By Gary Lynam, Director of ERM Advisory, Protecht
In today’s hyper connected, yet highly uncertain business world, effective risk management is becoming critical to long term survival and prosperity for organisations of all sizes.
For mid-size companies in particular, the first challenge is often moving from a basic Excel-oriented approach to a more unified risk management system. However basic risk management tools that work in silos can not properly connect the dots across a wide range of key business areas, including regulatory obligations, audit findings, and important business services.
With an Enterprise Risk Management (ERM) system in place, companies are much better positioned to spot dangers or potential eventualities on the horizon and take the steps needed to mitigate them before they can derail future operations.
But what exactly is ERM, and how can companies go about implementing it effectively? This article will take a detailed look at ERM, explore some of the main internal barriers to implementing it and discuss how businesses can overcome these as effectively as possible to gain a return on investment through efficiencies and savings in risk event reduction.
ERM for Risk in Motion
Mid-size companies around the world today face an incredibly challenging business environment. New risks are constantly emerging, existing ones are changing, and regulatory requirements around audit, risk, resilience, and compliance are evolving at a rapid pace, making it harder than ever to spot potential threats.
In the past, many smaller companies traditionally managed their data and processes manually, using spreadsheets, emails, and sometimes messaging platforms such as Slack or even Teams. However, in such uncertain times, it’s increasingly clear that these siloed approaches simply don’t cut it anymore. In some cases, they even create risks of their own at an operational level.
Companies should now see risk is continuously ‘In Motion’. What we learnt from the rapidly changing Covid-19 landscape is that a dynamic review of risk has never been more important. This requires a well embedded and well operated ERM framework and processes to be lent upon. It is time to bring risk management into action with the ability to continuously and proactively monitor and assess changing information, including identification of evolving threats.
With this in mind, it’s no surprise that there’s been a widespread shift towards ERM amongst mid-size companies in recent years.
ERM solutions support the management of risk in both a holistic and an actionable way, using technology to analyse enterprise and operational risks at all levels within the same platform, in real time. Leading ERM solutions also support best practice risk analytics – such as bow tie analysis – dashboards and reporting, to enhance communication about risk across the entire workforce.
Such solutions not only improve data quality and help manage regulatory change, but they also enhance the quality and timeliness of reporting to decision-makers, meaning good decisions can be made faster at all levels of the business.
Overcoming barriers to realise the benefits
Despite the undeniable benefits of adopting ERM today, many companies run into a number of barriers when attempting to implement it effectively. These generally fall within three main categories:
- Risk culture – How people act and behave when it comes to risk management. Factors associated with risk culture may include a lack of budget for technology investment, a conservative unwillingness to engage in major transformations, or a lack of perceived importance when it comes to risk management as a business priority.
Successfully addressing these factors requires a focus on identifying key stakeholders and convincing them both of the business efficiency benefits ERM solutions offer and of the risks of continuing business as usual.
- People – Individuals and teams can sometimes be against investment in ERM solutions because they fear job loss from automation, control loss from wider use and access, or increased scrutiny.
Addressing these factors requires a focus on the positive benefits of the ERM solution both to risk management and general business teams. Doing so shows the impact will be to free up time to generate business benefits and provide managers with better, more actionable insights.
- Advisory – The organisation does not have confidence that it has the expertise to evaluate, implement, mature, and evolve an ERM program, even if key stakeholders believe that one would be desirable.
Addressing these factors requires an understanding of the options available for help with generating business cases, working with risk experts to specify the solution required, and implementing the software and associated process changes to the organisation.
Now is the time to reap the rewards and thrive
The time to consider implementing an ERM technology platform is now. With so many risk, compliance and audit challenges out there today, attempting to manage them all manually, in silos, is no longer a safe or effective way to achieve organisational objectives, and continuously monitor risk and evolving threats.
Implementing an ERM approach, supported by technology and the right implementation team, enables mid-size companies to manage these challenges in an automated, interconnected way at both a strategic and a tactical level. Doing so will lead to a host of positive outcomes including better decision-making data, improved risk, and compliance management, and enhanced regulatory relationships.
Adapting a ‘Risk in Motion’ approach is about embracing risk as an opportunity to reap the potential return of investment a ERM platform can deliver through efficiencies and savings in risk management processes.
Looking further ahead, it is those with a robust ERM approach in place who will be best positioned to adapt and thrive, regardless of what the future holds. So don’t be left behind.
