We are seeing unprecedented levels of political uncertainty and ever-increasing regulatory scrutiny. Rapid technological change and climate change challenges, meanwhile, are impacting many organisations. Board members now have to deal with increasing uncertainty and complexity so, unsurprisingly, risk is a matter that now sits high up on their agendas.
Risk has always been a topic for board consideration. The UK Corporate Governance Code sets out the board’s responsibility for risk and other sector governance codes have similar provisions. Boards’ approaches to risk as an agenda item varies but, too often, this involves little more than a review of the top scoring items on the risk register. At its worst, the discussion becomes little more than a debate about whether the scoring of risks is right, rather than more substantive discussions about how to respond.
Given the rapidly changing environment and the number of corporate failures we continue to see – no need to list them all here - it is time for boards to rethink the way they approach risk. The starting point is to recognise that risk is pervasive in everything the organisation does and all decisions a board makes involves consideration of risk. So, every board should explicitly embed risk thinking in all its discussions and decision making.
To be fair, many boards will give risk a good airing when making big decisions. For example, when assessing an acquisition opportunity, downsides are considered. But it is worth the board thinking about how its risk assessments can be enhanced. Making sure the whole board has a sound understanding of the business environment is the starting point, and regular ‘CPD’ sessions – particularly involving outside presenters – can help give board members a more effective basis for understanding risk in the context of business strategy. Creating better awareness of possible biases when challenging management assumptions will also help and, to address this, some boards undertake unconscious bias training.
Even where risk is embedded across board discussions, that is not to say that there is no value in risk appearing as a periodic agenda item in its own right. A ‘deep dive’ session on key risks give board members the opportunity to reflect on major risks away from the heat of decision making. The risk agenda item allows the board to consider how risks might be linked. It also provides an opportunity to think more strategically about risk by reflecting on how risks align with strategic objectives and to ask whether enough is being done to bring them within risk appetite.
But the risk item on the agenda is also the chance for the board to go beyond just concerning itself about downside risk and to consider whether uncertainties also present the board with new opportunities they can take advantage of, or whether the organisation is operating too far within appetite. So, when reviewing principal risks, boards should proactively and consistently also consider upside opportunities.
As far as risks are concerned, boards readily focus on ‘known’ risks, particularly where issues have arisen in the past. As a result, emerging risks often do not get enough attention. So to address this, as a starting point, boards should make sure they understand their organisations’ horizon scanning processes – and ask what work is actually done, in a structured and systematic way, to identify new risks?
Boards should also consider undertaking scenario analysis to assess emerging risks, particularly where future outcomes are highly uncertain or the impact of future events are significant (e.g. geopolitical risk). In these situations, scenario analysis can have important benefits as it forces the board to think longer term and more strategically, and it encourages agility.
This is particularly the case when underpinned by a diverse board that brings broad experience, varied viewpoints and a willingness to challenge.
Supporting a board’s work, of course, is the work of its committees. Each will have oversight of certain risks – the remuneration committee for incentive risk, for example – and boards should make sure they have a clear picture of which committee has oversight responsibility for which risks. Committees need to work in a joined-up way to ensure there are no gaps or overlaps in risk oversight.
Though unusual in other sectors, separate board risk committees are expected in financial services firms but they suffer from an absence of principles-based guidance about their role and remit. The Risk Coalition’s first project developing this guidance will help risk committees think more strategically and holistically and will be a useful source of reference for those outside of financial services too.
As the external environment gets increasingly uncertain and complex, boards need to ensure they adopt a strategic approach to risk. To do this, make sure you build on a strong understanding of the external environment, give sufficient focus to emerging risks and consider how risk creates opportunities for your organisation.
Author
Hanif Barma
Director, Board Alchemy
About
Hanif Barma is a board, risk and assurance specialist and director at Board Alchemy. He is also a co-founder of the Risk Coalition.
