accenture managing risk for high performance in extraordinary times

8/9/2019 Accenture Managing Risk for High Performance in Extraordinary Times

1/20

Managing Risk for High Performancein Extraordinary TimesReport on the Accenture 2009 Global Risk

Management Study


2/20

Develop integrated risk

management capabilities.

Risk management must be

institutionalized, integrated and

aligned with the operating model

of the business. To be effective, risk

management must be a normal and

expected component of the meetings

and reviews that are held and the

questions that are asked. Risk issues

must inform governance and decision-

making processes, the training people

receive, the management and leadership

cultural behaviors expected throughout

the organization and the reward

structures in place.

Effective integrated risk management

departs from the fragmented and

compartmentalized solutions already

in place at many companies. It offers a

holistic view of the enterprise, enabling

the identification and understanding

of a variety of risks, and then feeds that

understanding into the growth engine

of the company. An effective response

to any particular kind of riskstrategic,

market, credit, liquidity or operational

depends on rapidly and consistently

gathering, aggregating and making sense

of information from both internal and

external sources.

Improve the quality of information

and the frequency of risk reporting.

Companies that are more competent

in managing risk have a higher

frequency of risk reporting to different

stakeholders. They are also more likely

to have standardized risk reporting

procedures.

The quality of information and data

is also critically important. Effective

risk management and internal controls

depend on the information provided.

In our experience, companies that aremore advanced in their risk management

capabilities have attained a high degree

of granularity in the risk data that

supports their information reporting.

Attaining this level of granularity

and specificity is a direct result

of foundational risk management

processes that have been embedded

in these organizations. Management

needs the right information, in the

right granularity, at the right moment

to assess risks and take action.

years in developing more rigorous

risk management capabilities, survey

respondents highlighted two goals in

particular: better alignment with the

overall business strategy and more

effective collaboration with their

business units.

3. Integration of risk managementand performance management

is lacking. The risk management

capability in most organizations plays

an important role in strategic decision-

making but at this point is less involved

in objective setting and performance

management.

4. Increased regulation is expected.

Companies expect a more stringent

regulatory and compliance environment

in the coming years.

5. The costs of effective risk

management are increasing. The

cost of risk management has increased

significantly over the last three years,

driven primarily by increased business

complexity, as well as inefficiencies

in systems, data and processes.

6. Outsourcing of parts of the risk

management capability is being used

to improve efficiency. Outsourcing of

selected processes and systems is being

used to increase the efficiencies of the

risk management capability.

7. Companies are investing to improve

their risk management capability.

Despite the current crisis and shrinking

budgets, firms are increasing their

investments in their risk management

capabilities.

8. Optimism still exists about the

ability of strong risk management

to drive business performance.

Executives continue to believe in the

ability of a strong risk managementcapability to support profitable growth.

Implications for AchievingHigh PerformanceBased on this research study, and

on our experience working with

organizations across all industries

to improve the ability of their risk

management capability to drive

business value, the following

are especially important keys

to achieving high performance

through an improved,integrated

risk management approach:

Executive SummaryIn the wake of the global economic

meltdown, chances are there isnt a

boardroom or executive management

office anywhere today where the topic

of improving the organizations risk

management capabilities, processes,

tools and training isnt top of mind.

Companies have stared into the abyss

and they dont want to get that near

that ledge again.

The stakes are even higher given the

scope and seriousness of the economic

downturn. The business community has

seen global recessions before, but this is

arguably the first multi-polar recession.

That is, the multi-polar world has only

come into existence over the past

decade or soa world where both the

generation and consumption ofeconomic power is emanating from

multiple points around the globenot

just from traditional, Western and

industrialized centers of power. How a

multi-polar world reacts to prolonged

economic duress is still an unknown.

To better understand the challenges

companies within a multi-polar world

are facing with regard to their integrated

risk management capability, as well as

the approaches, tools and structures that

are helping some companies manage riskmore successfully, Accenture recently

conducted its 2009 Global Risk

Management Study. The research

involved a survey of the risk

management attitudes and capabilities

of more than 250 of the worlds largest

enterprises, represented by their chief

financial officers, chief risk officers and

other risk executives.

Major findings

The following are the major summary

findings of the Accenture 2009 GlobalRisk Management Study:

1. Risk management capabilities

are not currently equal to todays

challenges. The current financial

crisis has underscored the fact that

significant improvements in companies

risk management organizations and

capabilities are required.

2. Risk management is inadequately

aligned with business strategy and

poorly integrated into business

operations. Asked to name the biggest

challenge they face over the next two


3/20

2

in protecting value or guarding against

failure. By optimizing both risks and

rewards, companies with effective

and integrated risk management

capabilities link risk and profitability

objectives; in this way they can improve

strategic capital decisions and increase

shareholder returns. They better

coordinate risk measurement, capital

allocation, performance assessment

and management across the enterprise.

performance management capabilities

as advanced.1 What that means

from a risk perspective is that many

companies cannot adequately focus

the risk management organization on

what exactly it should be doing to drive

risk-adjusted business performance.

Increase the involvement ofrisk management in driving

value creation.

Accenture believes that companies

have an opportunity to employ risk

management as a competitive

differentiator to create value while

also protecting the interests of

shareholders and other key stakeholders

in a cost-effective manner. Improved

compliance is an important goal, but

higher goals must also be pursued.

Today, effective risk management isalso a matter of using the information

derived from risk assessment and

analysis to make better decisions

and drive growth. In this way, risk

management becomes a proactive,

ongoing initiative tasked with creating

value, not simply a reactive exercise

Risk-adjust the companys

performance management processes

Risk management exists to support,

not stifle, the entrepreneurial spirit of

a company. If inadequate coordination

exists between risk management and

performance management, executives

may be improperly rewarded for the

risk/return outcomes of their decisions.

Therefore it is important to employ

risk-adjusted performance metrics

assessing potential rewards with

some adjustment for risks. Combining

risk-adjusted metrics with traditional

asset-liability management and

profitability-performance measurements

can provide a company with a more

balanced view.

One of the issues here is that

companies struggle just as much

to provide integrated performance

management capabilities as they do

to provide integrated risk management

capabilities. For example, only 20

percent of respondents to Accentures

most recent High Performance Finance

Study described their enterprise

The Accenture 2009 Global Risk

Management Study underscores the

fact that risk management can be a

competitive differentiator, helping

companies advance toward high

performance even in these uncertain

economic times. It is critical, however,

for risk management to be integrated

throughout the operating model of

the business, including its culture and

incentives as well as investment, financeand operational decision making.

In fact, risk management and

performance management are really

two sides of the same coin, and they

need to be held together in a kind

of constructive tension. This tension

frequently tests the limits of the

entrepreneurial spirit each company

needs to drive growth. To be sure, those

limits must be firm and unambiguous.

But there are times when a strong

risk management capability should

encourage a company to probe those

limits. With closer integration, the

risk and performance sides of the

organization are kept in sync, working

together toward a common goal:

supporting a companys risk appetite

while also protecting the interests of


in a cost-effective manner.

The ultimate results of the effective

coordination of risk management

and performance management can be

higher economic returns, sustainable

shareholder value and increased

stakeholder confidence in spite

of an uncertain global economy.

Achieving these goals is a critical part

of driving toward high performance

in extraordinary times.

Risk management and performance management:

Working together to drive high performance


4/20

3

The required changes will require

a long-term commitment set by

executive management and supported

by associated investments. The good

news emerging from the Accenturesurvey is that, although the executives

recognize that they will need to

make new investments in their risk

management processes, they also

expect the changes to deliver positive

bottom-line results. The compliance

demands caused by new regulations,

and the need to to coordinate and

link complex business systems, will

increase overall risk management

costs. Outsourcing part of the

risk capability can increase efficiencies

and help to counteract cost increases.

For many companies the investment

goes beyond compliance requirements

the survey reveals an emerging group

of companies that believe that strong

integrated risk management can drive

profitable growth.

About the research


Management Study is based on

responses from more than 250

executives involved with theirorganizations risk management

capability. A high percentage of

C-level executives participated,

including chief financial officers

(34 percent), chief risk officers

(33 percent), chief executive officers

(13 percent) and chief compliance

officers (8 percent). Respondents

were from all major geographies

and industries (see graphics).

Many jobs and functions have changed

or are being looked at with increased

scrutiny since the 2008 collapse of

the global capital markets, but perhaps

none more dramatically than the fieldof risk management. The first truly

global financial crisis has revealed the

inherent weaknesses in the traditional

approach to risk management, and the

inadequacy of current risk management

processes to respond to the challenges

in the emerging economic order.

With the global economic crisis quite

fresh in everyones mind and experience,

Accenture recently conducted a global

risk management survey involving more

than 250 chief financial officers, chiefrisk officers and other risk management

executives across all geographies and

major industries. (See About

the research.)

Our purpose in conducting this risk

management survey was to assess

executives perceptions and plans for

their organizations risk management

capabilities in light of the economic

downturn. We also sought to gauge

respondents insights into how risk

management can be transformed froma controlling, compliance-oriented

capability to one that can effectively

support the entrepreneurial risk-taking

needed to achieve high performance.

Taken together, the survey results

show a strong commitment to using

the lessons of past failures to create

a new generation of integrated risk

management that can drive business

value. The surveyed executives were

close to unanimous in their belief that

current risk management practicesmust be substantially improved both to

correct deficiencies and to capitalize on

emerging opportunities. One widespread

perception that can be seen in survey

responses is that an organizations risk

management capability has been overly

isolated and not fully a part of the rest

of the organization. Risk executives

believe risk management must be better

aligned with the companys strategy

and goal-setting process and more fully

integrated into the companys businessunits, culture and performance

management processes.


Management Study: Major Findings


5/20

4

Financial Services28%

Public Services1%

Communications& High Tech21%

Resources23%

Products27%

Industries of participating organizations.

Geographical location of participating organizations.

North America31%

Europe, Africa,Latin America48%

Asia Pacific21%


6/20

5


7/20

6

overwhelmed the traditional thinking

and fragmented processes at the heart

of most corporate risk management

processes and systems. Companies

tracked risk, though often in a siloed

manner. This rendered them incapable

of assessing the compounding and

interrelated issues until the situationgot entirely out of hand.

The economic crisis was the ultimate

stress test for a companys risk

management capability. No financial

simulation could accurately capture

the dismal performance and the

increasing correlated reactions of

the financially engineered products.

No scenario planning exercise could

realistically depict the global markets

extreme reaction and many companies

fumbled responses.

Lessons from the crisis

The survey respondents were frank

in their assessments of the overall

strengths and weaknesses of their

internal risk management capabilities.

About half believed that their company

was well prepared to face the current

level of economic turmoil, while the

other half believed that their companywas not well prepared. (See Figure 1.)

Somewhat similar numbers resulted

when executives were asked to assess

their confidence in dealing with future

risks and negative events. On a scale

of 1 (low) to 5 (high), forty-two percent

assessed their preparedness at 3

or lower, while 58 percent ranked

themselves as prepared or very prepared.

Together these findings are a candid

admission that mistakes were made

and that changes must occur inrisk managements approach.

A unique and unprecedented aspect

of the market collapse of 2008 was

the speed at which events occurred,

outpacing the ability of companies

internal systems and risk management

capabilities to keep up. Market events

Figure 1: How prepared was your company from a risk management

perspective to deal with the current economic and financial turmoil?

Level of preparedness to face current economic and financial turmoil

4%

7%

35%

45%

8%

Not Prepared 2 3 4 Extremely Well Prepared

Increasing levelof preparedness


8/20

More specifically, the Accenture 2009

Global Risk Management Study found

evidence for eight primary lessons to

be learned from the manner in which

most current risk management capability

performed against the current economic

crisis.

In the postmortem assessment of this

real-life stress test, executives have

identified a number of components

which did not adequately perform or

integrate. (See Figure 2.) These include:

Inadequate availability of timely

risk, finance and business data.

Lack of integration and aggregation

across all risk types.

Ambiguous risk responsibilities

between corporate and the

business units.

Inability to integrate risk, return

and capital issues in decision

making at both the strategic

and operational levels.

Insufficient enterprise-wide

risk culture.

Lack of alignment between a

companys strategies and its

risk appetite.

7

Figure 2: Lessons learned from the current financial and economic crisis.

In time availability of integrated risk, finance and businessdata has to be improved

Risk transfer to insurers or capital markets will be more important

Tools, methods, models are not enough to reflect and evaluate thecomplexity and dynamics adequately - a human factor needs to be(re)institutionalized in risk management for evaluation

Remuneration/Bonuses have to support prudent risk management andlong term business perspective

Effective integration of subsidiaries and/or business units into corporaterisk management processes and look through on exposures andunderlying risk drivers has to be implemented

The integration of risk across all relevant risk types will be increased

Risk management responsibility between group and business unitshas to be sharpened

Systematical and recurring evaluations of integrated risk situation includingmacro economic scenario analysis, look through on risk drivers and riskconcentration and systematic deep-dive analysis is required

Risk management needs to move out of compliance function into abusiness partner role

Operational decision making has to integrate more effectively risk,return and capital management views.

Strategic decision making has to integrate more effectively risk, returnand capital management views

Enterprise wide awareness for risk (risk culture) has to improve

The strategic alignment between business strategy and risk appetitehas to be improved

80% Divider

80% 20%

55%

75%

75%

75%

78%

78%

68%

68%

78%

85%

82%

85%

45%

25%

25%

25%

22%

22%

32%

32%

22%

15%

18%

15%

Agree Disagree


9/20

8

The foundational elements of an

effective integrated risk management

programconsistent risk processes,

governance, measurement and

taxonomy.

The desired outputsrisk reporting;

risk aggregation and integration;

risk-adjusted performance and

executive compensation; and

better alignment of strategy

and risk appetite.

Lesson 1:

Risk management capabilities are not

currently equal to todays challenges.

Although about half of the survey

participants believed their companys

risk management approach was well

prepared for the economic crisis,

executives nevertheless overwhelmingly

agreed that improvements are needed

in companies ability to manage risk in

pursuit of better business performance.

(See Figure 3.) More than 85 percent

of respondents (see above, Figure 2)

indicated that changes must occur in

their risk management capabilities if

the lessons from the economic crisis

are to be learned and then leveraged

to produce better business results.

These changes must address all

the major components of risk

management, including:

Figure 3: Level of changes required to take full advantage of the lessons learned

from the economic downturn.

No changes required Slight changes required Significant changes required

15% Divider (Average of No changes required)

In time availability of integrated risk, finance and businessdata has to be improved

Risk transfer to insurers or capital markets will be more important

Tools, methods, models are not enough to reflect and evaluate the complexityand dynamics adequately - a human factor needs to be (re)institutionalizedin risk management for evaluation

Remuneration/Bonuses have to support prudent risk managementand long term business perspective

Effective integration of subsidiaries and/or business units into corporaterisk management processes and look through on exposures and underlyingrisk drivers has to be implemented

The integration of risk across all relevant risk types will be increased

Risk management responsibility between group and business units has tobe sharpened.

Systematical and recurring evaluations of integrated risk situation includingmacro economic scenario analysis, look through on r isk drivers and riskconcentration and systematic deep-dive analysis is required

Risk management needs to move out of a compliance function into abusiness partner role

Operational decision making has to integrate more effectively risk,return and capital management views

Strategic decision making has to integrate more effectively risk, returnand capital management views

Enterprise wide awareness for risk (risk culture) has to improve

The strategic alignment between business strategy and risk appetitehas to be improved

12%47%

42%

27%44%

28%

13%48%

38%

15%44%

41%

14%51%

35%

11%

52%37%

16%51%

33%

18%46%

35%

22%42%

37%

12%53%

35%

11%48%

41%

14%48%

38%

11% 49%40%


10/20

Eighty-two percent of executives agreed

that improvements in risk culture are

necessaryenterprise-wide awareness

of risks and how to mitigate them in

the name of better overall business

performance.

assessments about risk, return and

capital management, as well as better

alignment of business strategy and

the risk issues that affect, positively

or negatively, the achievement of

goals and strategies.

Integration of risk management acrossall relevant risk types is also important,

according to 78 percent of respondents

(shown above in Figure 2). The goal

of a new generation of risk management

solutions must be the full integration of

risk management with the operating

model, performance goals and decision-

making frameworks of a businessthe

layers of day-to-day accountability

within the organization as well as the

bigger rules and governance structures

by which it operates.

Integration of risk management into a

companys organization structure and

culture is also essential. Both good and

bad news needs to be communicated

across, up and down the organization in

an open, transparent and timely manner.

Lesson 2:

Risk management is inadequately

aligned with business strategy

and poorly integrated into

business operations.

Asked to name the biggest challenge

they face over the next two years

in developing risk capabilities that

are more rigorous and effective, surveyrespondents highlighted two goals in

particular: better alignment with the

overall business strategy and more

effective collaboration with their

business units. (See Figure 4.) For

example, 85 percent of survey

respondents agreed that one of the

lessons of the current economic crisis

is that the strategic alignment between

risk management and business strategy

must be improved.

As shown above in Figure 3, 42 percent

of respondents pointed to the need for

better integration of risk, finance and

business data. Similar numbers of survey

participants looked to better integration

of strategic decision-making with

9

Figure 4: Primary challenges for the risk management organization over the next two years.

Significant Important Not Really Important Not Important At All

Availability ofcomprehensivetechnologicalsolution to meetyour needs

Being alignedwith the overallbusiness strategy

Collaborationwith businessunits

Cost reduction Resources/talent

Identificationof the bestservices to meetbusiness needs

Integrationin the firmsprocesses/culture

1%

30%

50%

18%

37%

56%

4%

3%

36%

53%

7%

3%

38%

39%

21%

2%

33%

55%

9%

2%

30%

50%

18%

2%

37%

52%

9%

3%


11/20

10

The challenge of the next generation

of risk management is to better

integrate and align risk taking

with performance measurement

and executive remuneration. This

fact was affirmed by 75 percent of

the executives surveyed. Forty-one

percent of respondents felt that

significant changes are required to

remuneration and bonuses, which

need to more effectively support

prudent risk management and a

long-term business perspective.

Lesson 3:

Integration of risk management and

performance management is lacking.

How involved is risk management in

some of the critical aspects of managing

the business and making decisions?

For a significant number of survey

respondents, integrated risk

management is essential to effective

strategic planning. Forty-eight percent

of executives said their risk capability

is involved to a great extent in such

planning, and 92 percent indicated risk

was involved at least to some extent.

Similarly high numbers pointed to

the importance of risk managements

involvement in investment and

divestment decisions: 45 percent

say risk is involved to a great extent

and 87 percent say there is involvement

to some extent.

Contrast those results, however, with risk

managements involvement in objective

setting and in performance management.

For both those types of activities, only

27 percent of survey respondents said

the risk capability was involved to

a great extent. (See Figure 5.)

Figure 5: Inclusion of risk management in decision-making processes.

To A Great Extent To Some Extent Not Included Not Applicable Lower inclusion

Strategic

Planning

Mergers and

Acquisitions

Investment &

Disinvestment/FinancingDecisions

New product/

Process/SystemIntroduction(Incl. Designand Pricing)

Objective

Setting andIncentives

Performance

ManagementProcess

Budget &

Forecasting

Procurement Definition of

Health &Safety/EnvironmentalControlRequirements

Definition of

InsuranceRequirements

Outsourcing/

MultisourcingDecisions

48%

2%

37%

43%

12%8%

45%

2%

36%

48%

12%

3% 2% 2%

33%

50%

16%

1%

28%

47%

21%

5%

30%

45%

22%

3%

40% 42%

13%

5%

29%

47%

20%

5%

12%

6%

44%42%

54%

27%

17%

27%

18%

53%


12/20

Several factors are leading to these cost

increases. One is fairly obvious: increased

regulation leads to the need for more staff

and more investments in compliance-

monitoring processes. Other factors are

more technological in nature. For example,

more than 80 percent of respondents

indicate that poor data quality, inefficientreporting processes and fragmented

systems are increasing the cost of risk

management. Inefficiencies may be linked

to the absence of a good infrastructure.

Fewer than 25 percent of the companies

surveyed have an integrated and scalable

IT infrastructure to help manage risks.

The inability of many companies to create

and sustain an integrated risk management

approach is also a factor. Insufficient levels

of integration lead to redundancies and

errors, which in turn lead to increasedcosts. According to our survey, most risk

managers spend only about 20 percent

of their time advising business units.

Almost 60 percent of their time is spent

on data cleansing, data management

and compliance needs. (See Figure 8.)

But compliance alone cannot effectivelydefine risk management, nor derive itsoptimal value. Compliance tends tobreed a command-and-control riskmanagement environment. It can alsoproduce a merely reactive culturefocused on ticking boxes on a checklist

rather than on working togetherproactively to find ways to improveperformance through bettermanagement of risks.

Lesson 5:

The costs of effective risk

management are increasing.

The complexity of the risk environment

has cost implications that are a concern to

companies, given the financial constraints

under which they are already operating.

For about four out of ten respondents,

risk management costs have increased bymore than 25 percent. For 14 percent of

respondents, costs have risen more than

50 percent. About seven in ten companies

have experienced cost increases in excess

of 10 percent. (See Figure 7.)

Lesson 4:

Increased regulation is expected.

High-profile financial mismanagement

examples in the past usually precipitated

major changes in financial reporting.

The current crisis, on the other hand,

will generate new regulations affecting

risk management. Almost half of our survey

respondents across all industries believethat regulations will become more

stringent, and more than one-third say

they are already experiencing such an

effect. For 45 percent of respondents,

that formation of new regulations is,

itself, actually exacerbating risk problems

making the environment more risky and

not less so. (See Figure 6.)

Regulatory compliance is certainly

a critical component of good risk

management. But if compliance

becomes the only or dominant mindsetof a company when it comes to risk

management, it may impede a companys

ability to anticipate and respond to todays

marketplace risks. Our survey found that

most executives see regulatory compliance

as one of the top benefits of the risk

management capability.

11

Figure 6: To many executives, more regulation increases rather than decreases risk exposure.

45%

34%30%

35%

14%

24%

69%

5%

The ongoingfinancialmarketsinstability

Formationof newregulations

Rapidtechnologicalchange

Politicaland socialinstability

Commoditypricefluctuations

Competitionfor talent

Missing financialliquidity (missingcredit capacitydue to currentcrisis)

Others

What change in the business environment has the potential to cause maximum increase in risk faced byyour firm and its peer group?

Note: Percentages may not add to 100 as respondents could make multiple selections


13/20

12

Figure 8: Percentage of time employees within risk management spend

on a variety of activities.

15.28%

21.97%

18.81% 19.55%

21.51%

Data Management/Data cleansing andReconciliation

Customizing andMaintenance ofRisk Related ExpertEnd-User Tool

Risk ReportsFor Internal Use

Compliance andMandatory RiskDisclosure

Advise toBusiness Units

Average percent of time spent on different activities.

N=260 (May not add up to 100% due to others)

Figure 7: Different levels of cost increases experienced by companies over the past three

years to manage risk effectively.

27% 28%

17%

8%

1%5 %

14%

VerySignificantIncrease(Over 50%)

SignificantIncrease(Between25 and 50%)

ImportantIncrease(Between 10and 25%)

LimitedIncrease(< 10%)

No Change Decrease Do Not Know


14/20

Lesson 7:

Companies are investing to improve

their risk management capability.

Despite the current economic downturn

and shrinking budgets, companies are

increasing their investments in risk

management capabilities. More than

70 percent of respondents have either

increased or are planning to increase

investments to improve risk management

capabilities. Seventeen percent of the

executives say the level of investment

has already been increased, and another

23 percent expect such an increase in

the next six months. (See Figure 10.)

Almost half the firms in our study

(48 percent) invest in risk management

expecting enhanced profitability and

sustained growth as the primary

benefits. Thirty-seven percent expect

improvements in capital allocation.

Other benefits mentioned by at least

25 percent of respondents include

an improved capacity to enter new

markets and regions; enhanced process

efficiency; and better early warning

capabilities about future ensuing

crises. (See Figure 11.)

of the overall risk management

capability can be outsourced

with application development, IT

infrastructure and hosting of risk-

related reporting tools and data

warehouses leading the way.

(See Figure 9.)

Cost considerations are the top reason

for outsourcing, noted by 68 percent

of survey respondents. Other important

reasons include:

Advantage of unified risk procedures

across units of the same company

(55 percent).

Process improvements and better

turnaround time of risk responses

(50 percent).

Improved ability to deal with regula-tory requirements (46 percent).

Enhanced scalability (45 percent).

Lesson 6:

Outsourcing parts of risk

management capability is being

used to improve efficiency.

As a result of the need to substantially

improve the effectiveness of the risk

management capabilityas well as

factors such as increasing costs and

data integration challengesoutsourcing

is emerging as a significant option for

many companies. Its primary attraction

is the elimination of the need for

time-consuming management of IT

applications, allowing risk professionals

to provide more strategic oversight on

behalf of their companys business units.

Companies that have a fully integrated

risk management process but lack the

capabilities to collect, aggregate and

utilize the risk-based information

efficiently can accelerate their effortsby considering the outsourcing option.

Sixty-three percent of survey

respondents stated that some portion

13

Figure 9: The majority of executives believe some aspects of risk management

can be outsourced to deliver better efficiencies.

37%

24%

18%

29%

20%

23%

20%

None

IT infrastructure for Risk Management

Model validation and back testing processes

Application development of expert tools

Hosting/Maintenance of Risk related expert tools

Hosting/Maintenance of Risk related ReportingTools/Data Warehouse

Report production for standardized riskreports and disclosure

63%


Risk activity/processes that organizations think can be outsourced


15/20

14

Figure 10: The majority of companies are increasing their investments in risk


Impact of the current financial turmoil on companies investment decisions to improve their risk management capabilities

13%

15%

31%

23%

17%

72%

No real impact

General budget constraints and cost cuttingprograms may reduce the level of investmentsin risk management

The increase of the level of investment is currentlyin discussion

The level of investment to develop risk managementcapabilities will be increased in the next six months

The level of investment has already been increased

Figure 11: Potential business benefits of investing in improved integrated risk


Not applicable/no planned investments

Reduced market losses

Reduced credit losses

Reduced operational losses

Anticipation of crisis/early warning capabilities

Enhanced process efficiency

Enhanced market reputation/perception

Avoidance of intervention by regulator

Avoidance of intervention by government

Capacity to enter into new markets/regions

Enhanced profitability and sustainability

Regulatory capital reduction

Improved capital allocation

2%

11%

16%

20%

27%

26%

21%

19%

14%

25%

48%

18%

37%



16/20

An integrated risk management approach

is the exception today and not the rule.

Most companies struggle to derive

insights from their internal information

systems and to evaluate the impact of

external events on their operations and

business. Other Accenture researchour

most recent High Performance Finance

Study2found that only 8 percent of

all companies surveyed indicated they

have a fully integrated risk management

capability that is used uniformly across

the enterprise.

Successful companies are more likely to

include risk management as a key input

to making organizational decisions. The

degree of inclusion is particularly high

for business decisions such as strategic

planning, new-product design and

investment/divestment.

Improve the quality and relevance

of information and the frequency

of risk reporting.

An effective response to a certain kind

of riskstrategic, market, credit, liquidity

or operationaldepends on rapidly and

consistently gathering, aggregating

and making sense of information from

both internal and external sources. To

be successful, companies must increase

the frequency of risk reporting to

different stakeholders, and should

also have in place standardized risk

reporting procedures.

broad reach covers both the layers of

day-to-day accountability within the

organization as well as the bigger rules

and governance structures by which

it operates. Based on our research,

and on our experience working with

organizations across all industries

to improve their risk managementcapability to drive business value,

the following are especially important

keys to success:

Develop more integrated risk


Effective risk management departs from

the fragmented and compartmentalized

solutions usually in place at many

companies. It offers a holistic view

of the enterprise designed to identify

and understand a variety of risks, and

then feed that understanding into the

growth engine of the company.

Risk management must be

institutionalized, integrated and

aligned with the operating model

of the business. To be effective, risk

management must be a normal and

expected component of the meetings

and reviews that are held and the

questions that are asked. Risk issues

must inform governance and decision-

making processes, the training people

receive, the management and leadership

behaviors expected throughout the

organization and the reward structures

in place.

Lesson 8:

Optimism still exists about the

ability of strong risk management

to drive business performance.

Executive confidence in the business

value of an integrated risk management

capability remains strong. The highest

number of executives (72 percent) listed

improved compliance with regulations

as an important outcome of improved

risk management capabilities. However,

other business benefits also rose to the

fore: 61 percent of executives stated

that an improved integerated risk

management capability can support

and sustain business profitability,

and 58 percent said that they will

be able to more effectively manage

liquidity and cash flow. More than half

of the respondents affirmed that better

risk management can help them achievecompetitive advantage. (See Figure 12.)

Implications of theresearch for achieving

high performanceTaken as a whole, the survey results

constitute a road map for developing

the next generation of integrated

risk management. The promise of

a new generation of risk management

solutions lies in part in the full

integration of risk management with

the operating model, performance goals

and decision-making frameworks of a

business. Integrated risk managements

15

Figure 12: Impact of risk management on identified outcomes.

No Impact Minor Impact Major Impact

Compliance

with Regulations

Competitive

Advantage

Reduction

in the Cost

of Capital

Sustainability

of Profitability

Enabling

Profitable

Growth

Managing

Liquidity &

Cash Flow

Positive Rating

from Rating

Agencies

Positive

Comments

from Analysts

Reputation in

Public and Media

72%

27%

1%

53%

42%

5%

47%

47%

7%

61%

35%

4%

53%

43%

4%

58%

37%

5%

53%

34%

13%

50%

38%

12%

53%

40%

7%


17/20

ConclusionThe executives we surveyed as part

of the Accenture 2009 Global Risk

Management Study are aware of the

potential business value waiting to

be unleashed from improved integrated

risk management capabilities.

They also know that a new and moreeffective approach to integrated risk

management must simultaneously be

both comprehensive and cost efficient.

It must have the kind of reach and

specificity needed to restore public

trust and enable business growth,

while also delivering the cost

savings that are critical during

these challenging economic times. It

must support the constructive tension

needed to simultaneously set limits on

entrepreneurial activities and encourage

that sense of entrepreneurshiphelping

executives take reasonable risks to

fuel growth and improve business

performance.

The extraordinary circumstances of

the current financial crisis and global

economic downturn present daunting

challenges, but also unique opportunities

to rethink risk management strategies

and practices and run day-to-day

operations better than ever. Despite

intense scrutiny from many quarters,

executives can now exploit the levers

of managing in a downturn to maximum

effect. Cost management, customer

retention, operational excellence

and flawless execution of mergers and

acquisitions are especially important

when uncertainty is greatest.

Accenture believes that the goal of

a new generation of integrated risk

management solutions and capabilities

must be the reestablishment of trust

by which we mean two essential things.First, investors and other stakeholders

must be able to trust that robust risk

management capabilities are in place

to mitigate against the kinds of risks

that eventually undermined the global

economy. Second, however, companies,

entrepreneurs and innovators must

be able to trust that a sound risk

management platform is in place that

enables them to launch new venturesto

grow and expand, to enter new markets,

develop new products and sell to new

customers around the world. Ultimately,effective risk management is about

achieving and sustaining high

performance.

Companies that are successful

in keeping risk management and

performance management in a state

of constructive tension have higher

expectations for what their risk

management capability can accomplish

from a business perspective. They

believe that risk managment has asignificant impact on delivering business

value. That is, effective integrated risk

management can improve the business

at multiple levelsfrom cost control to

compliance to profitability. Successful

companies from a risk perspective are

more likely to indicate that integrated

risk management has a major impact

on areas such as competitive advantage,

enabling profitable growth, sustained

profitability and better ratings and

reputations.

Increase the involvement of

risk management in driving

value creation.

Accenture believes that companies

have an opportunity to employ

risk management as a competitive

differentiator to create value, while

also protecting the interests of


in a cost-effective manner. As we have

noted, improved compliance is an

important goal, but higher goalsmust also be pursued.

Today, effective risk management is

also a matter of using the information

derived from risk assessment and

analysis to make better and more timely

decisions. In this way risk management

becomes more than just a matter of

mitigation, compliance and control,

as important as those processes may

be. Risk management can become

a proactive, continuous initiative

focused on creating value and drivinggrowth, not simply a reactive exercise

in protecting value or guarding

against failure.

By optimizing both risks and rewards,

companies with an effective and

integrated risk management capability

link risk and profitability objectives,

improve strategic capital decisions and

increase shareholder returns. They better

coordinate risk measurement, capital

allocation, performance assessment and

management across the enterprise.

Leading organizations today are also

looking to more effectively monitor

external events to evaluate contagion

riskthings happening with markets,

business partners or other companies

whose problems might then ripple into

their own organization.

Effective risk management and internal

controls depend on the quality of the

information provided. In our experience,

companies that are more advanced in

their risk management capabilities have

attained a high degree of granularity

in the risk data that supports their

information reporting. Attaining this

level of granularity and specificity is

a direct result of the foundational risk

management processes and capabilities

that have been embedded in these

organizations. Management needs

the right information, in the right

granularity, at the right moment

to assess risks and take action.

Risk-adjust the companys

performance management

processes

Risk management and performance

management must work together

if a company is to stay on the path

toward high performance. Risk

management exists to support, not stifle,

the entrepreneurial spirit of a company.

If inadequate coordination exists

between the two capabilities, executives

may be improperly rewarded for the risk/

return outcomes of their decisions.

Performance management is equally

important in terms of providing

guidance and incentives to individuals.

One pervasive problem in organizations

is that performance targets are focused

on the short term and thus do not

encourage behaviors that create

long-term, sustainable value.

One answer is to achieve a greater

level of specificityactually charting

a new set of desired, risk-focused

behaviors against the operating

procedures needed to encourage those

behaviors. In this way, risk management

becomes every employees responsibility,

and strong risk management becomes

synonymous with good management.

The total rewards package can then be

recalibrated to reflect a better balance

of base and at-risk pay, lengthening the

timescale over which deal quality is

assessed and rewards are paid out.

16


18/20

17


19/20

18

Glossary of terms

The following definitions were used inthe survey:

Risk ManagementThe process of

identifying, categorizing, measuring,

monitoring and mitigating risks in

an organization.

Risk CapabilityThe ability of risk

management in an organization to

perform the activities it was instituted

for. It is a combination of the available

people competencies, methodologies

and technology assets.

Risk IT StructureThe IT systems and

architecture underlying the functioning

of risk management in an organization

for example, a risk IT architecture

integrating the different expert tools to

support time-efficient risk measurement

and management processes as well as

increased data and report consistency

across all risk types, or an enterprise-

wide governance, risk management

and compliance software platform

to support internal process controls.

Risk Operating ModelThe way

that risk management constructs itscapabilities to execute its strategies.

The model shows what capabilities

are needed to form an end-to-end

risk value chain.

Risk Management OrganizationThe

people component of risk management.

It includes the governance mechanism,

as well as the roles and responsibilities

of the risk capability.

Enterprise Performance Management

The capabilities required to manage and

optimize business performance across

a single enterprise or business network.

These capabilities include strategic

planning, goal setting, budgeting,

planning, forecasting, and performance

management and reporting.


20/20

Copyright 2009 Accenture

All rights reserved.

Accenture, its logo, and

High Performance Delivered are

trademarks of Accenture.

About AccentureAccenture is a global management

consulting, technology services

and outsourcing company.

Combining unparalleled experience,

comprehensive capabilities across

all industries and business functions,

and extensive research on the worlds

most successful companies, Accenture

collaborates with clients to help them

become high-performance businesses

and governments. With more than

181,000 people serving clients in over

120 countries, the company generated

net revenues of US$23.39 billion for

the fiscal year ended Aug. 31, 2008.

Its home page is www.accenture.com.

About Finance &Performance ManagementThe Accenture Finance & Performance

Management service line helps clients

on their journey to high performance

by identifying critical issues relative to

the office of the CFO, setting strategic

direction and successfully delivering

innovative solutions to transform their

finance management capabilities. We

offer a range of financial consulting

services, focusing on the areas

of corporate finance, enterprise

performance management, finance

operations and risk management.

We have the breadth of experience,

global resources, superior assets

and deep knowledge and insights

to help the CFO create new forms

of value. Our extensive research,

insight and innovation, global

reach and delivery experience

have made us a worldwide leader,

serving thousands of clients everyyear, including many of the Fortune

500 companies across virtually all

industries. For more information, visit

www.accenture.com/fm or contact:

[email protected].

1The Changing Role of the Finance

Organization in a Multi-Polar World:

Accenture High Performance Finance

Study 2008.

2The Changing Role of the Finance

Organization in a Multi-Polar World:

Accenture High Performance Finance

Study 2008.

accenture managing risk for high performance in extraordinary times

Documents