Think about risk management in organisations over the last decade or two. Now try to contemplate what the near and mid-term future holds for those same organisations and the profession itself. Data and its secrets have become pervasive, technology is developing exponentially and business models are being disrupted on an almost daily basis. What does it all mean and what are the implications for you, for your organisation and for risk management?
The increasing velocity of change
It is hard to imagine how these major changes, sometimes collectively referred to as the Fourth Industrial Revolution*, will impact on organisations, individuals and society as a whole. An analogy might be of assistance.
Think of a river - up until recently, this river was flowing reasonably predictably; there were sections with eddies, dangerous currents and rapids of course but, from a risk viewpoint, emphasis could be on navigating the parts between the rapids as effectively and productively as possible. When turbulence rocked the boat, it was a matter of pulling through somehow to the next section of more peaceful flow.
Now, the river is in flood and rapids are everywhere. From a risk viewpoint, they can’t be neglected, and management focus and policies need to address them. After all, rapids, if not now, will soon make up most of the river, with peaceful flow being the exception.
So how will this increasing pace of turbulence and disruption impact on risk and its future? How will risk look, not only at one section of the rapids, but prepare and be ready for a succession of rapids, dangerous currents and eddies?
Understanding the risks is just the start
Risk management, broadly speaking, has up to now been mostly and justifiably concerned with the first type of risk - the 'normal' river where a reasonably predictable flow dominates and there are isolated unforeseen events.
However, we believe that it is reasonable to postulate that the second risk perspective, of turbulent flow where eddies and rapids rule, is the one that will likely dominate in the future. It follows that the ‘future of risk’ will be linked to developing models and strategies for dealing with the dynamism, unpredictability and relentlessness of turbulent flow. This, we believe, is a major challenge that will rapidly migrate closer to the C-suite.
This brave new world of risk will have some of the characteristics of our current practice but will be challenged by new elements at almost every turn.
Whilst identifying, quantifying, prioritising and treating risks will remain core competencies, dealing with emerging risks will require enhanced skills - and key will be dealing with them at speed. The rate of change will continue to accelerate and as such, business leaders and their supporting risk functions need to be able to read and respond to the changing environment in a positive and timely manner. Strategies, plans and projects will need to be extremely agile - able to stop, start or change direction as the operating environment is continually reshaped.
Risk Managers will rely more heavily on data - from information systems and from sensors that collect real time intelligence. The risk manager of the future will leverage new technologies to access, process, interpret and report on the vast amount of data available.
And the 'connectedness' of organisations will challenge businesses and risk managers to better understand risk across vendors, service providers, utility companies and the like.
However, the effectiveness of businesses, and the risk function itself, to deal with the conditions in this intense new environment will be predicated on a key issue - capability.
Capability and culture - an essential eco-system
It behoves risk management then to take an active role in creating the right conditions for the organisation to anticipate, evaluate and respond to the emerging risks generated as a result of the fourth industrial revolution.
New business models, tailored to the turbulent environment, will emerge to create the transformative organisation of the future. These models will be bespoke to each organisation incorporating its risk maturity, cultural settings and its various capabilities.
Risk is best understood as being linked to the ecosystem the organisation operates in. An ecosystem is a complex network of interconnected resources – people, machines, data & software, suppliers, and customers to name a few. For organisations to have the capability, and therefore the agility, to cope with the expected turbulence, these elements will need to work in harmony.
Here we consider the ‘capability and culture ecosystem’ which is a subset of the total ecosystem organisations operate in. The importance of the capability and culture ecosystem is that it determines, to a very large extent, the organisation's resilience to turbulent environments; that is to change, innovation and transformation pressures. A strong capability and culture ecosystem is associated with high competitiveness and risk maturity and, conversely, a weak ecosystem corresponds to low competitiveness and risk maturity.
How do you define the capability and culture eco-system? It may be summarised as follows:
'The values, models, methodology and infrastructure put in place by the organisation to develop, nurture and leverage its ability for change, innovation, transformation and execution.'
The key benefits for the risk professional are clear. Improving capability, and therefore business performance, means increased relevance of the risk function and greater input into strategic decision making - and what risk manager doesn't need to be a part of this?
We'll explore the concept of improving organisational, team and individual capability and its critical link to risk management in future blogs. To ensure you don't miss future issues, subscribe via my website.
Anthony Wilson, M.Risk Mgmt, M.Mgmt, GAICD Founder & Director, Proximity Risk & Assurance
and Affiliate, Capability Institute