Risk managers cannot afford to stand still

Risk management has undergone huge change across Africa in the past few years, as Commercial Risk Africa’s Risk Frontiers Africa 2018 survey reveals. Below, as a foretaste of the survey, we hear from some of the risk managers taking part in it about what keeps them awake at night and the evolution of risk management The European Union’s General Data Protection Regulation, in force from 25 May, may not have much to do with Africa at first glance. However, a little like the UK’s Bribery Act of a few years back, the impact is likely to become global very quickly, according to Reuben Andrews, chief risk and credit officer with an African bank. The penalty for a data breach can be up to 4% of global turnover and the data breach can occur at any point along the supply chain. This effectively means that a major European corporate doing business in Africa has to be mindful of the risk of a data breach via the African subsidiary or business partners. And equally, African businesses with European connections also need to be aware and comply with the new rules if the business relationship is to continue. All the evidence ahead of implementation of the rules was that European businesses remained largely ignorant of the risks. One survey suggested 75% of European businesses were not prepared and would not be sure of compliance as the new rules came in. The concern among the experts was that if this was the position in Europe, what would it be in the rest of the world? Certainly, the anecdotal evidence in Africa was not encouraging. When the risk management community was asked, few were aware of the rules. Those that were tended to have foreign ownership. However, also a little like the Bribery Act, once told of the new rules, concern was high. And those who are aware of the rules were quick to point out the massive amount of work, time and money it has cost the company to become compliant. Mr Andrews explains that his organisation is present in about 20 African countries and has plenty of interaction with its European head office: “We have already invested tens of millions of dollars in cybersecurity but this requires a new level of security.” Mr Andrews explains that the new rules will apply to the supply chain for any corporate, and that has required him to look at the customers the bank has on its books and the interaction at all levels. “We are concerned about our customers but also about our suppliers and who their suppliers are. We have to conduct KYS (know your supplier) on everyone, we have to have water-tight contracts and we have to drive compliance through the entire chain,” he says. There has to be ongoing review processes in place and Mr Andrews says it has taken due diligence to whole new levels. “With regard to our stakeholders, we have to ensure they operate in a manner consistent with global best practice,” he says, adding that solid risk management is paramount in achieving this goal. Risk management on the move Risk management is vital to the company, as risk managers for the insurance sectors, says Deniese Imoukhuede, chief risk officer at Zep Re. “Our business requires that we are in a position to provide capacity to the insurance sectors we operate in to support cedants’ underwriting and to meet our share of their obligations as they fall due,” she explains. One of the frequent comments from risk managers across the continent is that their boards do not take risk management seriously enough. However, Ms Imoukhuede says her “board is committed to risk management and provides full support to the risk function”, adding: “We have a board subcommittee that is specifically focused on the company’s risks, providing oversight and guidance on the management of our risks.” She believes risk management training should be continuous as risks by their very nature are dynamic, and frameworks in place to manage risks are themselves evolving. A particular area of focus should be on the quantification side of risk management, to support a greater depth of understanding relating to complex and emerging risk exposures, with the purpose of supporting better informed decision-making. “The availability of risk management training,” she says, “should not be limited for risk professionals, but for all members of the organisation, as everybody within the organisation is responsible for risk management. It is a means to build the risk culture of the company and hence facilitate good risk management practices across the enterprise.” From South Africa, Christopher Palm, chief risk adviser at the Institute of Risk Management South Africa (IRMSA), is concerned that training alone is not enough: “Considering the number of risks that have materialised in the past 18 months – and considering how many of those risks were highlighted since 2016 – it becomes clear that having knowledge of the risks is not enough.” He adds: “We must show a greater willingness and ability to effectively treat or respond to identified risks, in both the public and private sectors.” Mr Palm believes risk compliance remains important and cannot be sacrificed, “so we must bed down an effective risk management framework and mature it continuously”, adding: “We must, however, shift our focus to moving beyond just being ‘risk process facilitators’ to ‘translators’ of risk data into workable predictive risk information and scenarios in support of improved decision-making. “The risk management function needs to play a leadership role, which requires risk managers to speak the unspeakable, take up the role of mind-changers to influence leadership, and embrace the benefits that big data can offer in the risk management process.” One evolution is the increasing use of scenario planning. Mr Palm explains: “The Institute of Future Studies (IFR) scenarios do not offer a comprehensive image of the future, nor are they the only possible construct of uncertainties; but they allow us to ‘rehearse’ possible futures, offer opportunities to deepen our insight, enrich our debate and promote a shared understanding of where and how we can influence the future.” He says IRMSA and IFR are collaborating not only on building future scenarios, but on identifying the skills that risk practitioners require to facilitate and develop these scenarios and then to make the relevant training available to our members to build these skills. The challenges of fast-moving exchange rates, the importance of risk management and the future for young professionals are key, according to Marie-Agnes Sanon, director, central operations and special risks at Africa Re. Her top three risks are: The volatility of the main African currencies, which impact significantly the income of the corporation in its reporting currency (US dollars). Regulatory risk Natural catastrophes. Ms Sanon explains foreign exchange volatility has remained top of the list. “Although there have been improvements from last year, the underlying volatility of the exchange rates makes it a serious concern,” she warns. African economies and markets are still developing, albeit slowly as a result of political uncertainties, Ms Sanon explains. “This development sometimes introduces radical changes and hence exposes businesses to disruptions and risks. “Our risk appetite is purposefully dynamic to allow for changing economic landscapes. Nonetheless, there are still risks that have potentially significant impact on our business. These include currency volatility, regulatory risks, insurtech, natural catastrophes, cyber risks etc.” Regulatory risk has not changed since last year. Ms Sanon says: “The regulatory environment is changing rapidly and the potential impacts are still unclear. For example, South Africa has recently implemented the Twin Peak regulatory approach. This might increase focus on market conduct and customer treatments, which other markets may adopt in the near future. “Other more advanced markets such as Morocco and Kenya may adopt this supervisory approach. Also, other major markets in Africa such as Nigeria are moving towards the risk-based regulatory regime. “There is also the issue of domestication of insurance business, which may lead to market fragmentation. The impact these will have on our business, though, can be analysed but still remain uncertain.” She fears the risk of natural catastrophes is on the rise given the recent seismic activities and the destructive impact. “These seismic activities may not be uncorrelated with the expected impact of climate change/global warming, which has also been linked to extreme weather events such as flooding, cyclones, hailstorms etc. Hence, it may be appropriate to put this risk on the radar rather than classify it as one-off or exceptional,” she suggests. As a risk professional at an insurance entity, it is no surprise that Ms Sanon is a firm believer in insurance as the leading risk mitigation tool. She explains: “Insurance helps to transfer some of our risk exposures. It ensures that we are able to take risks only up to our risk appetite threshold, thereby maximising our risk-adjusted earnings. “There is adequate cover for the current exposures. The market is also quick to respond with new covers when there are new exposures.” Supply chain risk is increasingly on the risk manager radar, not just in a physical sense but also as businesses realise the potential damage to their reputation if something goes wrong in any deal between customer and seller. “In the core business of insurance, the main actors in the supply chain are the intermediaries – that is, agents and brokers,” says Ms Sanon. “Hence, there is some focus on the intermediaries as they wield much influence on the customer and power on the insurance providers. “The cost of acquisition is steadily on the rise. These intermediaries also drive competition among insurance providers, hence a need to consider the risk that exposures from distribution channels,” she warns.

Risk managers cannot afford to stand still

Want to read this article?

Read Next

European Parliament approves regulation to tackle forced labour

Absenteeism drops dramatically in France

Climate change could spread malaria risk to new countries, warns International SOS

Europe records 300% surge in farmer protests this year

Swedish risk managers told to focus on flexibility rather than resilience

European Parliament approves regulation to tackle forced labour

Absenteeism drops dramatically in France

Climate change could spread malaria risk to new countries, warns International SOS

Europe records 300% surge in farmer protests this year

Swedish risk managers told to focus on flexibility rather than resilience

Want to read this article?

Read Next

European Parliament approves regulation to tackle forced labour

Absenteeism drops dramatically in France

Climate change could spread malaria risk to new countries, warns International SOS

Europe records 300% surge in farmer protests this year

Swedish risk managers told to focus on flexibility rather than resilience

Related Articles