Anyone who has spent any time over the past few years hanging around with financial professionals – finance directors, internal and external auditors – must have heard a lot about risk management. The management of risk was the cool philosophy of the 1990s. It was sold as the methodology for any set of directors to be able to fulfil their collective stewardship role (preserve and enhance the company’s assets) and at the same time take the leaps of commercial faith necessary for growth.
While the 1990s good times rolled, risk management made eminent sense.
At the same time, there was also an implicit promise that it would stand a company in good stead when business conditions became less favourable.
So when the ICAEW published a booklet on the reporting of risk to shareholders, its title, No surprises, summed up the risk management vision. With the benefit of hindsight, however, shareholders in several companies may now find this title a little ironic.
Corporate governance was central to risk management because the latter required the framework of the former. Without such a framework, risk could not be managed across an organisation as a whole. Corporate governance rose to prominence after the recession and the subsequent corporate failures – some fraudulent, some not – of the late 1980s and 1990s. Financial professionals were central to risk management because it built upon and extended the idea of financial management – especially the reliance on internal controls that FDs have been using for decades.
Directors should now be using risk management to deal with the downturn.
Yet it seems likely that when the business environment improves there will be companies which admit that their risk model needs to be made more robust. It hardly counts as blue sky scenario planning to work out that that markets can shrink and that a company’s revenues can decline, sometimes drastically and suddenly – and if this is all risk management says, then it is nothing more than a fad.
A glance at the business section of any newspaper gives a flavour of the current gloom. The companies in the most pain are not two-bit SMEs, but organisations with huge resources and the ability to attract the best managers. Had you checked their annual reports prior to their current embarrassment you would have found plenty of references to risk management.
Those who advocate the efficacy of risk management would argue that it is not the theory that is at fault but its application. Business risks change and there are new, potentially disastrous risks that emerge at great speed out of a clear sky, they say. Risk management is a continuum, a constant checking of the radar for trouble ahead. Working properly it provides data by which companies make more informed decisions. Maybe FDs understand better than most other directors the idea that risk management should be seen not in terms of a check list but as a methodology for decision making. Risk management provides a vocabulary through which business people with a wide variety of backgrounds can converse about decisions that need to be taken.
This argument is valid – up to a point. Maybe I wasn’t listening properly, but when risk management was being discussed in the 1990s, it was something more than just a jargon, a shorthand through which business people could converse. Then again, while there are arguments for suggesting that risk management has failed some companies, others argue that economic volatility raises the profile of risk management within an organisation. It should provide organisations with a way to react quickly to events that threaten the company.
An FD in a media group suggested that when business is going smoothly, organisations tend to go through the risk management motions. The danger in is that companies have used risk management as a bureaucratic exercise rather than treating it as a way of examining the fundamental. Another FD told me: “The last thing you want in a recession is some procedural governance nonsense, but the proper application of risk management could save your company and your CV …”
The crucial words are ‘proper application’. Just now, there will be a fair number of FDs under more commercial pressure than they have ever known. It would be surprising if a risk-orientated approach to management was helping them escape the crisis.