If we define risk management as the recognition, evaluation and effective control of risks what should the role of the risk management specialist be?
For some years two views prevailed:
i. that risks could be divided into static (or pure) risks, roughly corresponding with insurable risks, and dynamic or commercial (and hence uninsurable risks);
ii. that insurable risks could be managed by a “risk manager”.
Neither view has wide currency now. It is recognized that the so-called static and dynamic risks inter-relate often in a dangerous fashion as the enterprise with “dynamic” risk problems will frequently not manage its “static” risks very well. Insurers are realizing that the management factor is one of the predominant determinants of quality of risk.
The management of risk in any company is an all-embracing task and all members of management both line and functional are engaged in managing risk. If there is a single risk manager, then it can only be the chief executive who, through his team, ultimately manages the risks of the company.
How much “risk management” takes place is therefore related to the chief executive’s broad view, his allocation of responsibilities and the determination of priorities in the various executives work. There is a link between the style of the company and the pattern and degree of risk management. Some companies are aggressive risk takers: others excessive risk avoiders it does not follow that the latter are the best risk managers.
At overall company level decisions on acceptable level of risk and the risk return ratio (the level of exposed profit considered against the perceived level of risk) will shape an outline risk strategy which might well not be clearly documented.
There is another important aspect, the natural risks arising from the nature of the company’s business, which can be considered three-dimensionally:
i. the “technical” risks of the business related to production and operational processes;
ii. the “social” risks related to the company’s position in its industry and the industry’s position in society—a mix of what is expected of the company and its industrial colleagues, and what is realistic;
iii. the “political” risks related to government and other attitudes asexpressed in regulations and legislation.
So for the would-be risk management specialist much of the background shapes the possibilities of his role in the company especially the outside risk “culture” (described above as natural risks) and the inside risk “culture” (as seen in management structure, attitudes and activities).
Reasons For Risk Management
It would seem that the first question to be asked is “Why risk management?” and it needs to be asked about each particular company. As soon as the question is considered it will be evident that it must be practically related.
For example:
i. it may be needed because of concern about particular risks and their effect on the company and its operations (often due to an incidentinside or outside the company); or
ii. it may be a reaction to what we can call the “cost of risk”, a feeling that money can be saved by reducing the cost of insurance and/or uninsured losses and/or (although it is usually ignored), the cost of loss control.
Either of these two starting points can provide a basis for risk management action but practical results will be expected. These will be a reduction in the cost of regular losses or (much harder to demonstrate satisfactorily), a clearly perceived reduction in the probability of large losses, or a reduction in insurance costs. In the latter case risk management is not the only factor as the insurance market cycle may help or hinder improvement in cost.
Existing Risk Management
Having found a rationale for risk management and targets against which risk management performance can be measured, one needs to look at what is already happening. The typical big company will already have a number of risk specialists in areas such as fire, safety, security and legal control, each with a particular functional responsibility.
How does their work shape up against the target that has been set? If an internal failure or near miss has caused the initial concern, it seems realistic to ask:
“Why did it happen?”
There are various possibilities or combinations, including the following:
i. the risk function involved was incompetent or not sufficiently practical;
ii. line management failed to heed its advice (or put another way functional management failed to convince line management);
iii. neither recognized and/or responded to the risk situation.
If the target is a reduction in the insurance etc., expenditure, can these specialists be relied upon to contribute sufficiently to ensure success?
Understanding Risk Reasons
Before getting too involved in organizational aspects of risk management it will be useful to consider the “risk problem” and what the risk manager can do about it.
Risks result in injury and loss for a number of reasons and often in combination:
i. lack of awareness—failure to recognise either possibility or circumstances of risk;
ii. lack of capability to handle the risk situation—which may result from lack of knowledge, lack of skill or competence, or lack of resources (equipment or people); lack of practical training can contribute;
iii. lack of motivation to deal properly with the risk problem. This can vary from indifference that lets the problem arise to a refusal to deal with it (either properly or at all) when it emerges (e.g. it’s not my job, I’m not paid to do that, etc.).
The vast majority of losses involve one or more of these factors. Line management has a variety of problems and is often under considerable work pressure so the risk is only another problem. Functional management may be under considerable pressure and despite specialization, the above three factors can be present and may be reinforced by an insular determination not to seek help.
The three major risk reasons of lack of awareness, capability and/or motivation, provide a basis for the risk management specialist. He or she must be able to deal with these shortcomings in a practical way that removes (or helps to remove) them without seriously disrupting the company’s operations or adding substantially to cost. The risk management specialist’s work must be cost-effective, it must save more than it spends.
Risk Management Specialists And Their Skills
To help solve the risk problems of lack of awareness, capability and/or motivation, the risk management specialist must be able to bring something new to the problem-solving. It is important to define this “value added” contribution of the risk management specialist, which is likely to result from superior understanding, superior practical ability and/or superior communication skills.
Superior understanding is likely to come from more careful analysis and particular multidisciplinary or many-sided analysis. Often it replaces a dogmatic one-sided view by a more perceptive examination of why risks are not seen in advance. It may be due to over-familiarity or lack of broader vision. The missing factor is often, but not always, an understanding of human behaviour.
Superior practical ability will come from various sources. It can be either through study, or from looking at the problem in various circumstances and from various viewpoints. It might result from wider or more varied experience and especially from lots of practice in different circumstances.
Superior communication skills are likely to result from the ability to feel about the problem like the persons being taught, the effective use of example and illustration and lively and interesting presentation.
Not every would-be risk management specialist possesses this group of skills. This aspect can be clarified by asking:
- What can this specialist contribute to this problem?
- How will that help?
- What are the consequences, if any, in cost or operational disruption?
It will be clear that what we are talking about is insight, and the ability to achieve a substantial and lasting improvement. For this improvement to happen it is necessary to gain the support of those where in day-by-day control of the risk, so the risk management must be realistic (it must seem capable of achievement and acceptable) and cost effective (usually this means that it has to become part of the natural everyday work of line management.
So how should the risk management specialist carry out his or her role?
Whilst there is a place for patient investigation and research, much of the work is going to be done throughout the company where the risks are—understanding them, seeing why they happen, relating them to normal and unusual operations and developing acceptable means of reducing and eliminating them.
There are huge advantages in this “shoe leather management” approach in finding out what happens, why it happens, how it goes wrong, and what to do about it. It isn’t always easy, and can be embarrassing (when one’s favorite theory or solution clearly doesn’t work) but provides the only lasting basis for substantial and progressive improvement of risk control.
By shoe leather management we mean site visits, looking at real problems under operational conditions, inside and outside normal working hours. The site visit has several purposes, including:
i. becoming acquainted with risk problems at the practical level;
ii. assessing the risk management capability of the unit, factory, or branch;
iii. building good relationships with line management to secure their support.
Site work will help to improve risk control and to extend the knowledge of the risk management adviser but it will not necessarily change attitudes and secure lasting results. The wider framework is understanding and support from senior management expressed in terms of:
i. defining or endorsing risk management targets for line management;
ii. allocating resources including the work of the risk management specialist to achieve these targets;
iii. setting up a program for monitoring progress at regular intervals.
Senior management endorsement will depend entirely on the credibility of the risk management specialist. This will be based on either past success, or for a short period, the credibility of any personal presentation. In the latter case continuing backing will depend on the achievement of worthwhile results so that the two aspects interlink—top management support and results in the field.
It will be clear that the risk management specialist needs a number of qualities, including:
i. an enquiring and open mind;
ii. a willingness to persist, and insist on getting to the heart of the problem;
iii. the personality to get on with people at all levels (a mixture of friendliness and firmness);
iv. good stamina to get into, above, around, through, and below all sorts of structures;
v. the ability to learn fast and absorb the essential.
Any knowledge deficiencies can be corrected.
Inside a company it seems unlikely that risk management will provide a permanent career structure for executives, unless linked with an on-going and more permanent role. In a small risk management department, three years in the career of a broad-minded engineer, accountant, lawyer or manager, spent in risk management will give them a very broad knowledge of the company that will help them move up into senior management; in the meantime they could contribute a lot to risk management after a short period of intensive training.
The key aspect for the risk management specialist is the need to relate his or her work to the individual situation and management style and philosophy of the company and to commit him to realizable objectives.
Takis Kalogerakos
Underwriter