabler. So what do they recommend?

Katie Outhwaite, from Willis’ project team, said you need to ask yourself how you can contribute to business opportunities and what the company is trying to achieve. “Bring yourself further upstream in the decision-making process so that you’re involved in those conversations as they happen. That’s a lot easier than responding to a problem once it’s already in place.”

Smyth argued that one way to do that is to socialise. “Socialising gives you influence, speak to as many people you can.” He noted that it can be tough to speak up, especially if you are not delivering good news. “In that case, prepare the ground: get someone senior onside before any crunch meeting. It will make it far easier.”

Ultimately, though, all speakers pressed home the need to relate the major risk decisions to what really matters to the top brass: the bottom line. As Quinlivan summed up: “The more you can think about the things that will affect the business results, the more you’ll get the ear of the c-suite.”

How does your board view risk?