Risk management – part of the problem or part of the solution?

Todd Davies asks if a changing environment is a new norm – and explains how risk professionals can cope.

Change is happening at a greater scale than ever before. We see it every day. This creates great uncertainty for the organisations that we serve, and should be a boon for us as risk professionals. After all, we’re in the business of managing uncertainty, or at least that’s what ISO 31000 tells us.

But the reality is that most people in the audit, risk and compliance fields aren’t dealing with uncertainties at all. We know that most of the risks that we anticipate are going to happen at some point in some sort of predicable manner. The only thing we don’t know is when or on what scale.

So as we merrily trundle along addressing these known-risks with known methods we add checks and balances. We add layers of approval. We write policies and procedures.

This is all great stuff in a steady-state environment. The only problem is that a steady-state environment isn’t the norm any more. In fact it hasn’t been for some time. Maybe you’ve noticed.

And in a non-steady state environment, the best risk response is the ability to adapt at short notice. This means scaling up capability quickly and dismantling it even faster. It also means the ability to innovate, scale and adapt could become more important sources of competitive advantage than existing assets and infrastructure. A truly frightening idea for most of us.

Heresy you may say. But have a look at the top 50 list from any stock exchange from 20 years ago and compare it to today. You won’t recognise much. A lot of change can happen in a very short time.

So back to today. With all of this change this in mind, does adding checks and balances add agility, or reduce it? How about layers of approval, or layers of policies and procedures? Or are we calcifying our organisations and making them less able to adapt?

Risk management is about allowing for success under multiple scenarios. In everything we do we must remember that steady-state is only one scenario, and possibly an unlikely one at that.

Charles Darwin said ‘It is not the strongest of the species that survive, nor the most interesting, but the ones most responsive to change’.

When we can manage risk by creating greater agility then risk management will stop being part of the problem and start becoming part of the solution.

This article appeared as a cover story in the inaugural web-based version of Risk Management Magazine.