Managing risk in the extended enterprise

CRE: What do you see as the key issues, findings and recommendations within the study/report? RA: This work reflects on a world in which everything is happening faster, there is total uncertainty and ambiguity about what is happening and where we are all totally interconnected—not just from an IT perspective but in terms of how people work together. If you look at any major project—product design to manufacturing—nobody can do everything from source to end point on their own any longer. So we are all working in these extended enterprises in a very complex world and in this publication we at the IRM are asking what does that look like from a risk management perspective. We feel the solution is all about understanding the power in relationships and who is getting what out of these connections, and not just from a financial point of view. Above all the study stresses the importance of the extent to which there are shared ethical values across the extended enterprise, because where there aren’t shared ethical values that is typically where you see the risk explosions. So that is what we are talking about in this report and how some of the tools and techniques that we are developing need to be spread across this interconnected world of complexity. CRE: Who exactly is the report aimed at? Risk professionals or boards? RA: As with all of our thought leadership it has a joint readership in mind. We always want to support risk practitioners by providing them with tools, techniques and approaches to allow them to better do their jobs, but we are always interested in making sure we can address the needs of the board. At the end of the day if we are not addressing the needs of the board then the risk manager is going to be wasting his or her time.hideCRE: The report stresses the need for organisations to move from enterprise risk management (ERM) within their own entity to ERM across the extended enterprise. How does a risk manager go about achieving this? RA: It is about being able to map the social dynamics. It is also about being able to understand who is participating in your extended enterprise, how you are connected and where are the points where problems can occur. It also demands a change in leadership. Leadership in a hierarchical sense breaks down in an extended enterprise because you don’t have authority as you cannot know everything that is going on. Therefore you need to create a followership so people want to follow the general direction of a particular extended enterprise. In response risk practitioners have got to be much more agile in a business and strategic sense. They have got to be really good at the personal connections, building relationships and making sure the right relationships are working. Risk managers are going to have to adopt a very open and enquiring mindset. Don’t assume you know it all, you have got to be what I describe as the disruptive intelligence that pierces perfect place arrogance. CRE: Is this why the report warns against a reliance on compliance and box ticking to manage new risks thrown up by extended enterprises and increasingly complex supply chains? RA: Absolutely. We are dealing with very complicated ideas and business activities. We know that a complex problem isn’t susceptible to normal management rules. You can’t have a single discipline and a simple process and know what will happen. As you start trying to deal with complex problems you need to bring lots of ideas and disciplines to the table and you need creativity and imagination to find the resolution to the problem. So you cannot just tick the boxes because there are no longer any boxes to tick. Supply chains are a big issue and a tick box mentality can actually hinder supply chain risk management because it diminishes the importance of relationships. It is very difficult for the relationships to survive the tick box approach. CRE: What is the difference between an extended enterprise and a supply chain? RA: There is a really interesting difference. Supply chain is me, my hauliers, my suppliers and if something goes wrong it will be bad for me. Whereas the extended enterprise is everybody that is in my ecosystem and if something goes wrong it is bad for all of us. CRE: The report promotes managing the behavioural side of risk within the extended enterprise. Are risk managers currently doing this or is more work needed in this area? RA: I am not sure whether they are at the moment. Clearly risk management culture is a hot topic right now, but my sense is that a lot of the standard questionnaires are rather stultifying. From my own perspective, rather than the IRM’s, I have been working on getting to the real artefacts of culture, which is all about understanding the risk conversations. Culture boils down to what I say to you, how you respond and whether you are listening to me when I am telling you about risk or thinking about something else. There is an approach that I am beginning to develop where you map conversations about risk between different participants, both within an organisation and across an extended enterprise. To me that is what we are going to need to start to do. I have used this approach in a number of organisations and it has shown up those where a strong silo approach exists, which is disastrous in a complex world. It shows where there isn’t interaction between departments. CRE: But isn’t mapping these risk conversations notoriously difficult to achieve in a quantitative and measurable manner? RA: Culture and behaviour is hard to measure and pinpoint so it is about getting as much data as you can and then being able to map that and show others that things are or are not taking place and working. I have been working with technologists to facilitate this process. It will start with a questionnaire that goes out to comparatively few people within an organisation and asks them who have they been talking to about risk, what subjects have they been discussing and what is the quality of the conversation. From that we can see whether we have both ends of the conversation, whether there is agreement on the importance or quality of the conversation and the number of times the conversation is held. We can then map the conversation by hierarchy, business unit, function, process and geography to map the quality of conversations right across an organisation. A lot of people are currently assessing risk culture with tick box surveys but I am not sure that approach really works. CRE: What role do boards need to play in managing risk in the extended enterprise? RA: From within a UK context the new guidance from the Financial Reporting Council is very clear that it is the board’s responsibility to ensure that the risk culture is appropriate for the management of risks they wish to take from a strategic perspective. But at the end of the day regulation isn’t the reason to do it. The reason to do it is to create a long-term, sustainable organisation. To achieve that you must understand and manage your risks and one of the most important aspects of that is ensuring your people know how to do so. CRE: What are the tangible benefits for risk managers who read and take advice from this report? RA: They will further their ability to influence boards to think more widely about their scope of risk management.

Managing risk in the extended enterprise

Want to read this article?

Read Next

Healthcare and flexible/hybrid working most valued benefits

Global data breaches double in 2023 driven by extortion and third-party software attacks

Social inflation set to continue driving US liability rates: AM Best

Zurich appoints Adriana Scherzinger group head of captives

Marsh McLennan achieves ‘Autism Confidence’ status

Healthcare and flexible/hybrid working most valued benefits

Global data breaches double in 2023 driven by extortion and third-party software attacks

Social inflation set to continue driving US liability rates: AM Best

Zurich appoints Adriana Scherzinger group head of captives

Marsh McLennan achieves ‘Autism Confidence’ status

Want to read this article?

Read Next

Healthcare and flexible/hybrid working most valued benefits

Global data breaches double in 2023 driven by extortion and third-party software attacks

Social inflation set to continue driving US liability rates: AM Best

Zurich appoints Adriana Scherzinger group head of captives

Marsh McLennan achieves ‘Autism Confidence’ status

Related Articles