A new risk equation: Safeguarding the business model


Published on

The analysis in this study, published by Grant Thornton in co-operation with the Economist Intelligence Unit, is based on a survey of 396 senior executives in the United Kingdom and 69 in the Republic of Ireland – 465 respondents in all. To complement the survey, the Economist Intelligence Unit also conducted a series of in-depth interviews with corporate leaders in the UK. All content was written by the Economist Intelligence Unit with the exception of the foreword and Grant Thornton and other external perspectives presented throughout the report.

Published in: Business, Technology
1 Like
  • Be the first to comment

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

A new risk equation: Safeguarding the business model

  1. 1. A new risk equation?Safeguarding the business model
  2. 2. ForewordA new risk equation?Safeguarding the business modelMany company risk A key finding of the research indicates a poor perception of current riskprocesses fared poorly in processes, with the majority ofdealing with the impact of respondents believing they do notthe recent recession. genuinely influence decision making or add value to the business.This report, written in While many companies were able tocooperation with the identify their key business risks, a failureEconomist Intelligence to effectively stress test their business model left them unprepared forUnit, reviews issues around managing the impact of risks.the success of risk We believe that this report willmanagement practices over stimulate boardroom discussions aboutthe past 18 months and how the importance of risk management in shaping the business model to reducethey may fare in the future. risk and maximise opportunity. Simon Lowe Partner, Head of Business Risk Services Grant Thornton UK LLPContentsForeword 2 A More Fundamental Problem 13 About the report 3 More than disaster prevention 16Executive summary 4 From Grant Thornton Findings Views from Grant Thornton experts 18 Risk management under the microscope 5 Seize the moment 22 Unprepared for the downturn 6 Contributors 24 How companies are reacting 8 Notes 262 New risk equation report
  3. 3. IntroductionAbout the reportThe recent recession has proven that economic cycles,and the dangers attendant on them, are very much alive.Financial difficulties, however, are just one of the risksthat companies have to address.Indeed, acting in the face of uncertainty based on a survey of over 450 senior fresh thinkingto maximise potential benefits and executives as well as in-depth interviewsminimise dangers – a broad definition of with practitioners, suggests that therisk management – is the core of doing complacency extends to corporatebusiness. An earlier study in this series1 approaches to risk management. As therevealed a high degree of complacency pain caused by the recession eases, there The analysis in this study is basedamong British and Irish companies about is a danger that so too will the pressure on a survey of 396 senior executivesthe need to change their business models on companies to re-think their risk in the United Kingdom and 69 inin the wake of the downturn. This study, management practices. the Republic of Ireland – 465 respondents in all. The survey sample was senior, with half of respondents Defining the business model being C-level executives, and hailed For the purposes of this study, from a wide range of industries and we identify five components of the company sizes. To complement the business model: survey, the Economist Intelligence • The value proposition, or the licensing, franchising, subscription Unit also conducted a series of benefits that a company’s products or or other mechanisms in-depth interviews with corporate services provide to its customers • Cost structure, or the balance of leaders in the UK. The research for • Target markets: the customer fixed, variable and other costs within this study was conducted between segments and product and geographic the organisation October 2009 and April 2010. markets a company aims to serve • Value chain, combining a All content was written by the • Revenue-generation mechanisms: company’s supply chain and the Economist Intelligence Unit with an organisation’s revenue and pricing sales and distribution channels it the exception of the foreword and models – for example, its decisions uses to deliver its products and Grant Thornton and other external to earn revenue through direct sales, services to market perspectives presented throughout the report. Please note that not all survey data shown in the charts Retrench or Refresh? Do existing business models1 add up to 100% because of still deliver the goods? March 2010. rounding or because respondents were able to provide multiple answers to some questions. New risk equation report 3
  4. 4. Executive summaryRisk management practices prepared more broadly. Business leaders, for Current risk management systemscompanies poorly for the downturn. example, see financial risk as the biggest are failing to provide what companiesBritish and Irish companies saw danger they face, a view reinforced need in many areas.widespread failure of their risk systems by Economist Intelligence Unit The survey paints a disappointing pictureto help them foresee or address the assessments, which see the banking about the effectiveness of riskrecession. Nearly half of surveyed sector as the greatest source of risk management in general: processes haveexecutives report that their reviews of in the UK and Ireland. created a common awareness of risk fromstrategic risks prior to the crisis did not top to bottom at just 37% of companies, Companies’ risk appetite will changeadequately capture its extent, and only and they add value to the business at only little in the near term as worries about 34% of all firms surveyed. Interviewees30% think that their risk management the economy persist. say that to improve these figures, riskprocesses helped to minimise its impact. In each type of business model risk management must go beyond theHow companies engage in risk covered in the survey, the most common mechanistic calculation of risk based onmanagement should shoulder part sentiment among respondents is that their specific metrics in order to produceof the blame. Professor Michael Power company’s level of risk aversion will compliance with regulation or bestof the London School of Economics remain the same over the next 18 months. practice. Rather, risk managers shouldnotes that often it “is essentially These findings are in line with consider using scenario building, stresscompliance-based... This has let us expectations that economic growth will testing or other techniques whichdown because it creates an illusion of be well below the average of previous incorporate a diverse range of relevantthings being under control.” years for some time to come, and that the information – not merely hard data –Today’s heightened attention to risk recovery will be fragile, with fears of about the surrounding risk environment.management is probably temporary. another reversal stoked by the eurozone The risk function will then be in betterSixty-eight percent of executives say debt crisis of April-May 2010. shape to help companies with the varietytheir companies have changed how they of strategic issues they face.value risk because of the downturn,and 71% say they review it more often.Management interest in risk typicallyincreases after a large shock, but usuallylessens as conditions improve. As mighttherefore be expected, the focus todayis more on the financial dangers justsuffered rather than on addressing risk4 New risk equation report
  5. 5. FindingsRisk management under the microscopeA downturn is more than a difficult economic period,it can be a time of immense change within an organisation.Companies must gear up to face the challenges of thepresent, but must also prepare to seize the opportunitieswhich a sustained recovery might bring.Rivals will certainly be doing as much, things. Over the past decade, many haveas will hungry new entrants. However, also failed to gauge the likelihood thatas the first publication in this series – technology advances or new regulatoryRetrench or Refresh? Do existing requirements, for example, would upsetbusiness models still deliver the goods? their business plans. Risk management– showed, most businesses in the UK and at both the strategic and operationalIreland are not seizing the moment. levels is deservedly under the microscope.Overly cost-conscious, too often As Chris Hill, CFO of Travelex, a foreigncomplacent, they are preoccupied with exchange and business paymentscost reduction rather than more company, puts it, when looking back atsubstantial business model renewal. how companies were affected by the Changing the business model – downturn, “a lot of the lessons learnedthe fundamentals of what the company will be around risk management.”does and how it operates – entails risk. This study explores the lessons thatIn adjusting models and charting strategy, companies are learning about managingcompanies make assumptions about the strategic and operational threatseconomic conditions, demand for their to their business. The risk managementproducts, availability of supply, arrangements in place before thetechnology, regulation and many other recession left too many companiesfactors. The recent recession ill-prepared for what was to come.demonstrated that most companies in the While they are now paying moreUK and Ireland underestimated the risk attention to risk, the question remains asof a significant deterioration of the to how fundamentally their approacheseconomy, and thus of demand and the to risk management will change asavailability of finance, among other economic conditions gradually improve. New risk equation report 5
  6. 6. FindingsUnprepared for the downturnRisk management within a company, whether embeddedin dedicated departments and formal processes, or simplya set of considerations for executives when making decisions,should at the very least do what the name suggests: preparecompanies for the possibility of things going badly wrong.By this measure, British and Irish the crisis did not adequately capture the Risk managers are not entirely to blame:companies saw widespread failure of their impact of the downturn, against 44% who the initial impact of the financial crisisrisk systems to help them foresee or believe that it did. Worse still, only 30% of was overwhelming. Simon Peckham,address the downturn. Of the executives respondents think that risk management COO of Melrose – a company whichin our survey, 49% say that the review of processes at their businesses helped to purchases underperforming industrialstrategic risks at their companies prior to minimise the impact of the recession. companies in order to turn them around and sell them – remembers: “For a period of time, the world froze because nobodyDo you agree or disagree with the following statement? knew what was going to happen.“Our review of strategic risks prior to the crisis adequately captured the impact Everyone became massively risk averse.of the economic downturn.” (% responses) Whatever risk management you have, it isn’t going to make a difference in that Strongly agree Agree Disagree Strongly disagree Don’t know kind of a fundamental situation.” 7.2% 37.0% 42.0% 7.4% 6.3% Certainly, risk processes were notSource: Economist Intelligence Unit going to enable companies to sail through such troubled waters unscathed, but they might have done better at preparing them for the storm. There were plenty of signs Grant Thornton for those willing to see them. Mr Peckham notes that in the summer comment of 2008, “it was looking pretty certain something was going to happen.” The problem may have been that executives were keeping an eye on the wrong potential dangers. Adrian Fawcett, CEO of General Healthcare Group, There is an increasing focus on annually review the effectiveness a provider of private healthcare services, the role risk management plays in of their risk management systems and recalls that after years with relatively easy corporate governance. The UK report the results to their shareholders. access to capital, many companies were Corporate Governance Code, The Turnbull report, which provides no longer focused on financing risk. for companies listed on the London guidance to companies on risk The tendency for financing arrangements Stock Exchange, requires the board management and internal control, to have grown not only in quantum but to establish an ongoing process for is being reviewed by the FRC in late also increasingly complex only added to identifying, evaluating and managing 2010. It is anticipated that this the difficulty, he contends, because the significant risks faced by the will result in an increased focus on executives typically focus on the things company. They are also required to risk processes. which interest them. “Too many leaders and managers of UK companies were not6 New risk equation report
  7. 7. alert to balance sheet and financing risks are often dictated by regulation” he says. respondents whose firms quantifiedas the extended period of low inflation, “This has let us down because it creates an strategic risks before the downturn,low interest rates and increasing sources illusion of things being under control.” under half (49%) say that their riskand availability of capital had left them Professor Power complains that, rather reviews adequately captured the potentialprincipally paying attention to company than being linked into strategy and impact of the recession, slightly moreoperational risks that remained more decision making, current practice tends to than the entire survey sample. The greaterconsistently present in front of them.” relate risk management to high-level ability of this group to understand the This issue of focus points up a objectives only in a bureaucratic way. scope of the problem does not seem towidespread weakness in the practice of Jeremy Bentham, Shell’s VP Global have conferred any particular advantage:risk management. Michael Power, Business Environment and head of the only 30% think that their riskProfessor of Accounting at the London company’s scenario team, agrees: management processes helped toSchool of Economics, says “the essential “Risk management is often seen as a minimise the effect of the recession,question” is why risk systems did not mechanistic, analytic issue, whereas we the same as the overall survey average.prepare companies better for the live in the realm of human activity withdownturn. “Quite a lot of risk rational and less rational choices.”management practice is essentially Techniques which quantify risk helpedcompliance-based, following rules that companies surprisingly little. Of surveyWhich of the following areas of your company’s business model will be subjectto the greatest degree of risk over the next 18 months? (% responses) Total Financial Media Construction Healthcare Retailing services entertainment property servicesRevenue-generation mechanisms(eg, pricing model, licensing versus direct sale, etc) 24.2 % 31.5 % 23.8 % 11.9 % 28.8 % 19.6 %Cost structure (balance of fixed, variable and other costs) 23.8 % 16.7 % 19.0 % 28.8 % 32.7 % 23.5 %Target markets 13.5 % 11.1 % 12.7 % 23.7 % 7.7 % 9.8 %Value proposition (ie, the benefits that the firm’s productsor services provide to customers) 13.1 % 14.8 % 15.9 % 5.1 % 11.5 % 11.8 %Distribution channels(how the firm delivers its products/services to market) 8.7 % 11.1 % 14.3 % 3.4 % 7.7 % 11.8 %Supply chain 7.9 % 5.6 % 1.6 % 11.9 % 5.8 % 15.7 %None of these areas will be subject to risk 4.6 % 5.6 % 6.3 % 8.5 % 1.9 % 5.9 %Don’t know 2.4 % 3.7 % 3.2 % 3.4 % 3.8 % 2.0 %Other, please specify 1.7 % 0.0 % 3.2 % 3.4 % 0.0 % 0.0 %Source: Economist Intelligence Unit New risk equation report 7
  8. 8. FindingsHow companies are reacting Grant Thornton commentBolting the barn door after the The importance attached to riskhorse is gone. management tends to be highly cyclical.The recession has pushed companies to According to Professor Power:become more active risk managers. “It inevitably gets most attention afterSixty-eight per cent of respondents say the threat you wish to prevent has Grant Thornton’s eighth annualthat they have changed how they value materialised. There is no magic bullet – review of UK corporate governancerisk as a result of the downturn, and people are prone to group-think and disclosures noted that on average71% say they review risk more often. optimism, so those who said in 2005 or FTSE 350 companies disclosed 10.7Moreover, 56% of those who did not 2006 that this would end in tears simply principal risks of which 3.4 werequantify strategic risk before the weren’t heard.” financial, the largest category of risksdownturn have decided to do so because The evidence so far is that the current for all industry sectors. Operationalof it. heightened risk management activity is risks (1.7), macro-economic and Awareness of some risks has certainly part of the traditional cycle rather than political (1.6) and regulatory (1.5)risen. Mr Fawcett points out that people a fundamental re-think. For one thing, were the next most commonly“are more familiar with risks that were the severity of economic hardship seems disclosed risks. Surprisingly, therenot thought about before,” noting that to affect the openness to change. For was an average of only 0.6 businesseven tabloid readers now recognise terms example, in Ireland, where the recession growth risks disclosed, despite 26.9%such as leveraged debt, asset-backed hit harder than in Britain, 84% of of respondents identifying this as onefinancing, covenant cover, tier one capital companies in the survey have changed of their two most significant risks.ratio and Ponzi scheme. how they value risk and 83% review it The difficulty, however, is knowing more often. In the construction sector,how much of this is simply a temporary which was particularly hard hit, thereaction to a traumatic experience, and equivalent figures are 81% and 80%.how much is a considered improvement In both cases these are well above thebased on a learning experience. overall survey averages. As ProfessorAs Professor Power puts it, business Power notes: “If you have been badlyleaders “have learned from the crisis; hurt, it will shape your attitudes overwhether that will be embedded in the next year.”companies, only time will tell.”8 New risk equation report
  9. 9. What are the two most significant types of risk currently Of greater concern is that, having beenfacing your business? Select up to two. (% responses) stung in one area, companies might become less aware of dangers in others. Total Financial Media Construction Healthcare Retailing When asked about the leading risks their services entertainment property services companies face, by far the biggest concern Financial 53.6 % 46.3 % 53.1 % 52.5 % 54.7 % 70.6 % of survey respondents is financial risk Business growth 26.9 % 14.8 % 29.7 % 28.8 % 5.7 % 35.3 % (cited by 54%). Far down the list come Operational 24.1 % 18.5 % 26.6 % 27.1 % 24.5 % 31.4 % macroeconomic (19%) and political risk Regulatory 21.0 % 53.7 % 14.1 % 10.2 % 26.4 % 9.8 % (14%). The heightened attention to Macroeconomic 19.1 % 29.6 % 12.5 % 22.0 % 3.8 % 17.6 % financial risk may be understandable Political 14.3 % 7.4 % 4.7 % 22.0 % 39.6 % 0.0 % given that the survey was conducted in Reputational 8.7 % 20.4 % 12.5 % 6.8 % 7.5 % 11.8 % October 2009-April 2010. Nonetheless, Human resources 7.8 % 1.9 % 12.5 % 6.8 % 15.1 % 3.9 % this focus on one type of risk worries Mr Peckham: “The impact of massive Technology 7.4 % 3.7 % 18.8 % 3.4 % 3.8 % 3.9 % government borrowing and the attendant Environmental 4.8 % 0.0 % 1.6 % 10.2 % 1.9 % 3.9 % macroeconomic dangers, particularly inSource: Economist Intelligence Unit the UK, are not small.” If nothing else, the fiscal stabilisation measures put forward by the new coalition government will subdue wider economic growth, but sustained banking-sector weakness and external shocks similar to the Greek debt crisis (see box on page 9) could threaten even the central low-growth scenario. New risk equation report 9
  10. 10. FindingsEvolving perceptions of risk United KingdomThe Economist Intelligence Unit’s riskscores for Britain and Ireland suggest Criteria July 2009 January 2010 April 2010the dangers foreseen by the survey Sovereign risk score 34 35 37respondents are not misplaced. Currency risk score 33 34 35These assessments are based on over Banking sector risk score 42 42 4160 indicators – including existing data Political risk score 23 24 25and likely future developments – Economic structure risk score 23 25 28which are then combined into scores Overall country risk score 36 37 38to represent the level of risk foreach country. The scores range from Irelandzero (equivalent to an AAA rating)to 100 (equivalent to a D rating). Criteria July 2009 January 2010 April 2010In both countries, the banking sector is Sovereign risk score 35 37 34the source of greatest risk – which may Currency risk score 25 32 29help explain why our survey respondents Banking sector risk score 43 43 42are so concerned about threats to their Political risk score 17 17 17firm’s financial position. It is also Economic structure risk score 38 38 38noteworthy that while the Economist Overall country risk score 39 40 38Intelligence Unit’s risk scores for Irelandhave declined slightly in recent months, Source: Economist Intelligence Unit Country Risk Servicethose for the UK have generally risen.Beyond the financial sector, risk concernsin both countries derive from fiscalweakness (particularly in light of theeurozone debt crisis of April-May 2010) opportunity for a specialist risk managerand expectations of a fragile economic “to have a much more meaningfulrecovery this year and next. conversation” with those responsible Of course, attention to risks is not a for the processes.zero sum game. Peter Kaye, Group Head Nevertheless, the intense focus onof Business Protection and Continuity at financial risk means other dangers mightthe John Lewis Partnership, points out be missed. Although financial threatsthat the emphasis on cost reduction in a have certainly not disappeared,downturn leads to a greater concern for companies should be looking moreefficiency and therefore more detailed closely at the possible implications of thedefinitions of processes. This provides an macroeconomic and other risks they face.10 New risk equation report
  11. 11. Risk appetite: A slow recovery amid This picture is not uniform across thecontinued money worries economy. Companies in the financialAlthough companies are expecting to sector – the epicentre of the downturnspend more time looking at risk, what is and among the first to feel the pain –likely to happen to their appetite for it? expect to start accepting risks fasterAs documented in Retrench or Refresh?, than most industries. Manufacturingexecutives are not betting on a rapid or respondents, on the other hand, predictstrong recovery. As a result, they are growing risk aversion in most areas.expecting to see only a small change in Mr Peckham explains that actingtheir own willingness to take on risk. conservatively rather than trying to When asked how their degree of risk engage in a price war – the only way toaversion will develop over the next grow market share in last year’s18 months, a plurality of survey conditions – has so far probably savedrespondents say they expect no change. many companies from bankruptcyWhen it comes to entering new and may remain the best strategy forgeographic or product markets, some time.experimenting with new business models, Perhaps more important, however,and investment in new technology, is that just as risk management goesmore respondents expect risk appetites through cycles based on economicto increase rather than to lessen. conditions, so does risk perception.The downturn’s effect, however, is not Notes Mr Peckham: “Nobody knowsyet finished working its way through what will happen in the UK economy incorporate attitudes. Nearly 40% of the next 12 months. There will not be a bigrespondents, for example, suggest their change [in risk perceptions] until peoplefirms will shorten the time frames have a better view of what is going on.required for projects to show a return. If the economy is in real trouble, riskProfessor Power surmises: “Companies aversion will remain high. If it improves,have definitely learned lessons, and people will forget quickly.”quite specific lessons about the way theygot hurt. It is probably making themmore risk averse in those areas. On otheraspects of risk, they might have the sameattitudes as before the downturn.” New risk equation report 11
  12. 12. In the next 18 months will your company become more or less risk averse than it is now in the following areas? (% responses) 25% 29% 44% 2% Willingness to enter new product markets 27% 29% 41% 3% Willingness to enter new geographical markets 20% 31% 46% 3% Willingness to invest in new technologies 19% 38% 38% 5% Willingness to experiment with new aspects of business model 37% 16% 42% 5% Length of time it is willing to fund projects before showing a return 22% 20% 51% 7% Willingness to rely on existing number of suppliers Percentage of respondents 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% More risk averse Less risk averse No change Don’t know Source: Economist Intelligence Unit12 New risk equation report
  13. 13. A more fundamental problemIf the only issue for risk management was a lack ofattention, then the increased focus described on page 12might be an adequate response as companies slowlyaccept more risk again. The problem, however, is that riskprocesses are failing to deliver on a range of basicrequirements at too many companies.According to the survey: According to Professor Power: “Risk Shell’s Mr Bentham, as a scenario• Risk processes have a genuine management has too often been made practitioner, also stresses the need to use influence in decision making at less into an audit practice, and risk officers the many appropriate analytical than 50% of companies feel that the thinking part of the job has approaches to risk while having an• In only 41% of companies is risk been squeezed out. An audit practice understanding of the deeper personal and managed at all levels of the business won’t help you anticipate when things cultural drivers that influence human• At no more than 37% of firms is there are going vastly wrong or provide for choices. “One of the areas that we’ve a common awareness of risk from top flexibility of response.” He suggests that, enhanced over the last year, and which to bottom rather than a largely metrics-based has always played a role in our scenarios,• Just 34% of executives say their risk approach to risk, one which includes is that of social-cultural-behavioural management processes add value consideration of alternate futures, modes of choice,” he says. “This is not to the business including what could go wrong – such only about understanding how business as stress testing or scenario building confidence swings; it is beginning toAlthough these figures are higher at – is necessary. The natural optimism of educate us about our own behaviours.”larger companies – which are more likely people makes such an approach vital, he (See box on page 12)to have a dedicated risk function – only a believes, as “organisations find it difficultminority are seeing a benefit from their to project failure of business cycle.”risk systems. Among firms with annualsales of over £1 billion, for example, riskmanagement processes have a genuineinfluence on decisions at 54%, they areseen to add value at 46% and they havecreated a company-wide awareness ofrisk at 36%. Even in the financial servicessector, which has perhaps the mostextensive experience of risk management,only 52% of executives believe that itaffects decision making and 43% thatit adds value. What should companies considerdoing to improve their risk management?Our interviews suggest that a startingpoint is to break out of the two silos inwhich risk management is oftenconfined: how it perceives risk,and how this perception is used in thebroader business. New risk equation report 13
  14. 14. A more fundamental problemWhich of the following statements is true of the riskmanagement process at your company? (Select all that apply.)(% responses) The risk management process... Total Financial Media Construction Healthcare Retailing services entertainment property serviceshas created a common awareness of risk from top to bottom 36.7 % 48.1 % 18.8 % 49.2 % 37.7 % 35.3 %has ensured that risk is managed at all levels of the business 40.6 % 57.4 % 31.3 % 37.3 % 52.8 % 33.3 %adds to the value of the business 33.6 % 42.6 % 28.1 % 30.5 % 22.6 % 27.5 %genuinely influences decision making 49.2 % 51.9 % 42.2 % 52.5 % 39.6 % 41.2 %drives cost savings 37.5 % 18.5 % 31.3 % 45.8 % 22.6 % 51.0 %has helped to avert a potential major incident,which could have harmed the business 18.9 % 27.8 % 25.0 % 20.3 % 20.8 % 9.8 %has helped to minimise the impact of the economic downturn 29.7 % 35.2 % 32.8 % 37.3 % 7.5 % 27.5 %helps to educate and inform non-executive directors, whichenables them to provide real challenge to the executive team 18.2 % 18.5 % 10.9 % 13.6 % 34.0 % 15.7 %Source: Economist Intelligence Unit14 New risk equation report
  15. 15. Shell; scenarios and assessing to habituate senior leaders to thinking “not because we felt it was a highrisk in the downturn about things in different ways. Since early likelihood but to educate seniorShell is well known for its use of in the decade, Mr Bentham says, Shell’s leadership to recognise the signals –scenarios – a structured approach to macroeconomic and geopolitical what was a significant event and whatimagine a range of possible futures and scenarios had included possible large, was part of the noise – and to prepareto consider their implications for negative shifts. “People were thinking them for what it might look like.”strategy. The technique has even about the long-term trends and the An advantage of scenarios in suchoccasionally allowed the company to potential for discontinuity,” he adds. conditions, Mr Bentham explains,have considered the best response to “There was a grounding of preparation” is the steadying influence they provide.dramatic shocks – such as the Soviet when the downturn hit. “In the beginning of 2009, ourUnion’s collapse – before they In autumn 2008 Shell’s analysts, recession and recovery scenarios,occurred. How useful were scenarios, although aware of building tensions in including the deep recession scenario,however, when the downturn struck? the financial system, were not predicting were teaching us collectively not to Jeremy Bentham, Shell’s VP Global that an imminent crisis was inevitable. panic. This became self evident withinBusiness Environment and head of the Mr Bentham recalls, however, that our leadership thinking,” even whilescenario planning team, believes that “when Lehman Brothers went down, popular opinion was frequently“elements of the approach were very we recognised that it was likely to over-reacting. Now, he adds, thehelpful, although of course some things cascade through.” Within two weeks the scenarios, which are reviewed regularly,were missed that everybody missed. scenario team provided the executive are “cautioning against overconfidenceOverall, I believe they helped us to committee and board with details on the in what is emerging. There is still aavoid both under-reacting and over- seriousness of the situation, the relatively significant level of fragility inreacting to events.” uncertainties involved and the relevance the recovery.” One important benefit of scenarios in of other long-term trends. Bentham adds This steadying influence does notany such situation is the behaviour that the leadership recognised that, in come simply from executives reading awhich their long-term use inculcates. such circumstances, “the only way to particular set of scenarios; moreStories may be the most visible part of address this outlook was through important, says Mr Bentham, is thescenarios, but more important is how scenarios, and they were needed quickly.” large amount of dialogue that goes onthese are used within a corporate By January Shell had highly detailed around them. This conversation is aculture – through both formal recession and recovery scenarios. continuous, ongoing part of how theprocesses and informal means – One even involved a great depression, company operates. New risk equation report 15
  16. 16. A more fundamental problemMore than disaster preventionEven the best risk assessments in the world are not much good, however,if nobody uses them. Travelex’s Mr Hill believes that problems areinevitable if “risk management is seen as a separate discipline and separatedfrom how the business is run. The best way to make risk managementwork is to make sure it is integrated.”For risk management to go beyond new data security standards imposed by point for the company itself. Mr Hillsimple compliance and play such an banks to reduce fraud are causing a explains that Travelex handles a lot ofintegrated role, Professor Power broader rethink of information security cross-border payments for companiesmaintains, it needs a champion – be it a and information handling. Similarly, the for which this is not a core part of theirchief executive or CRO (chief risk new Solvency II regulations facing the operations. Such transfers, however,officer) – who can ensure that risk insurance industry, although imposed are coming under increasing regulatoryconsiderations are brought into decision from the outside by European regulators, scrutiny, so expertise in addressingmaking and strategy making early on, hold out the possibility of better compliance risk is attractive to customers.rather than being a box to tick prior to informed decision making and improved “Because risk management is a key part ofcompletion. Companies need some way use of capital. what we do, it is an opportunity to– whether through risk officers or other General Healthcare Group’s Mr Fawcett differentiate ourselves,” he says.executives – to challenge ideas believes that risk considerations should “For example, because we understandconstructively. Similarly, Mr Kaye notes: play an integral role in how a company is the anti-money laundering environment,“If you are going to deal with [a risk] run. “Risk management covers a far that provides comfort for our customersproblem in a business-led way, then you broader spectrum of things than the based upon our expertise in this field.”really need to get the right top-down word ‘risk’ brings to mind. If the senior Professor Power sees risk andgovernance in place. You have to have management team is tasked to look at opportunity coming together best in themanagement engaged.” Simple strategies efficiency, market awareness, risk appetite process. “Risk appetite,”can help to achieve this. Mr Kaye says organisational effectiveness and customer he maintains, “should be understood asthat because John Lewis’s risk reviews satisfaction, it has covered most of what a value creating proposition. The policyand strategy reviews take place a good risk audit would address.” should be symmetrical between lossessimultaneously, there is a much greater Mr Fawcett reminds, for example, that and gains, and as widely understood aschance that executives will integrate risk working with customers to ensure that possible among top management.”considerations into strategic choices. they are getting what they want, and with He adds that the very process of By helping the leadership decide on, and suppliers to avoid problems of discussing risk appetite can and shouldunderstand, the implications of an obsolescence or shortages, are not capture both the upside and downsideappropriate risk appetite, risk management traditionally “risk management, but just of risks and, most importantly, serve as acan also help with the identification of good business practice. They are driven by reminder that new ventures are expectedopportunities to improve operations. the approach of how can we reduce risk by the company. Risk, then, should beEven what might seem on the surface like and maximise opportunity.” about where a company wants to go asa simple compliance exercise can greatly Risk management can even go beyond much as where it will not go.improve processes. Mr Kaye notes that helping with strategy to providing a selling16 New risk equation report
  17. 17. Travelex learns lessons from basis.” For Travelex, this in particular information gathering about customersthe downturn means the orderly management of and other businesses with which theThe downturn hit two of the core liquidity risk – a must for a business that company has dealings, in particularmarkets of Travelex, a currency sees £2.5 billion moving through its looking at creditworthiness.exchange and payment services systems during a month. The company For example, where it might have reliedcompany. Less travel by people has collects highly detailed data on cash flow, on credit agency ratings before themeant less money-changing, and a which the CFO reviews daily and uses recession began, it now looks at creditreduction in trade volumes has reduced in fortnightly calls with all the divisions. swap data and other indicators thatthe flow of international payments. More broadly, Travelex remaps its risks monitor the macroeconomic picture.Even though revenue has declined, the in detail once every twelve months, and The data has also increased itscompany is still in a position to expand management revisits this assessment knowledge of customers and abilityits airport footprint and consider several times in the course of the year. to service their needs.introducing its FX products into new Mr Hill adds, “It is about having the right At the same time, the tight riskgeographies and industries. processes that keep risk on the agenda. management has enabled the company Chris Hill, Travelex’s CFO, credits The key is to identify, understand, to invest in expansion and otherthe placement of risk considerations at manage and monitor risks, and then opportunities which have emergedthe centre of corporate management have a system to make sure the controls from the downturn. Mr Hill explainswith much of the company’s ability to are working.” that “In an environment where lots ofadjust to the harsher environment. Travelex had the framework of its people are nervous, we have to be“Many businesses are now questioning current processes in place as early as careful that we back the opportunities‘why didn’t my risk management 2007, but that does not mean it stood still that are truly going to pull through.processes tell me this would happen?’,” as the downturn arrived. “When the We are continually looking athe explains. “You’ve got to have a credit crunch hit,” says Mr Hill, opportunities, and it is the riskprocess for managing risk, and that “we went on to stages two and three.” management that will help us to makeprocess has to be embedded in how This has meant even greater discipline in the best of them.”you manage the business on an ongoing liquidity management and more detailed New risk equation report 17
  18. 18. View from the Grant Thornton experts Chris Tam Grant Thornton, What have you seen in China, with regard What are the key challenges/risks to firms China to risk management process and policies wanting to do business in China? over the last 18 months? We advise UK investors to conduct a thorough In mainland China, the government has recently risk assessment by consulting your business introduced new regulations which require public advisers with local knowledge. However, we companies to establish internal control and risk would like to highlight the following risks. management systems, annually evaluate the Taxes – despite relatively low operational effectiveness of internal control and disclose costs in China, there are many hidden costs. any material deficiencies in their annual report. For example, tax rules are governed by state and External auditors will be required to express local governments and these vary from province- an audit opinion on the effectiveness of internal to-province or city-to-city. Also, following tax control that their strategy is aligned with their reforms in 2008, there are very few preferential desired risk profile. tax benefits for foreign investors compared to In light of the credit crunch has there domestic companies. been a change in attitude? Labour – skilled labour costs in major cities have While the credit crunch in US and Europe did not been increasing by 15-20% per annum for the significantly impact on domestic consumption in last 2-3 years. We expect to see this momentum China, there was a large impact on exports. continuing in the mid term due to shortages of As such, the Chinese government promoted skilled labour. In addition, compulsory social increases in domestic consumption with many insurance and benefits top up approximately export oriented businesses repositioning their 34% to base salaries. strategies to domestic markets. The recent downturn has also created opportunities for Chinese companies to move outside of the country. In 2008-2010, we have seen increasing amounts of outbound investments by Chinese companies acquiring international brands and technologies, natural resources and distribution channels in the US and Europe. However, many Chinese companies are not familiar with managing overseas businesses and do not have experience in managing unfamiliar risks such as labour relations, international regulations and political issues. This will pose a challenge to many of those companies and require a step change in their risk management processes.18 New risk equation report
  19. 19. Cian Blackwell Grant Thornton,Republic of Ireland The impact of the global economic situation on The majority of companies are paying more Irish companies has been exacerbated by two attention to risk management, and are both specific local factors – the deflating of a increasing the resources allocated, and reviewing significant property bubble, and the financial and the approach being taken. This is particularly reputational damage to the country as a result noticeable among medium to large private of governance scandals in a small number of companies that may not previously have been companies, notably Anglo Irish Bank. convinced of the benefits of investing in risk management. Although the survey suggests that Although most Irish companies are surviving the heightened attention may only be temporary, the recession – and some are thriving – many of if companies can use this opportunity to review the casualties can be attributed to a failure to and strengthen their risk functions then the manage risk. Two risks in particular proved to be benefits may be long term. widely underestimated: firstly, that banks which were so eager to lend in the boom times would be so reluctant to do so in the recession, cutting off many companies’ credit entirely; and secondly, that property values could plummet, in some cases by over 80%. The latter risk was of particular relevance where so many companies, particularly private and owner-managed companies, couldn’t resist the allure of diversifying into the ‘guaranteed returns’ of the property market. What we are seeing in the Irish market at the moment is reflected in the survey results, particularly the view that risk management practices prepared companies poorly for the downturn. However, opinions tend to be divided as to whether that was because the companies themselves implemented poor risk management processes, or whether it points to a general inability of risk management to deal with significant events such as those of the past two years. This latter scepticism has produced some reluctance to invest in risk management, particularly among smaller and medium sized companies. New risk equation report 19
  20. 20. View from the Grant Thornton experts Sandy Kumar Grant Thornton, UK How companies are reacting Risk appetite We have seen a renewed interest in developing Historically, the risk appetite of many effective risk systems over the last year. In many companies has not been formally defined and cases this has involved a move from a can only be implied through decisions made by compliance-led risk minimisation approach, often the board and management. This is often at a detailed process and business unit level, subjective, inconsistent and not always to a more strategic risk function. This process communicated effectively. has enabled some companies to improve We have noted growing interest in developing the effectiveness of their risk function while risk appetite statements which set limits on the reducing its cost. level of risk that a company is willing to accept. As the economy continues to emerge from the The best examples are clearly linked to a recent downturn, it is those companies with the company’s strategic objectives, include best risk processes which are best placed to take quantifiable measures, have regard to stakeholder advantage of opportunities as they arise. expectations and are set by the board and senior They are able to quantify the potential risk and management. By defining their risk appetite, reward arising from specific decisions and companies can improve the quality and improve their strategic decision making. consistency of their decision making and ensure These companies often have enhanced risk that their strategy is aligned with their desired mitigation activities, as management are able risk profile. to allocate resources more precisely.20 New risk equation report
  21. 21. Sterl Greenhalgh Grant Thornton, UKAn increasingly important aspect of the risk The failure to prevent or identify financial crime ismanagement spectrum is mitigating financial entwined in a lack of secondary and pervasivecrime and related risk in the light of increasing controls. These can be created through fraudlegislation and enhanced intervention by law awareness training and effective managementenforcement and regulators. While the recent supervision which in turn ensure compliance andliquidity crisis exposed several major frauds create effective deterrents. Without these two(such as Madoff) that typically relied on an ever essential components, organisations will struggleincreasing number of investors to maintain the to drive the necessary behavioural changesillusion of a successful investment vehicle, it is required to embed over time an ethical culture.inevitable that more modest frauds also remained As our related 2010 corruption survey “Decisionundetected during the boom times. Time” reveals, the drive towards reducing bribery and corruption will also require companies to adopt a more robust risk assessment process to assess both strategic and operational risks. New risk equation report 21
  22. 22. Seize the momentPut risk managementreview on the board agendaHere are some suggestions from our own experts on the areasof risk management that will help you to discuss and assessthe quality of your risk management framework. We measurethis against five levels of risk maturity. These are as follows:Risk Maturity Key characteristicsRisk Naïve formal approach developed for risk management NoRisk Aware Scattered silo based approach to risk managementRisk Defined Strategy and policies in place and communicated. Risk appetite definedRisk Managed Enterprise-wide approach to risk management developed and communicatedRisk Enabled Risk management and internal control fully embedded in the operations22 New risk equation report
  23. 23. An organisation’s level of risk maturity can be assessed against the following categories. Leadership Have you assessed your risk appetite in determining the business model? Is the board active in risk management? Do the right people have ownership of your risks? Risk strategy and policies Do your risk processes add value to the business? Has risk management been embedded in the business? Are risk systems integrated with business processes? People Are the right people involved in risk management? Is there a common awareness of risk throughout the business? Processes Are you confident that you have identified and are managing your main risks? Do you utilise robust models to quantify and score risks? Is this consistently applied? Do you regularly monitor the effectiveness of risk responses and the operation of key controls? Do you make use of stress testing or scenario building to consider alternate futures? Risk handling Is there a continual updating of risks by operational management? Have you embedded risk into your decision making processes? Do you have standardised risk reporting throughout your business? Outcomes How is risk management built into performance management processes? How have risk management processes contributed to the achievement of your objectives? How successful have your risk processes been in preparing you for the downturn? For a snap shot assessment of your own organisation’s risk maturity, complete Grant Thornton’s online Risk Maturity Assessment. The self assessment is also a useful tool for discussion around thecurrent and planned risk processes, either internally or facilitated by one of our risk professionals.The self assessment can be found at www.grant-thornton.co.uk/riskquestionnaire
  24. 24. Contributors Grant Thornton wishes to acknowledge the contributions made to the research by the 465 respondents and the following who commented on the findings: Jeremy Bentham VP Global Business Environment, Shell Adrian Fawcett CEO, General Healthcare Group Peter Kaye Group Head of Business Protection and Continuity, John Lewis Partnership Simon Peckham COO, Melrose Michael Power Professor of Accounting, London School of Economics Chris Hill CFO, Travelex24 New risk equation report
  25. 25. and from Grant Thornton Simon Lowe Chris Tam Cian Blackwell Partner, Head of Business Director Partner Risk Services T +86 (21) 23220 223 Business Risk Services T 020 7728 2451 E chris.tam@cn.gt.com T +353 (0) 16805 805 E simon.j.lowe@gtuk.com E cian.blackwell@grantthornton.ie Sandy Kumar Sterl Greenhalgh Alan Lees Partner Partner Partner Banking and Financial Services Forensic and Investigation Services Central Government T 020 7728 3248 T 020 7728 3448 T 020 7865 2392 E sandy.kumar@gtuk.com E sterl.greenhalgh@gtuk.com E alan.lees@gtuk.comFor more information, please visit:www.grant-thornton.co.uk/refresh New risk equation report 25
  26. 26. Notes26 New risk equation report
  27. 27. Contact usFor further information on this report and its findings, please contact:Simon LowePartner, Head of Business Risk ServicesT 020 7728 2451E simon.j.lowe@gtuk.comFor other queries, please contact your local Grant Thornton office:Belfast Ipswich NorthamptonT 028 9031 5500 T 01473 221491 T 01604 826650Birmingham Kettering NorwichT 0121 212 4000 T 01536 310000 T 01603 620481Bristol Leeds OxfordT 0117 305 7600 T 0113 245 5514 T 01865 799899Bury St Edmunds Leicester ReadingT 01284 701271 T 0116 247 1234 T 01189 839600Cambridge Liverpool SheffieldT 01223 225600 T 0151 224 7200 T 0114 255 3371Cardiff London SloughT 029 2023 5591 T 020 7383 5100 T 01753 781001Edinburgh Manchester SouthamptonT 0131 229 9181 T 0161 953 6900 T 023 8038 1100Gatwick Milton KeynesT 01293 544130 T 01908 660666Glasgow NewcastleT 0141 223 0000 T 0191 261 2631© 2010 Grant Thornton UK LLP. All rights reserved.’Grant Thornton’ means Grant Thornton UK LLP,a limited liability partnership.Grant Thornton UK LLP is a member firm withinGrant Thornton International Ltd (’Grant Thornton International’).Grant Thornton International and the member firms are nota worldwide partnership. Services are delivered by the memberfirms independently.This publication has been prepared only as a guide.No responsibility can be accepted by us for loss occasionedto any person acting or refraining from acting as a result ofany material in this publication.www.grant-thornton.co.ukB1627701