“When we do not challenge and ask the right questions, we create risk.’’
Those were the words of RiskNZ chief executive David Turner (pictured) when he sat down with Insurance Business to talk about the future of risk management and how he believes leaders should approach this function for optimal outcomes.
In Turner’s view, risk management is directly connected with a company’s leadership, meaning how much appreciation is given to risk management from the top is crucial.
“Leadership is the biggest influencer for risk management now,” Turner asserted. “If leadership doesn’t understand how important risk is, then risk management won’t get the right attention, won’t get the right support, won’t get the right funding.”
More importantly, according to the RiskNZ CEO, it is the leadership’s understanding that will lead to the big questions that need to be asked. For example, boards need to appreciate risk more, know what they are reading, and know how to question appropriately.
“If leadership doesn’t understand how to read risk management reports and challenge them, then risk management can be skewed the wrong way,” he said. “Leaders need to understand risk management across their organisation and not just pay lip service to it.”
Turner pointed out that, while risk management teams may have the experience and expertise, leaders can’t just rely on them solely to steer a company’s direction.
“They need to help make calculated logical decisions,” Turner declared. “If they don’t, then the organisation is only moving forward on what it gets told, and this has become a habit in some organisations.
“Risk reporting and advice may usually come from a small department or team within an organisation looking after risk. Effectively, that risk team is influencing the course of that organisation.”
The chief executive clarified that it’s not usually an issue of trust or competence, more than it is a matter of realistic ‘checks and balances’ and thoroughness.
“Good risk management is two things,” Turner told Insurance Business. “It’s questioning and it’s challenging. That’s real risk management. A third thing would be good communication. We tend to not take enough time to know why and how things are decided in risk management, and why we choose the mitigations or pathways we do.
“Many times we take information on board and say it must be correct, sometimes leading to the wrong decision. We need to look at risk and the root causes of risk much more closely. It might be uncomfortable for some, but this is good consultancy, i.e. you go in investigate and, where needed, challenge the status quo and make sure the right information is being presented, and assess from there.”
He went on to explain: “In some organisations, their risk managers and teams have a good and broad understanding of what they should be looking for, and they look at all the risks and issues they can from point A to point Z, and they prioritise what they should look for and they do this quite well. Other organisations may not have that broad understanding.
“Some consultants also need to ensure that not just great ideas are being given, and not just hopes are being sold, but real and realistic solutions, defined targets, and a good level of substance is being provided to not only meet organisational needs and expectations but also help improve our risk industry. I think we have a way to go yet.
“So, the best thing we can do is ask and just make sure we are following the right track, we are all looking at the right things, and any kind of concerns or queries are being met. Also, are we using the right technologies and what technologies might we need in the future? This does not mean to be threatening; rather it’s making sure that there’s a bouncing board… That’s all it is – it’s assurance – but we need to practice this more as we move forward as organisations.”
On the risk managers’ end, Turner pointed out the need for them to be effective communicators as part of their remit.
“It’s not enough to be a really good risk manager, be able to provide reports, conduct good assessments and pass them up,” he said. “That’s only half the battle. We must know how to articulate risk management to everyone in that organisation on each level, how to educate on what risk means, how everyone can use it, and what we should be looking for and asking.
“Also, we should be writing it in a way where people can easily understand it in layman’s terms of exactly what we are getting across, what the real risks are, so people have opportunities to look at that and ask questions back. The biggest risk we have in some organisations is the risk management team itself, where they may have made it overcomplicated, and people can’t understand it.
“The less we understand about something like risk management, the less questions we’ll ask and the more we’ll accept, hence we take on more risk and miss good opportunities, and we don’t get exactly where we need to go. It’s not making everyone in the organisation an expert, but it’s certainly making sure that there’s a habit of good risk management conversation and everyone appreciates it for what it is. This leads to risk management success.”
In a complex world where we are experiencing increasing change, Turner believes a risk manager’s job will be easier if they keep learning to gain wider knowledge, while ensuring they can then communicate that knowledge.
