Expectations of Risk Management Outpacing Capabilities

KPMG Survey 240x180It’s Time For Action

By KPMG

About the survey
In December 2012, the Economist Intelligence Unit carried out a global survey on behalf of KPMG international. This survey gathered data from 1,092 respondents around the world in a closed-ended online questionnaire. All were C-level executives: 28 percent were Chief executive officers or equivalent and 18 percent were Chief Financial officers, the two largest groups. Five percent were Chief risk officers. If you combine those in the risk function and departments that work most closely with risk (legal, compliance and audit), the number comes to 131 people, or 12 percent of the total. Responses were evenly spread among companies of different sizes. Forty- six percent came from companies with annual revenues of US$500 million or less. There were a lot of large companies: 37 percent reported revenues of US$1 billion or more. Most of the responses came from North America (25 percent), Europe (25 percent) and Asia-Pacific (23 percent). The remainder was from the rest of the world, including latin america (15 percent), Africa (8 percent) and the Middle east (4 percent).

The survey was answered by people from more than 21 industries. To make it easier to drill down into individual categories, we grouped respondents into sectors; Financial Services (including banking, insurance and so on) comprised 17 percent; technology, Media & telecommunications made up 16 percent; Healthcare comprised 15 percent; and energy and natural resources comprised 14 percent. Another large category was Diversified industrials (including manufacturing, automotive and aerospace) which made up 15 percent of the total. This left 23 percent from other industries such as consumer goods and chemicals.

Executive summary
Risk management is at the top of the global executive agenda as companies face an array of threats that grow more complex by the day. the risks are multitudinous and ever-present, and those companies that fail to manage them well imperil their future. Many risks are posed by the challenge of complying with complicated, new government regulations drafted worldwide in the wake of the financial crisis, affecting all industries. The global economy remains fragile, the eurozone wracked by a series of crises. economic growth in the developed world is weak and faster-growing emerging markets are unfamiliar to many corporate executives. At the same time, companies have to contend with increasing competition, rapid technological change and the battle for talent.

These challenges are growing faster than most organizations’ abilities to respond: today’s complex environment requires an even stronger capability to master and optimize risk management. This is the main finding of a large-scale study of risk conducted by KPMG international, based on a global survey of 1,092 C-level respondents that was deployed by the economist intelligence Unit in December 2012. The aim was to find out about executives’ perceptions of the risks facing their companies and their sense of how, and how well, their companies and industries are tackling them. We also interviewed senior executives in five major industries and turned to KPMG’s risk Consulting experts for their insights into risk management.

KPMG Survey Area 600xppp

We found the risk management capability is not advancing fast enough at most companies. Given the difficult challenges faced by companies around the world, the survey shows there are significant gaps and weaknesses in the management of enterprise risk. These problems often arise from an inability to manage risk in an integrated and holistic way. Executives say they take the ‘business of risk’ very seriously, but the survey shows that many enterprises are not rising to the challenge.

When risk management is a strategic tool, the risk program and profile will constantly evolve. now that the global economy has shakily recovered from the financial storm, executives have become less risk-averse. But they need to be more risk-savvy. After a risk program has been running for a while, things tend to go stale, says Dan Fitz, Group General Counsel and Company Secretary of Bt Group (Bt). “Keeping it relevant in an improving economic environment is probably the biggest risk that we face,” he says.

Among the main findings of the research are:

  • Risk management is widely seen as a high priority among companies surveyed, but only 66 percent build it into strategic planning decisions often or constantly.
  • Most companies surveyed do not have a consistent way of assessing risk across the enterprise. A significant minority of respondents (20 percent) say there is no process at their company to develop and aggregate a risk profile and a further 38 percent rely on a self-assessment by the business units. Almost half profess difficulties in understanding their enterprise-wide risk exposure.
  • Less than a fifth of companies surveyed have developed a formal risk appetite statement. But without one, it is hard to calibrate the risks of pursuing a given strategy. Are we taking on too much risk for a given level of return, or are we taking on too little? Many cannot answer this fundamental question.
  • The top risk perceived by senior executives is the growing regulatory pressure from governments around the world. C-level executives in almost all industries say this, not just those in Financial Services, where companies are facing arguably the greatest regulatory challenge in their history. A global economic crisis and geopolitical instability are seen as the most threatening risk scenarios across almost all industries.
  • Respondents say the business units (the first line of defense) are more adept than the risk and compliance specialists (the second line), as well as internal audit (the third), in assessing and managing risk. to the extent organizations have improved their risk management processes in recent years they have not effectively communicated it. Less than half (44 percent) believe the organization is effective at developing stakeholder’s understanding of the risk program. This means organizations often do not translate enhancements into value in the minds of the Board, investors and/or regulators.
  • Forty-two percent of respondents say that a lack of skills is the main obstacle to the convergence or integration of risk and control functions in companies.
  • Survey respondents admit they need to do more to motivate business managers to make risk-aware decisions by linking their performance in this area to compensation. Forty-three percent said there was a weak link between risk management and compensation.
  • Many companies understand some, or all, of these problems and are investing in ways to upgrade their risk management. Yet more than a quarter of respondents have no means of measuring the return for the investment and a similar proportion is simply reviewing past events to assess the effectiveness of their risk controls. Does this inability to measure the return on investment in conventional ways prevent investment altogether?

Companies have their work cut out to improve their risk management commensurate with the challenges they face. By ensuring that risk management is everybody’s business and not just a single department, companies have a chance to rise to the challenge. They have no other option. in the sections that follow, we will describe in more detail the problems laid bare by the survey and offer solutions, as well as pose questions for the reader. Read more >