What makes a good risk management function in 2024?

In an ever-evolving landscape marked by swift technological progress, expanding global markets, and shifting geopolitical dynamics, the essence of risk management is being redefined.

According to Neil Hodgson (pictured above), managing director of Risk Management Consultancy at Gallagher, organisations across all sectors must navigate a labyrinth of operational, financial, and strategic challenges to safeguard their assets, ensure compliance, and foster resilience for sustainable growth.

The current and future operational risks identified by Hodgson underscore a rapidly changing environment where businesses confront increasing complexity and uncertainty. Supply chain disruptions and geopolitical tensions have heightened the competitive stakes, urging companies to seek robust risk management strategies that ensure resilience and agile response mechanisms.

Amidst these challenges, companies are recalibrating their risk management approaches to better align with volatile market conditions. This recalibration involves a mix of enhancing in-house capabilities and adopting hybrid models that leverage both internal and external expertise, highlighting the adaptability necessary in today’s uncertain landscape.

Hodgson emphasised the pivotal role of a comprehensive risk management framework, which guides businesses in identifying, assessing, and mitigating a spectrum of risks. This framework is especially crucial as businesses strive to diversify, minimise costs, and explore new growth avenues, all of which may introduce greater complexity to their risk profiles.

A “flip side” for risk

“Businesses should ideally be looking more closely at their risk profile at this time, and how it helps their business move forward,” Hodgson said. “While some of us view risk in a negative light, there is the flip side where risk enables opportunity and growth. Considering the range of risks that exist in your business helps to identify something that could go wrong, gives you the ability to put it right before it causes a problem. That’s an opportunity to do something better. Ultimately, it’s important to view each risk in context. It’s often easy to overlook that aspect.”

The efficacy of a risk management function, according to Hodgson, varies significantly between large corporations and mid-tier businesses, with the latter often demonstrating more advanced and integrated approaches.

This disparity underscores the critical need for organisations to closely align their risk management practices with their operational realities, particularly in light of the resilience tested by the recent pandemic.

“The pandemic shifted how people view risk, providing a valuable test of resilience and preparedness,” he said. “It was a pivotal moment in time across all industries and sectors. Moving from assessing risk on paper at a strategic level to actually going into the business and directly resolving the issue, shifted the process from reverse engineering once a problem happened, to understanding why this issue could occur and finding a way to rectify that issue.”

Managing the risk register

A key tool in strategic risk management, the risk register, when properly curated, can streamline priorities and foster a collaborative approach to leveraging risk for growth. However, Hodgson warns of the pitfalls of an overloaded risk register, advocating for a focused list of high-priority risks that facilitates targeted discussion and action.

“It’s not unusual to see a risk register with say 50–100 items on it. It should set out the 10-15 highest-priority risks simply and effectively so that key stakeholders understand the risk at root cause level… A reset to focus on a maximum of say 10 high-priority items can be a game changer. It’s focused, it presents the important detail, and the discussion is targeted and prioritised,” Hodgson said.

Moreover, Hodgson advised on the importance of an external perspective in developing an effective risk management framework. Too often, organisations falter by relying on generic, self-made plans that fail to address specific needs and complexities.

The engagement of seasoned risk management experts early in the process can significantly enhance the strategic depth and practical relevance of a risk framework.

“Businesses often bump into issues and gaps in a self-developed ERM [enterprise risk management] framework when it’s generic and high level,” Hodgson said. “They can misunderstand the premise and lack a robust methodology to build the framework, and ultimately how to utilise it. That’s where specialist advice from an experienced risk expert asking the right questions can be advantageous.”

“We’ve seen examples of businesses going online, printing a plan, or risk framework template, put their name on it and sending it off. It’s not fit for purpose. At best it ticks a box, and while people are happy ticking boxes, they’re storing up a problem for a future date,” he said.

What makes a good risk team?

Effective risk management requires a comprehensive and interconnected perspective, and by breaking down internal silos and fostering cross-functional collaboration, risk teams can gain a complete understanding of the risks their organisations face, assessing their significance and determining how to prioritise them effectively.

Hodgson emphasised the importance of a partnership-oriented approach within the team, which involves building robust relationships across different levels of the organisation and combining strategic agility with a capacity for rapid response.

“Businesses are operating in a highly dynamic environment right now, leaving owners, operational leaders, and executives juggling a complex agenda. The conversations surrounding AI and ChatGPT are a moving picture, and the use case is still not fully understood,” Hodgson said.

“People and workplace transformation are a heightened risk at this time as the war for talent continues, and employees gradually return to the office, and flexible working patterns are fully bedded into business operations,” he said. “Inclusivity, diversity, and mental health awareness are on the agenda and central to employee satisfaction. Talent retention and leadership capability will be key to delivering business plans and ensuring longer-term success.”

What are your thoughts on this story? Please feel free to share your comments below.