Risks are growing and becoming more complex – with Brexit, Covid-19, the accelerated development of AI and world conflict, risk managers are facing tremendous challenges.
Organizations face various challenges in effectively aligning their strategic objectives with identified risks, standardizing risk assessments, and dealing with both quantitative and qualitative assessments.
It’s no surprise then to learn that the global market for risk management software is growing rapidly, with estimates suggesting it will reach USD 23.57 billion by 2028 (Grand View Research Inc.)
So what are the top challenges for risk managers today and what can we do to overcome them?
1. A lack of alignment between strategic objectives and identified risks
One of the most common challenges organizations face is the disconnect between their strategic objectives, and the associated risks and opportunities. Your organization might be able to clearly articulate its goals and objectives, but can the same be said for the risks and opportunities associated with them?
This misalignment can lead to a lack of prioritization in risk mitigation efforts and hold your organization back from achieving its organizational goals.
So what can you do to ensure alignment?
Once you’ve identified your risks, start linking them to the relevant strategic objectives and areas of the organization that will be impacted. Linking these is crucial for demonstrating how different risks can influence the achievement of strategic goals – this is key for communicating risk to your stakeholders in a way that helps them understand the impact.
A well-communicated risk appetite statement is key, enabling you to set specific tolerances for different categories of risks. This helps your organization define the acceptable level of risk exposure and helps you to keep risk management efforts consistent with organizational objectives.
Remember to regularly review your risk register to ensure no risks go unaccounted for or exceed your established tolerances. Continuously assessing in this way allows your organization to adapt and respond to the changing risk landscape in a way that’s proactive rather than reactive.
2. A lack of standardization across different areas of the business
Risk management can vary significantly depending on which area of the organization you’re dealing with. For example, your IT department might be more focused on IT and cybersecurity-related risks, whereas your finance department might be more concerned with financial risks. Your board and leadership will have different priorities too, likely focusing on strategic and operational risks.
The important thing to note is that although different areas of the business are concerned with different risks, all of these can be linked together and tied back to an overarching organizational objective.
To standardize practices across your organization, you can establish a comprehensive risk management policy. This should define clear roles, responsibilities and expectations for risk assessment activities across various business areas – whether that’s IT, finance or anything else. This policy should provide a framework for how risk management is conducted and how it integrates with the organization’s strategic objectives. It should outline the scope, objective, methodologies and categories to be assessed. The benefit of this framework is that it ensures your organization is consistently evaluating risks across different business areas in a standardized way.
This shouldn’t be intimidating for your stakeholders but instead make things easier – training can be provided to educate them and help build confidence around following a standardized process. This way, everyone involved will understand and follow the procedures you’ve established in the right way every time.
The result?
Your organization can ensure that its risk management efforts are made more efficient and that meaningful insights are produced across various functions and departments.
3. The debate between a bottom-up or top-down approach to risk identification
A top-down versus bottom-up approach to risk identification: which one is better?
The approach an organization takes to identify risks typically varies based on its size, maturity and industry. By adopting a top-down approach, an organization may miss operational-level risks identified by those closer to day-to-day activities, such as employees and front-line managers. On the other hand, a bottom-up approach might lack clear direction on how lower-level risks can tie back to the overarching goals and resources.
The good news is that you don’t have to painstakingly choose between the two.
Taking a combined approach to risk identification gives you a well-rounded strategy that can provide awareness and nurture a strong risk management culture. To do this successfully, you need to have certain prerequisites in place (many of which have been outlined earlier in this post).
Your organization needs to have a well-defined business hierarchy, processes and assets before you consider your approach. This ensures you have a clear understanding of how different risks relate to organizational goals and resources. Leadership and the wider organization must be made clear about the overarching goals if you want to foster a healthy risk culture.
Once these foundational elements are in place, process owners and employees more directly involved in operations can actively help build a risk hierarchy between higher enterprise-level risks and lower operational-level risks.
By enabling collaboration between different levels of the organization, you can foster a robust risk management culture that allows for more comprehensive identification and management of risks.
4. The use of qualitative vs quantitative risk assessments
How do you choose between qualitative and quantitative risk assessments?
Qualitative approaches are commonly used, especially in younger organizations, but they tend to be subjective in nature. This means they can lack tangible insights. Quantitative risk management, on the other hand, can provide clearer visibility into the likelihood and impact of risks based on benchmark data. Its objective nature allows for more accurate allocation of investments and provides meaningful data to inform decision-making. While a quantitative approach is ideal, it is not always possible to get the data and resources you need – particularly for smaller tasks.
So how do you know what’s appropriate for your organization?
While not all risks require a quantitative approach (for example, reputational or geopolitical risks), organizations should aspire to adopt quantitative risk management as they mature. Moving towards a quantitative approach is a positive step forward in risk management, but you will need more resources and data to do it effectively. Here are some important considerations to help you do it successfully:
Start collecting the right data – To conduct quantitative risk assessments, your organization must collect and analyze a substantial amount of data. What data do you really need to provide you with the outcome you’re looking for? This data could include historical, financial and benchmark data that gives you insight into the likelihood and impact of the risks you’re investigating.
Develop risk models – Risk models allow you to calculate quantitative risk metrics. These should take into account your organization’s specific risk categories and tailored to its needs.
Ensure data quality – Make sure the data used in your quantitative assessments is accurate and reliable. Inaccurate or incomplete data can lead to erroneous risk assessments.
Transitioning to a quantitative approach won’t happen overnight – this is why it’s typically a difficult and longer-term goal for most organizations. However, the result is greater value from insights, improved efficiency and informed decision-making across the organization.
In conclusion…
While nobody can predict the exact risks that might happen, we can take steps to improve our risk management processes to be better prepared. The strategies outlined above will contribute to a more robust risk management culture and enable better-informed decision-making at all levels of the organization.
By combining these strategies with the right GRC software, your organization will be better equipped to navigate the complexities of today’s business environment and achieve its overall goals.
