Sharpening the focus on risk megatrends
Once upon a time, risk might have been something of a technical, potentially infrequent, item on board agendas. But not any longer.
The last 16 months have upended all views of how to approach risk management, reinforcing the key ‒ and increasingly prominent ‒ role that it plays within businesses that are navigating their way through uncharted waters.
Primarily interested in the question of how Covid-19 has changed the approach to day-to-day business interactions, from the boardroom all the way through to individual home insurance, MEttle gathered insights from three people at the forefront of the discipline of risk: Joanne Ogg, EY’s Managing Partner and leader of the firm’s risk practice; Jonathan Mason, Chair of Vector, independent director of Zespri and Air New Zealand; and Blair Turnbull, CEO of Tower Insurance. We spoke with them about the changes they have seen ‒ and implemented ‒ now that risk has a clear voice in the boardroom.
Risk management needs to move beyond the risk register and should be integrated into everything an organisation does.
A necessary change in view
Joanne Ogg has seen the rapid evolution in the management of risk, specifically among the changing landscape of consumers, dynamic ecosystems, changing industry boundaries, disruptive business models and new competitive domains. This evolution, like so much else, has been turbo-charged by the pandemic. However, she says that this shift was already occurring before March 2020.
“There was a lot of change happening pre-Covid, but what we’ve seen post-Covid is that the pace has accelerated, resulting in fundamental attitudes changing to risk management. Traditionally, many businesses took the approach of compiling a list of risks they would revisit every six months if they were good businesses, every year if they were average, and longer if normal. This practice needed to change, and Covid has made it happen. Risk needs to be managed every day, rather than simply through a risk register every now and then.”
This advice is no different from what she would have said pre-Covid, Ogg adds.
“Covid has driven the need for organisations to be more nimble and agile in the way they operate, having to make decisions quickly and be able to change to respond when events happen, so inherently they need better thinking around risk.”
Blair Turnbull agrees with this view, saying that he has seen an enormous amount of change.
“Tower Insurance is a 152 year old business. It looks completely different today to 10 years ago, and we now look very different to even 15 months ago. The common denominator is how quickly change is happening, which means an organisation needs to assess risks, leverage technology and data to make timely decisions quickly.”
A problem with labelling
Identifying the challenge is a useful start, but what further change needs to take place? According to Ogg, businesses need to embed risk further into everyday decisions and activities.
“Many activities that we do aren’t necessarily thought of as risk management, so the labelling of it is where people fall down. They are doing risk management all the time, they just don’t specifically associate that that’s what it is. When you layer risk management over a list of activities an organisation does, it can seem disconnected and hard to identify the value-add. But, in reality, most people are doing risk management every day, most of the time.”
To sharpen the focus on what sort of activities should be encapsulated within the area of risk in a Covid world, Jonathan Mason says he is seeing more analysis on cashflow, solvency, scenario-planning amid uncertainty.
“Covid hasn’t really ended, even for the companies where it has faded significantly as an issue. The disciplines created on cashflow, operating within uncertainty, and having an appreciation for that uncertainty have had a significant impact. In general, boards have not gone back to pre-Covid business-as-usual in terms of risk management, instead taking a much closer review of issues created by Covid. Additionally, the cadence of board meetings has increased, with directors and managers watching issues much more carefully.”
Sharpening the beam further, Mason describes indirect effects from Covid on almost all of the companies on whose boards he sits.
“For Westpac the economy is much stronger than expected, but banks in general had a period of loan deferral in 2020, and no information about whether people could pay their mortgages, which created a heightened risk alert. It’s still a bit of a ‘wait and see’ approach as it is hard to model a pandemic for a bank where there aren’t any examples to compare. Zespri saw fruit consumption increase, which provided a record year, but also real risks around picking and packing fruit. If we had a Covid outbreak last April or May, public health would have been emphasised over fruit picking.”
Data-driven guidance is key
As Turnbull says, risk is increasing in the world we live in.
“We all need to be able to assess risks and opportunities quickly. At the heart of that is data and technology. Use them to ensure your organisation can pivot and adapt to mitigate risk.”
In this evolving environment, often more information is better than less – not only for customers but also the businesses that serve them. Turnbull says Tower provides constantly evolving risk information and guidance to customers, covering two main areas.
“Two-thirds of our customers don’t understand their insurance, cover, price and why it differs to someone else, which partly relates to our industry’s love affair with jargon. However, we have an opportunity to simplify language and better inform people.
“We are doing this, and we are also aiming to change insurance from an annual event for customers to a more regular conversation, embracing technology to try and educate our customers on their insurance, and therefore their risk. What we want to do as part of risk management is help customers understand their profile as a homeowner or driver for example, which will help them mitigate risk through connected devices, and ultimately help them to manage it.”
However, he says that getting insurance can often seem complex.
“To assess risk, we can ask customers looking for house insurance up to 45 questions like: what is the gradient of your roof? This can leave a customer wondering if they’ll be in trouble at claim time. So, Tower recently launched a different approach, reducing this to only 10 questions, which we’ve done without degrading our own risk. We collate data from Corelogic around the typography of your home and exposure to events such as flooding. This creates a picture of the risk profile of your home, and it is often more accurate than what the homeowner knows themselves. This enables us to ask the right questions and ultimately reduces both the customers and our own overall risk.”
We’re embracing technology to try to educate our customers on their insurance and therefore their risk.
Three questions to spot the swan in the darkness
Awareness of this approach is something that boards could also take advantage of as they raise the topic up the flagpole. Fortunately, this is already happening, says Ogg, who adds that she is seeing greater acknowledgement that boards should be thinking and talking about risk when setting strategy.
In doing so, she also says that boards should be asking themselves these questions.
“Firstly, what are the risks will prevent you from achieving your strategic priorities ‒ are they front of mind, and is management thinking about them constantly? Secondly, when thinking about your strategy: what has to go right?, what could go wrong? And lastly, thanks to Covid, I’d suggest adding: what may surprise you?”
This last question Ogg says has been gaining traction at board and senior executive level since the advent of Covid.
“I don’t think anyone had asked prior to March 2020 “what may surprise us”. We’d always thought about the downside, the opportunity and upside, but not the left field angle. These three questions are practical questions to be thinking about in any kind of strategic planning session, project set up, or business case, for example. If a business can think about these three questions, and have good mitigations in place to respond, then they’re managing risk.”
We’d always thought about the downside, the opportunity and upside, but not the left field angle.
Mason provides further advice around the value and contribution directors can offer organisations on risk management.
“Often managers don’t get time to think, reflect, read and consider risks. Generic risk categories that companies do poorly on are often the ones that have high consequence, yet many consider low probability, so mitigation is deferred. When this risk hits the organisation the management and the board can be caught flat-footed. Directors aren’t in management mode each day, so they can come in and see things that management is often not aware of and increase the organisations priorities based on a different and broader view.”
To address this, he adds that one trick he uses is to read everything that is relevant – and more.
“For example, I will read very carefully any litigation against a board in Australasia. Simply to be aware of examples of how a board has gotten into trouble, and whether there are any lessons for me on my directorships. The best way to manage risk is by avoiding it, rather than managing it once it arises.”
Taking this approach further, to look left field and understand the wider implications of risks and inform his variety of directorships, Mason tasks himself to read periodicals like The New York Times and The Economist as well as everything at every board meeting, plus attending a significant number of talks and panel discussions.
“I go, I listen, and I think. I take the information and think about the impact on the company but also laterally, asking myself “does this have a wider impact on the economy?”
“We need to be aware of what’s happening and ask, “could this affect us?” Risk management is not about eliminating risk, but considering it before the fact, and then how to mitigate it and taking steps to do so. By absorbing information, directors and organisations can draw insights on how to apply and respond to the risk rather than waiting for the risk to emerge.”
He adds that you don’t learn only from reading.
“I also get insights from talking to young people about what they are passionate about, how policy might work, how to attract young people to organisations and how important our licence to operate is as a business.”
Moving the dial into the future
Ogg says that she has seen ‘a lot of lip-service’ paid to business continuity, disaster recovery planning and crisis management prior to Covid, but fortunately that is now changing. She does add that more that needs to be done to enable business success in a time of exceptional risk.
“People have got through Covid fairly well so far because they got the right people together and got stuff done. Boards are now more in tune with risk management and we’re seeing the rise of the concept: ‘don’t just tell me, show me’. Directors and management need to be confident that processes are effective, and controls are operating. Organisations need to have good capability to respond and be resilient within an appropriate timeframe.”
This means, she says, that we need to move on from the idea of just knowing what the risks are and what we might do to make sure they don’t occur.
“We need to know that the processes, controls and plans are actually there and operating, providing assurance that the mitigation or treatment of risks identified is actually going to work and will help the organisation get back up and running.
“Resilience within supply chains, customers and Covid has taught us to have resilience in customer base channels, our supply chain, how we move products and our inventory. The just-in-time concept does not create resilience, as it has left people wanting and with a pretty big gap.”
Mason backs this up by focusing on the well-publicised risks presented to businesses by the current supply chain uncertainties.
By absorbing information, directors and organisations can draw insights and how to apply and respond to risk rather than waiting for the risk to emerge.
“There are some developers who won’t start work on a project unless they know all the materials are there, purely because of supply chain issues. We’re having to deal with a lot more variability, and it’s unprecedented how dysfunctional the supply chain is.”
Because this is an issue that is much wider than New Zealand, he adds that the uncertainty is likely to continue for another few years.
“We thought we were better at inventory management. With the variability in demand, the supply chain has toppled, and it turns out we need more buffer stock, which will take time to fix.”
Ogg finishes by saying: “Risk management needs to move beyond the risk register. It should be integrated into everything an organisation does. It’s a practical process that should underpin all of our important decisions and actions if we wish to succeed into the future.”
Download MEttle Issue 14
MEttle, a collection of stories and interviews with influential New Zealand business leaders, curated by MinterEllisonRuddWatts.