But encouraging a strong focus on providing as much clarity as possible in setting the risk appetite for the organisation sets the tone and internal conditions for ongoing improvements in risk culture; it provides better alignment between business decisions and a firm’s risk tolerance; and ultimately, delivers a better balance between taking on too much risks and inhibiting the kind of innovation that we depend on to build successful businesses and economies. Achieving these outcomes is more urgent than we might think. In an online poll by Marsh last year, 91% of risk professionals agreed that understanding technological innovation is crucial to stay at the forefront of their industry. This corroborates the 2017 Excellence in Risk Management report – also by Marsh and the Risk & Insurance Management Society – which revealed that more than 90% of companies are either using or evaluating disruptive technologies, such as the Internet of Things and wearable technologies. Yet, more than half of organisations have not conducted risk assessments to deeply understand the risks associated with disruptive technologies, much less define the organisation’s appetite for such risks. Less than half (48%) of respondents said they have a cross-functional risk committee that manages these risks, never mind how effectively. And even this percentage has dropped from 52% in 2016 and 62% five years ago. These observations point to considerable scope to improve current approaches to risk management – at a time where business lines are already venturing into unchartered territory.
Moving beyond risk measures to risk narratives Innovative risk management will also require new ways of looking at measures of risk. While financial measures of risk are not likely to go away anytime soon, a good place to start is by acknowledging that financial models do not, nor are they likely to, fully and perfectly account for how firms will be affected by risk events. In his book, “The End of Theory”, Richard Bookstaber who was also a former regulator at the US Securities and Exchange Commission, wrote that we cannot know where we will end up until we take the journey. And we cannot retake that journey once completed. This raises some important issues for how firms set and maintain limits that define their risk tolerance. It does not mean that we should necessarily throw out conventional risk measures. But it does mean that we need to supplement them with the ability to develop and maintain a richer risk narrative that is perhaps less precise, but much more informative. Moving away from more mechanistic approaches to controlling risk calls for strong discipline and higher levels of competence among business and risk managers. Where there are no bright lines, effective risk responses will depend on firms setting up a process that can bring together diverse perspectives and data sets; encourage rigorous debate and dialogue on risk developments; and build an informed consensus on how much risk an organisation should be willing and able to take to achieve its business goals.