Clearing the confusion

Everyone, it seems, is into risk. I have met nursery school workers, residents' associations, teachers and social workers who carry out 'risk assessments' as a routine part of their work - a concept that barely existed 10 years ago, outside of a few specialist circles.

Yet, do they really understand what the term means? For that matter, do businesses have a shared understanding of what it means? I expect not. If you asked 10 board executives what they understand by the phrase 'risk management', you would probably get 10 different answers.

Professor John Adams, a leading risk academic, will address this issue next month when he speaks at the Association of Insurance and Risk Managers' conference on the subject of Compulsive Risk Assessment Psychosis (the acronym this creates is intentional). Professor Adams is a great supporter of risk management but, like many of us, he is frustrated at the way the term is misused. In his seminal book, simply entitled Risk, he points out that a lot of what passes as risk management is really just back-covering.

Such an attitude can stifle enterprise - the one quality that we should value above all else. It is the duty of organisations such as Airmic to create a better understanding of risk, and we accept that our organisation should become more proactive in this area.

By way of illustration, consider compliance. Compliance is a growth industry, especially within financial services, and one where a lot of activity goes under the risk management heading. Someone has to do this work, but its main aim generally is to protect shareholders or customers. It does not add value to the business, and it is only a very small part of the risk management jigsaw.

Covering your assets

Insurance is rightly seen as a very important aspect of risk management. A speaker at a recent Airmic seminar pointed out that a firm's insurance programme can sometimes be its single biggest asset, and this could be equally true for smaller companies that cannot raise contingent capital as easily as bigger ones. Constructed creatively, it will promote initiative and encourage the taking of responsibility within an organisation, as well as help to make full use of capital.

But again, there is much more to the risk management profession than buying insurance. I know of one large South African firm, for example, which decided that none of its top 15 risks could sensibly be covered by insurance.

So, let's establish what we mean by risk management. It is a strategic exercise, conducted on an organisation-wide basis. The process is described in more detail in the Risk Management Standard, which can be downloaded free at www.airmic.com. Essentially, it is about identifying and prioritising the risks inherent in any enterprise and then managing those risks.

This can mean mitigating, removing or even exploiting them. And the process often includes a significant element of risk transfer - that is, insurance. But the real aim must be to help identify opportunity, as well as to avoid the bad things that can happen to any organisation; the outcome should be to make a business more competitive and more profitable.

Consider two problems - simple to understand, but complicated to address. If you own a clothes shop and Marks and Spencer opens next door, your business is at risk. You could see it as a threat and close down. Alternatively, you could see it as an opportunity to offer the crowds of potential customers arriving in your street the specialist clothes they might not find in M&S.

Now, take a multi-national manufacturer. Are you happy to have one factory produce key components worldwide to achieve economies of scale? Or would you rather have two production outlets, each putting up costs slightly but reducing the risk of supply-chain disruption?

These kinds of decisions will be taken at board level, but it is the risk manager's job to identify the issues and facilitate the discussion. Conducted within the appropriate framework, it will encourage innovation, because there is no need to fear risk. If you know the limits of the risks you face, and have taken steps to manage them, you can actually become more adventurous.

Yet, sadly, very few firms in the UK - with the exception of some in the financial services sector - truly implement this kind of enterprise risk management. In this respect, we are falling behind our competitors in some European countries, most notably Germany.

Introspective industry

So where does all this leave risk managers and their association, Airmic?

Above all, we must do more to communicate and educate. As a community, risk managers have perhaps been too inward-looking, although this has started to change in recent years. We must continue to get out there and spread the message to a wider audience - the message that there is more to risk management than just being defensive.

This was the main reason behind setting up Airmic's new training subsidiary, Risk Publishing Online. It is also why we continue to organise enterprise risk management workshops, which to date have always been over-subscribed. And it is why we shall be unveiling, at the conference, details of a major new project involving an independent research company to investigate how ERM can help businesses become more competitive. It will be a long road, but we approach it with enthusiasm.