|
|
|
Business Review 2006 from
|
|
How to manage reputational risk factors
Louise Grinstead
BakerPlatt
Three of the key components of reputational risk are compliance risk, legal risk and continuity risk.
A large part of BakerPlatt's advisory work is assessing how businesses identify and manage these risks.
Our experience shows that a significant amount of good work has been undertaken by many Island firms but that there is still much work to be done, particularly in the areas of risk identification, quantification, prioritisation and management.
This appears to be as a result of a variety of factors including:
lA lack of appreciation that risk management is not only about preventing bad things from happening, but also about ensuring that good things happen - that is that business objectives are met;
lThe absence of a coherent business strategy with measurable business objectives. Unless business objectives are measurable it is impossible to evaluate the contribution that risk management practices can make to their attainment.
lThe absence of a coherent risk appetite;
lInsufficient consideration of the importance of human factors within a business as well as formal risk management systems. The harm done by a dominant individual who encourages circumvention of rules can far outweigh the benefit of a glossy procedures manual, as many scandals in recent years have demonstrated.
The first challenge is to formulate a business strategy with measurable objectives. The risks inherent in the strategy should then be identified and quantified. A decision must then be taken about whether those risks are acceptable both qualitatively and quantitively. At this juncture the risk appetite is set.
An assessment then needs to be made of the relevance and adequacy of existing risk management systems and people, taking account of experience and competence. This exercise is not a one trick pony. It is a continuous exercise. As new objectives are set, or existing objectives adjusted so the consequential effects must be considered.
The board must then monitor operational performance in pursuit of the business objectives. This does not only involve assessing the figures. It also requires the monitoring of operational compliance with the risk management systems that have been implemented to encourage the business to meet those objectives.
An effective risk monitoring programme is an essential prerequisite, lacking in many firms. The absence of issues or problems serves in such firms to validate risk management culture. Nothing could be more dangerous. Frequently the first that such firms will know about a deficiency will be when it is too late to take corrective action. The damage will have been done and the inevitable scrutiny occasionally by third parties including regulators will need to be faced.
The point is simply this. To create an effective corporate governance environment a firm must do more than pay lip service to risk management. Risk management and corporate governance are inextricably intertwined.
Human factors is also critical. In many crisis situations, we establish that part of the reason for control failures is a unilateral decision by a staff member that a procedure did not apply in a given set of circumstances. In hindsight such a decision is rarely defensible.
Other human factors that are to be frequently observed are: dominant individuals; confirmation bias; internal reliance vacuums; bonus-driven cultures and the fascinating dynamic which is the commercial pressure to transact exerted by onshore offices on offshore counterparts.
Each business is nothing more than the sum total of each of its individual employees. Consider the last time you changed job. As soon as you took up your new post in a new firm or in a new department you observed differences.
In the 'space' from which those differences flow exists the human factors that influence the effectiveness of risk management practices.
Too few businesses have either the resource or the sophistication to invest in human factors in addition to the design and implementation of formal controls.
Those who do experience immediate benefits.
So why invest in an independent review of part or the whole of your business?
lWell it's just that, independent. There is no motivation to disguise risks or protect empires. The information is therefore the Golden Nugget board members desire.
lThe independence also means that the cultural straight jacket with which the firm wrestles does not impede the advisory firm.
lThe solutions provided are rarely limited to procedural amendment but are focused around changing the behaviour of all levels of staff and, dare I say it, board members. Something an internal review might well avoid.
The mere act of engaging with a firm to provide an independent insight sends a powerful message to all stakeholders that managing the risks to the brand is key to that firm's success.
So how do you select the right partner?
lSelect a firm who sees the relationship as a partnership and wants to build a greater understanding of your firm over time.
lEnsure the firm appreciates the pressures of running your type of firm. Select one that can provide a bespoke response that compliments existing methodology, not a plethora of new procedures and controls that divert attention unnecessarily.
lA firm needs to ensure ancillary services are available, such as legal advice or training and awareness programmes. These services help embed new practices at an early stage.
Above all, you will be letting an advisor into your 'inner sanctum' in which case you need to trust them and believe their work will deliver that sought after change in behaviour.
Independent insight will lead to boardroom foresight.
|
|
|
|
