Beware of “too much, too late’ risk management

The global credit crunch and slew of corporate and banking failures has catapulted risk management into the spotlight. But this could be a case of “too much, too late”, says Bevan Smith, senior manager, Operational Risk Management at The IQ Business Group.

According to Smith, effective risk management is about being prudent in good times as well as bad. It’s about setting tolerance parameters for corporate performance and when things move outside those parameters, asking why. It’s about asking whether good performance is sustainable and poor performance is likely to continue and whether either is setting the organisation up for failure.

“Unfortunately, it’s a very rare breed of executive who will question why his or her organisation is making excessive profits or whether a lucrative practice (think sub-prime mortgage loans) is sustainable,” he says.

Smith is concerned that in the wake of the financial crisis shock, there could be an over-reaction with the risk management pendulum swinging back so far, it could actually stifle recovery.

“If businesses and financial institutions attempt to eliminate even a modicum of risk from their operations, that could threaten the organisation’s longer-term sustainability.

“As much as the financial and business sectors have been shaken up, executives need to remember that simply being in business always involves some risk. It’s how that risk is managed that’s important. The global financial crisis occurred largely because credit risk was not managed well, not because lending money is bad,” he adds.

Ultimately, Smith continues, organisations need to be clear about their purpose in life. They need to be able to define who they are, and where they are going so they can see where and how they should be playing. Nothing should be allowed to interfere with that.

“Risk management plays in key role in ensuring the organisation is positioned to achieve its goals, but risk management in itself should never be allowed to become the strategic goal,” he says.

Risk tolerances can and should be adjusted to accommodate market changes and risk management needs to look at what the organisation should be doing in different scenarios. There should be constant reassessment based on what is happening both in business and the market.

“What businesses should be doing right now is integrating what business wants to do and how risk management will help to manage that. Risk management must be used for decision support and to identify when risk has moved outside agreed, acceptable parameters. But the very last thing it should be doing is stifling daily business operations,” he concludes.