This morning, I would like to talk about some of the changes we are seeing in the practice of risk management and reflect on important priorities for risk management as observed from our work at Bank Negara Malaysia with the financial industry. I will then offer some brief perspectives on business continuity management and close with some final thoughts on the prospects for the insurance industry in Malaysia to contribute towards the advancement of risk management capabilities across Malaysian businesses. Changing practices in risk management Since the financial crisis, risk management practices have come under intense scrutiny. The spectacular failures in risk management in the lead up to the crisis prompted deep reflections on what had gone wrong with risk management systems and practices – not least of all among companies that had invested heavily in sophisticated risk measurement and management systems only to have them ultimately fail to detect or control risk exposures. Closer to home, businesses in Malaysia are currently facing a set of challenging business conditions and some are likely to find themselves ill-prepared to respond to the challenges, with important implications for their future prospects. So what can we learn about the changing practice of risk management from these experiences? A first observation to my mind concerns the importance of building a strong risk culture supported by governance arrangements that are explicitly aligned to a firm’s risk appetite.
Few companies have robust risk management frameworks that incorporate measures of how their products and services affect the well-being of consumers or if consumers are being treated fairly, as long as legal exposures are contained. And efforts to adopt triple bottom line approaches to reporting firm performance are only beginning to gain traction. Within Asia, fewer than 10 banking institutions today subscribe to the Equator Principles for assessing and managing the environmental and social risks for projects. Clearly the gap between the existing risk management practices and a whole-of-business approach which fully embraces broader aspects of risks remains large. Regulation and greater shareholder activism will remain important drivers of change, and in my view, so will a new breed of risk managers who effectively integrate traditional and emerging risk perspectives, and who can speak to these perspectives in a compelling and cohesive way to an organisation’s key stakeholders. A third observation that I want to make today relates to the increasing importance of viewing risks over a longer-term horizon, and imagining the unthinkable. I mention these together for a reason. When one is focused on looking both backward and forward over a reasonably long horizon, the universe of what is unthinkable becomes smaller and our vision is less likely to be blinkered by limited experiences of only the most recent past. We are also likely to become more open to broader possibilities of new and emerging risks on the horizon.