It is striking that, in the last five years, global standard setting bodies such as the Basel Committee on Banking Supervision have moved to address risk culture, risk appetite setting and risk governance more explicitly in regulatory standards. This was not the case prior to the crisis, when emphasis was predominantly placed on risk management processes and systems, believing that this ought to be sufficient. Organisations largely failed to take into account behavioural biases that play such an important role in senior management decisions which ultimately affect the risks that a company will be willing to take or tolerate. These decisions include how performance targets are set for staff, how incentive structures are designed, and the stature and resources that are provided to risk management functions within the organisation – all of which can create a constant uphill struggle for risk managers to have any meaningful impact on risk outcomes. To illustrate the point, a report published by  BIS central bankers’ speeches  1  the Office of Financial Research in the United States observed that much of the advancements in risk management over the last decade have resulted in a highly analyticalfocused discipline, while largely ignoring the fundamental drivers of risk-taking that are rooted in more subtle behavioural characteristics. Within the financial industry, financial institutions in Malaysia are required to establish a wellresourced independent risk management function that reports directly to a board risk committee, and take active measures to promote a prudent risk culture in the organisation.
Few companies have robust risk management frameworks that incorporate measures of how their products and services affect the well-being of consumers or if consumers are being treated fairly, as long as legal exposures are contained. And efforts to adopt triple bottom line approaches to reporting firm performance are only beginning to gain traction. Within Asia, fewer than 10 banking institutions today subscribe to the Equator Principles for assessing and managing the environmental and social risks for projects. Clearly the gap between the existing risk management practices and a whole-of-business approach which fully embraces broader aspects of risks remains large. Regulation and greater shareholder activism will remain important drivers of change, and in my view, so will a new breed of risk managers who effectively integrate traditional and emerging risk perspectives, and who can speak to these perspectives in a compelling and cohesive way to an organisation’s key stakeholders. A third observation that I want to make today relates to the increasing importance of viewing risks over a longer-term horizon, and imagining the unthinkable. I mention these together for a reason. When one is focused on looking both backward and forward over a reasonably long horizon, the universe of what is unthinkable becomes smaller and our vision is less likely to be blinkered by limited experiences of only the most recent past. We are also likely to become more open to broader possibilities of new and emerging risks on the horizon.