Risk managers must consider message as well as reporting lines–Asia

Geetha Kanagasingam, Vice President, Group Risk at Barclays Plc and board member/Treasurer of Parima, the Pan Asian Risk and Insurance Management Association, said that risk managers should sit independently within a risk function and be relatively high up in the organisational reporting structure. The risk manager should ideally have a direct reporting line to board risk or audit committees that are in place at listed companies, said Ms Kanagasingam. For those risk managers at non-listed entities, the function should be structured in a way that provides a level of independence. This means reporting to the board rather than management, added Ms Kanagasingam.hide“Risk managers are sometimes put in certain compromising positions that stifle them from performing their duties effectively as ultimately they still report into the management rather the board,” she said. “This needs to be borne in mind when crafting a reporting structure for a risk manager. A risk function is ultimately the second line of defence no matter where they are placed within an organisation and must be equipped with a sufficient level of independence,” she added. Roland Teo, deputy director of the risk management office at a Singapore regional healthcare system, board member of Parima and governing council member of the Risk and Insurance Management Association of Singapore (Rimas), agreed that reporting to the board rather than senior management is the best structure. “For listed companies ideally it should be to the board so you have full independence and autonomy. Ultimately the board is the risk owner and they should have the oversight of risk management. In such structures there are no conflicts of interest that there can be if the risk function is overseen by senior management, the CEO or CFO for example,” said Mr Teo. Danny Lin, Associated Vice Present, Risk Management and Auditing Office at Qisda Corporation and Parima board member in charge of its Taiwan chapter, argued: “If the reporting line is to the CEO directly this doesn’t give risk management enough independence, so we report to the audit committee and board. I think this is the perfect reporting position for risk management. “This is a key successful factor for risk management and risk managers. In our organisation risk management reports to the audit committee, the board of directors, but we also work very closely with the CEO. But our boss is the audit committee and the board member that sits on that. Because of this and because the board can see all dimensions and aspects of risk we get very strong support from the CEO.” But other leading Asian risk managers believe reporting directly to the CEO is sufficient. “The risk manager should sit at group corporate level reporting directly to the CEO as the CEO is responsible overall for all risks identified within the company,” said Patrick Abdullah, Vice President, Enterprise Risk Management at Astro Overseas Ltd and Parima board member overseeing its Malaysian chapter. “Depending on the size of an organisation, the risk manager should be supported by a competent team of three or four colleagues working with risk owners from the various business units within an entity,” he added. Thu Xuan Ly, Director of Risk & Compliance at Vina Capital and board member of Parima in charge of its Vietnam chapter, said that no one reporting structure fits all organisations. Depending on the risk culture the risk manager can report to the CEO, COO or even CFO, she said. “However, a risk manager reporting directly to the CEO is still the leading practice of risk management and adheres to the three lines of defence where risk management serves as the second line, the first line is for risk owners or operations and the third line for internal audit and the board,” she said. She believes that limited risk management resources are effectively deployed as long as the organisation understands this concept and there is a segregation of duties between risk owners and risk managers. Steve Tunstall, Director of consulting firm Tunstall Associates and board member/General Secretary of Parima, said that reporting lines are still very much at the discretion of individual companies in Asia, even for listed firms. “There is still a lot of wriggle room in the way the listing rules are written in most Asian countries, as opposed to Europe and the US. So in Asia it is really up to the company concerned as to where and how they position risk management for it to have the most effect,” he explained. He is in agreement with other colleagues that don’t necessarily prioritise where a risk manager sits and reports but rather the message they deliver and the attention it is given. “All reporting lines are acceptable—it is the way you are perceived by top management and recognised that is key. I know people that report to the CFO or the CEO and they still only do the insurance piece. They don’t know how to develop the risk management aspect of their role. So for me I don’t think there is any ideal reporting line, it’s more how you are perceived in whatever structure exists,” said Franck Baron, Group General Manager, Risk Management and Insurance, International SOS and Chairman of Parima. Juliette Gelpi, Group Insurance Risk Manager, Asia Pacific at Schneider Electric and Parima board member, also takes this view. “The direct reporting is not really important, it is rather about what you deliver. I report to the corporate base in Europe but also deliver to local managers and country presidents, but don’t have direct reporting to them. The point is when they have major issues or want to start a new project, maybe in a new country, are they calling me to support them and give them my vision? This for me is crucial for risk managers’ influence,” she said. Keith Xia, Regional Head of Risk Management for Intercontinental Hotel Group and Parima board member in charge of its Chinese chapter, believes the best position for a risk manager to sit and report depends on the risk appetite of an organisation and the risks it faces. But he or she must be closely aligned with setting strategy, he added. “Ideally the company should be strategically thinking about the position of the risk manager and assign the position to a strategic area. So reporting to strategy or those charged with setting strategic thinking is important. In my company I directly report to the global risk management team. We are part of the business reputation responsibility function—so it is a very strategic position. You need this sort of reporting line and strategic position to be able to influence the culture of the firm,” he argued. Bob Sweeney, Vice President, Risk Management at DFS Group Ltd and Parima board member based in Hong Kong, said the person to whom the risk manager reports must grasp the function’s full potential and buy into the risk management concept. “It’s key that whomever one reports to grasps the importance of risk management and sees it as more than simply insurance,” he suggested. Mr Baron believes there are two major key performance indicators (KPIs) for the risk function. Firstly, whether the risk manager helps to manage specific projects or concerns and secondly whether he or she reports at executive and board level to set the level of resource needed to deal with such risks. “You can report to X, Y or Z and not speak about these issues,” said Parima’s president. “I would emphasise the first KPI as being the most important. This is very operational and where you can really provide added value. So I am a big supporter of developing a risk management approach to support projects within a company. This is where you can really make a difference and it is tangible. We tend to see that risk reporting at the top level is less and less relevant to the real business and operational challenges companies are facing,” he concluded.

Risk managers must consider message as well as reporting lines–Asia

Want to read this article?

Read Next

CSDDD a ‘milestone for responsible business conduct’

Shifting climate litigation against corporates and D&Os ripe for growth

New Africa-focused syndicate launched at Lloyd’s

AM Best upgrades outlook for UK market and expects further rate hardening

Marsh extends Cyber ECHO facility to $125m of excess capacity

CSDDD a ‘milestone for responsible business conduct’

Shifting climate litigation against corporates and D&Os ripe for growth

New Africa-focused syndicate launched at Lloyd’s

AM Best upgrades outlook for UK market and expects further rate hardening

Marsh extends Cyber ECHO facility to $125m of excess capacity

Want to read this article?

Read Next

CSDDD a ‘milestone for responsible business conduct’

Shifting climate litigation against corporates and D&Os ripe for growth

New Africa-focused syndicate launched at Lloyd’s

AM Best upgrades outlook for UK market and expects further rate hardening

Marsh extends Cyber ECHO facility to $125m of excess capacity

Related Articles