Monday, April 30, 2007

Risk Management & IT: A Marriage Made in Heaven

Remember that you heard it here first: The eventual combination of formal risk management with technology driven disciplines will revolutionise the way businesses realise genuine enterprise risk management - the holy grail of the risk professional and a key enabler of boardroom and executive decision making.

Although risk management is still a relatively immature discipline in most organisations, the development of risk management is assured through internal teams and external advisors. But what happens when risk management processes become 'mature' in an organisation?

The simple truth is that no matter what the area of expertise or professional discipline, at a certain stage of its development - it will become a silo. Executives in all areas become confident in their teams, their processes, their reporting. They will tell you that they are doing their bit. They go to conferences and learn from peers, swapping war stories and methodologies on how to improve their corner of the company - and there is nothing wrong with this.

The trick though is connecting specific areas together and ensuring that they form a consolidated enterprise.

Now, of all the areas of process management in a business, risk management offers one of the most profoundly information-rich sources of critical data, giving clues to overall corporate performance. This effects not just the risk profile but the culture, the thinking, the reporting regimes, cost of business, speed to market, the hierarchical structure; even the effectiveness of individual line managers.

Truly integrated risk management will not simply identify and mitigate the dangers to corporate health and well-being. It will impact the very quality of corporate decision making, save costs, and drive positive change.

So, true risk management requires that the business avoid the 'risk silo'. But how?

Step by step, from a thousand foot view, here it is:

  1. Start by constructing your enterprise risk management programme and see it through to maturity.
  2. Then automate that programme using appropriate software toolkits
  3. From there consider the data you are creating, the database that the information resides on, and then ask yourself this:

"How do I use this data to add value back into our corporate objectives, our bottom line, our decision making?"

In our business, we are engaging in increasing numbers of conversations which focus on the integration of risk software into business intelligence applications, banking software, HR software and the like. By integrating these systems, it is possible to create a much larger roll-up of meaningful data and information - regardless of its source - and distribute it through line management, the executive and up to the board in formats which are meaningful to each audience.

Most critically, it is about connecting the divisions of a business with common data, recognising common risk and common opportunity.

We all know that the information a risk manager possesses is of huge importance, but when placed in this context - how much more critical might that data be to overall corporate performance?

Aarron Spinley is a member of the Risk Management Institute of Australasia, and the NZ Society for Risk Management. Datasouth Corporate Services provides both risk and technology advisory services on both sides of the Tasman.