Management has to give direction to the institution it manages.’ Leading an organisation to think about and act on risk and performance in an integrated way will no doubt face roadblocks. But, companies should focus first on a few key areas for integration and improvements.
Start at a strategy setting
Integrating risk and performance management takes place at strategy setting. First, there must be a full C-suite consensus on clearly defined business objectives - whether strategic, financial, or operational. Once they’ve defined those objectives together, then they can start identifying the key risks that may present an opportunity to pursue those business objectives or impede their ability to achieve them. Sounds simple, doesn’t it? But for many companies, that kind of risk-informed strategic plan begins gathering dust the minute the planning cycle ends.
Each industry faces challenging industry dynamics and unique risks. This presents opportunities for both value destruction and value creation. Some of the risks the company must confront include:
lStrategic risks - such as intense competition and the pace of innovation
lOperational risks - such as supplier disruptions and intellectual property theft, and
lFinancial risks - such as skyrocketing commodity prices and daunting pension plan liabilities.
It’s important to map the organisation’s key sources of risk against both the level of potential impact on performance and the direction in which those are trending. These represent the first step in such a sustained, strategic view (see the figure).
Armed with such a strategic view, the management team can more effectively manage the risks that hinder and opportunities that promote business performance. They’ll also be able to allocate resources and assign accountability where required. This is to prevent value destruction and improve both financial and operational performance.
Also, this view of risk and performance provides transparency in risk reporting to external stakeholders. It provides analysts and the market at large a better picture of the company’s risk environment. Once the market can understand and appreciate the company’s ability to manage performance based on its ability to manage risk, it will reward that company appropriately.
Your business metrics
When it comes to measuring the links between strategy and execution, less may actually be more. This means creating more strategic focus. Some essential risk informed performance indicators, which offer the greatest opportunities for value creation or value destruction, will serve a leadership team better than a long laundry list of metrics.
Among the financial measures mentioned earlier, including earnings volatility, capital optimisation, and capital adequacy, a few additional metrics are involved in strategy setting and decision-making. The two questions below - and the measures linked to their answers — might feature prominently in an integrated approach to risk and performance management.
-What have I really got to lose?
-How much shock can my balance sheet endure?
In the telecom industry, cable companies pay close attention to customer care metrics such as customer satisfaction, retention and loyalty. It’s because those metrics predict customer churn (the rate at which customers defect to competitors), which is a key risk indicator. Poor customer care metrics guarantee customer churn. External data also comes into play as risk-informed metrics. For example, unemployment rates provide a leading indicator of estimated churn in a cable company’s customer base.
In establishing an integrated view of risk and performance, every company will develop its own tailored toolkit of risk informed performance indicators. But whatever metrics a company determines to be most informative and actionable, the data underlying those measures must be consistent across the whole business for an integrated approach to risk and performance to stick.
Transforming disparate data into meaningful information
Moving toward an integrated view of business risk and performance doesn’t necessarily require an IT overhaul. For many companies, the information required to link up risk and performance data, and layer it into strategic planning and decision-making already exists. But it’s often buried in data silos and systems across business and functional units that never sync up. When the information is consistent and accessible across the organisation, leadership has access to well integrated insights into target areas that represent risks to, and opportunities for, operational improvement.
Creating accountability and incentives for integrating risk and performance management
When it comes to managing risk and performance, companies appear to be split in their approach to oversight.
In some sectors, such as financial services and energy, chief risk officers are most often accountable for risk management and mitigation.
But in many other industries, accountability for risk typically falls on the chief financial officer, with input from the chief operating officer. A centralised top-down approach to risk may work for some companies. As recent events have shown, an integrated accountability structure that provides appropriate incentives at every level of the organisation may be better suited to managing risk. In an increasingly interconnected business world, it may also help manage performance better.
Of course, from the C-suite to the people on the work floor, giving incentives for behaviours that create a culture of risk-based performance management often requires the power and patients of compensation to drive accountability.
Written by Stephen Gaskill, Edward Chien and Bart Ziemerink. All have extensive working experiences in advising organisations globally. This article is based on a past study executed by PwC, ‘Seizing opportunity, linking risk and performance’.