Strategic Risk Gains Prominence

Although risk management has increasingly taken on a strategic role within many organizations, there is still uncertainty about where primary responsibilities for executing risk management strategy reside and whether risk management is being used to its full potential, according to a study released by Marsh and RIMS (the publisher of this magazine).

The 11th annual Excellence in Risk Management study, titled "Risk Management and Organizational Alignment: A Strategic Focus," found that 93% of C-suite executives and 87% of risk professionals agreed that risk management has an influence on setting an organization's business strategy. Three-quarters of executives and 60% of risk professionals confirmed that their organizations treat risk management as a key strategic function.

But when it comes to who has the primary responsibility for executing risk management approach and strategy, there was some disagreement. Although 47% of risk professionals thought this was their job, only 16% of C-suite executives agreed. Instead, 39% of executives looked to the CFO to execute risk strategy, while others favored the CEO (16%), chief counsel (12%) and COO (10%).

Nevertheless, 69% of the C-suite and 75% of risk professionals agreed that their organizations were managing risk effectively. But there is room for improvement. About half of C-suite executives and 43% of risk professionals thought the organization was not taking full advantage of the capabilities of the risk management function.

One of the ways for risk management to reach its potential may be through the increased use of data and analytics. "C-suites and boards are asking risk professionals for much more than what insurance coverage is in place. They want to know what unexpected risks the organization may face, and where to invest capital most effectively," said Brian Elowe, a managing director at Marsh. "If used properly, data and analytics can help organizations make better business decisions while at the same time increase the profile of risk management within the organization."

C-suite respondents thought that data and analytics would help the organization the most by improving risk mitigation and risk identification. Risk professionals, however, ranked understanding the organization's risk capacity and finding the right mix of analytics and qualitative methods as the most important benefits of data.

The study also suggested that, in order to continue raising their profile, risk managers could act as "risk knowledge centers" and help their colleagues understand the impact of various risks across the company. This would help address some of the biggest gaps in performance within risk management, as identified by both executives and risk professionals-integration with operations, lack of cross-organizational collaboration and educating others on key risk management practices.