Rules of Risk Management

Managing a risky business world

The global attitude towards risk management has changed dramatically over recent years.

It is this change that the professional accountant needs to navigate and control.

Their world is one which has to deal with strict regulations and the development of sophisticated financial modelling. They also have to identify and manage risks. This is an increasingly important part of their remit.

While strategy clearly plays a part in handling risks, ultimately, risk management must also address the human factor.

People make decisions based on the best available information, but more crucial is how that information is delivered, who it is delivered to, and whether and how it is acted upon which ultimately defines how well risk is managed.

To look more closely at this risky world, ACCA (the Association of Chartered Certified Accountants) compiled a study, ‘Rules for Risk Management: Culture, Behaviour and the Role of Accountants’, which reveals what actually happens in organisations where advice is given by risk assessment professionals. It looks at how ethics comes into play - or disappears altogether - and what risk management should, and shouldn’t look like, in practice.

The study canvassed over 2,000 ACCA members from 109 countries, including CFOs, finance directors, financial controllers and financial accountants from lots of different organisations.

A significant finding from this report is that accountants think they can do more to improve ethical behaviour. They feel they can do more to identify a superior decision-making culture, which respondents agreed would be six clear principles: questioning proposals – regardless of the seniority of their authors; recognising uncertainties – and measuring and managing them; making unbiased decisions – irrespective of personal interests; acting ethically – and encouraging an ethical culture; acting legally – and challenging failure to do so and lastly - thinking carefully by using applicable quantitative techniques.

The survey revealed a statistical link between the use of accounting practices that contribute to managing risk and lower occurrences of dysfunctional behaviour. The survey also found differences in the perception of a company’s exposure to risk between those at board level and those accountants working below board level.

The value of accountants’ contributions can be lost through the misuse of their skills and knowledge.

Accountants in the survey reported very high levels of ‘bad behaviour’ around risk management. Examples include frequent ‘gaming’ of forecasts, providing optimistic versions to avoid criticism or pessimistic ones to reduce expectations. Only 1% of respondents reported never seeing any of the bad behaviours asked about in the survey at their organisation.

Another key finding was that organisations – both private and public sector - need to

re-think risk. They need to work harder to spread responsibility for risk management across the whole organisation.

What is clear is that risk happens at all levels of business.  It doesn’t sit in silos. Risk management needs to be something that is undertaken by everyone in an organisation. It needs to be fully integrated.

Accountants have an excellent grasp of the risks faced by their organisation and the steps needed to manage those risks. The feedback in this report showed clear support amongst accountants for ‘challenging senior people’ as being part of good business culture – although this may be sometimes difficult.

If accounting is about providing information to help make good decisions, then good decisions mean less risk. The accountant’s day-to-day role is all about managing risk, even if people don’t think about what they do in that way.

The results are both encouraging, in terms of what accountants do now and what they can do in the future. However, the results are alarming in terms of the extent of revealed dysfunctional behaviour. It is for this reason that organisations – both in the private and public sectors - need to re-think risk. They need to work harder to spread responsibility for risk management across the whole organisation.

Businesses need to make sure they use the risk awareness and risk management skills of their qualified accountants, and not miss an opportunity to effectively integrate risk management.

Accountants surveyed for the report also examples of good risk management. These types of good practice included aspects of management accounting, forecasting, reporting and quality controls, decision support and controls over wrongful behaviour. Some of the highest scores for good practices were from small organisations. Their stereotype as unsophisticated is perhaps an oversimplification.

The survey also found that those in more junior roles are more aware of both risks and ‘bad behaviour’ than their board-level colleagues.

Non-execs were more likely than anyone else to identify ‘personality’ factors – such as planned dishonesty or the opportunistic abuse of power – as causes of problems rather than more controllable factors, such as financial pressure on an organisation. They were also much more optimistic about the frequency of ‘bad behaviour’ than anyone else, and were more enthusiastic about management tools that the survey shows to have debatable effectiveness, such as budgetary controls.

Perhaps this is due to those in senior levels being less involved in the day-to-day running of the organisation, or because they’re taking a broader view of the business. It might be that the way information is reported to them needs to be improved. There are still questions to be answered.

Now is a critical time for risk management. The financial crisis highlighted the disastrous consequences of senior management effectively ignoring risk management. Risk management has since risen up the agenda, but its importance hasn’t always been reflected in budgets or actual actions and there’s a danger it will be forgotten about once the current crisis has passed. Businesses need to take this opportunity to properly integrate risk management into their business processes.

A joined up approach to risk management is vital for any business that wants to pursue sustainable growth.

Accountants understand risk. They embrace the norms of risk management and they show overwhelming support for several effective risk management tools. They value the support they provide to decision–makers as a means to help them manage risk. They have a clear view that the contribution of accountants to the culture of decision making should encourage honesty and objectivity.

They understand that it is better, to explain a range of possible outcomes from a course of action than to detail just the most likely outcome. This is the essence of risk management. If an integrated approach is needed, then what should this look like?

The simple answer may be more difficult to implement, but risk awareness and responsibility for managing risk needs to be woven into each level of management activities, and into all strategic planning and decision-making processes.

Integrated risk management is concerned with all risks that affect each level of management. It means helping staff identify the likelihood of various outcomes and consequences of activities, as well as identifying risks that could affect strategic and operational outcomes. Risk management is also about making informed decisions about the best way to achieve objectives while targeting resources appropriately towards high-rated risks.  Managing risk also demands an understanding both the upside and downside of new activities.

Accountants are adept at handling risk because they understand risk management. In theory at least, management accountants speak the right language on risk. They add value because they can present risk management as part of every-day business decision-making.  They can do more and they want to do more.

Business should not miss the opportunity to embrace this.