Corporates in Australia and New Zealand are ahead of the global curve on risk management, taking a more advanced approach to the discipline than their global peers, a major study has found.
A global study of risk management attitudes and practices carried out by Ernst & Young (EY) found that firms from Australia and New Zealand (ANZ) have a more long term view of risk, are embracing Enterprise Risk Management (ERM) and are more likely than their global counterparts to align risk with corporate strategy.
Local firms’ more advanced view of risk management was evidenced through a number of criteria. More than 50 per cent in ANZ saw risk as extremely important compared with 35 per cent globally while 83 per cent embrace risk locally, compared with 69 per cent globally.
Meanwhile, in ANZ, companies spend more time reviewing longer term risks (5 years or more) than short term risks (the next 12 months). Globally, the trend is to focus on the short term and pay less attention to longer term risks. Australia and New Zealand’s global leadership position was reinforced by 76 per cent having a dedicated risk function (compared with 61 per cent globally), 70 per cent having a Chief Risk Officer (CRO) (compared with 55 per cent globally) and nearly 80 per cent linking internal controls reporting to risk management (69 per cent globally).
According to EY, Australia has been a first mover since the publication of AS/NZS: 4360 in the mid 1990s, which was one of the first risk management standards published worldwide. Regulatory moves from the Australian Prudential Regulation Authority and the Australian Stock Exchange have also helped, EY added.
Australia and New Zealand’s risk governance model is also leading the global pack. In ANZ, business unit heads and the CRO are responsible for monitoring risk while it is the board that has primary oversight for risk. Elsewhere the chief financial officer is responsible for both tasks, a less practical approach as management and oversight of risk in one role can be problematic, according to experts. If the management of risk occurs close to its source, risk management may be more easily embedded in the business, they said.
While the board is seen by 87 per cent in ANZ and 85 per cent globally as receiving regular, transparent and robust information on risk, local respondents are less confident than their global counterparts that the board is always using the information (43 per cent compared with 55 per cent).
Australian and New Zealand companies are the only firms globally to be taking practical steps to align risk assessments with corporate strategy, despite global respondents understanding the need to establish a risk framework and communicate the importance of risk around the organisation. However, neither group sees risk information as being primarily relevant to assisting organisations in developing competitive advantage.
Despite the upbeat assessment of the current standing of risk management in Australia and New Zealand there is work to be done. Around 40 per cent of respondents locally and globally said key risks are not being addressed. One of the sticking points is risk culture with two-thirds of local companies admitting they do not have a strongly embedded risk culture. However, two thirds of participants globally are planning to increase spending and investment in risk management in the coming three years, with the bulk of that going to resourcing and support.
The biggest issues are in operational risk, with technology risk being the second major area of concern. Environmental risk rounded out the top three.
According to EY, it is not surprising that many local firms are both taking a strategic approach to risk and looking to develop and enhance the risk management process.
One reason, EY said, for this critical view of apparently mature risk processes may be that these respondents operate in the mature framework provided by AS/NZS 4360. In such an environment, those people involved with risk seek to continuously improve the supporting processes and procedures by comparing themselves against this standard. In other words, their greater understanding of risk management best practice makes them more critical of their own performance. Additionally, a number of organisations taking part in the survey are likely to have participated in risk management audit or review exercises that would have raised suggestions and recommendations for risk management improvements and, in turn, made them more aware of areas that need to be addressed. Certainly in financial services, the work done to comply with Basel II regulations has increased focus on operational risks and made organisations more critical of risk processes in this area.