Paradigm Risk ACCA CRSA slides June 2013 by Peter Bonisch

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

Organisational culture, governance, risk & performance following the global financial crisis.

ACCA CRSA FORUM Culture, risk & performance 7 June 2013

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

What do we really know about culture? •  Our project •  A recent (from yesterday) look at how well boards oversee risk •  General discussion and debate on culture

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

. . . helping firms to make sense of and succeed in a complex and unpredictable world

Thomson Reuters Breakfast Briefing 5 June 2013

How and how well do boards manage oversight of risk?

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

Who are we? •  •  •  •

Paradigm Risk is a risk strategy advisory firm Based in London Focused on clients across financial, corporate and government sectors. Multi-disciplinary capability and team covering . . . –  governance, –  risk –  control and assurance •  Focus on framework development and appropriate structural, analytic and behavioural solutions •  Grounded in data and empirical knowledge

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

Who am I?

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

How do boards manage oversight of risk?

Very well by most measures but there are some . . . ‘dilemmas’

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

The prize for the most boring photo goes to . . . •  Deloitte •  Global Audit Committee Survey January 2013

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

The KPMG study •  Because we really needed another perception survey to understand the problem . . .

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

•  and what does that mean?

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

The KPMG study, cont: Just for starters . . .

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

The KPMG study, cont: Audit Committee members’ views

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

The KPMG study, cont: Audit Committee members’ views cont.

45%

37%

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

The KPMG study, cont: Audit Committee members’ views cont.

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

The KPMG study, cont: Audit Committee members’ views cont.

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

Much of which adds up to •  The importance of dissent •  The importance of diverse sources of knowledge and opinion

Aaron Wildavsky 1930 – 1993 Poli+cal scien+st UC Berkeley

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

How our language gives us away Vanessa Jones Director Corporate Legal Solu+ons barrister

Ely Razin Head of Board Governance Solu+ons, Thomson Reuters lawyer

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

How our language gives us away •  Appetite •  Tolerance •  Culture . . . . an abundance of metaphor •  Cannot be certain about these things –  “appetite” –  “expected risk” –  “the major risks facing the company” –  “appropriate culture”

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

•  Increasing the number of discussions of risk with management •  Ensuring that the board’s attitude to risk is reflected and applied in the structure of the organization •  Facilitating processes for integrating risk into strategic planning •  Ensuring that risk and strategy are closely linked together in any board papers and discussions •  Eﬀective oversight of risk procedures and practices to ensure that they support the formal structures and policies . . .

FUNDAMENTAL POINT

Risk culture: Rx (at pp.5-6)

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

Risk culture: Rx (at pp.5-6) •  Ensure that the tone from the board is disseminated within the organization to subsidiary companies and on down the chain •  Review the risk management frameworks to ensure they remain fit for purpose •  Embed risk management throughout the organization and align risk management to incentives

easy to say or write VERY difficult to do 22

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

About culture . . . Here is the problem: First, virtually no one clearly defines what they mean by ‘culture’, and when they do they usually get it wrong. Second, virtually no one has read the original research that shows why culture – when clearly defined – is so important, how it is formed, and how it changes. John Kotter in Forbes, 2012

John Kotter Professor of Leadership Harvard Business School author

What risks?

i.e. most satisfied with legal / regulatory / compliance and operating / control risks

compliance / regulatory operating / control

external

strategic / business environment

external technological

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

The truth about failure •  Focus on what matters •  Booz & Co. 2012 •  Repeats 2003 research

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

We live in ‘interesting times’

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

and another survey . . . •  What risks are on executives’ minds? PwC’s 16th Annual Global CEO Survey

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

Confidence is where it is at . . .

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

What matters now?

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

Growth is the new focus

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

And if you don’t believe me . . . Dr Claire Lewicki: “Control is an illusion, you infantile egomaniac. Nobody knows what's gonna happen next: not on a freeway, not in an airplane, not inside our own bodies . . .”

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

The centrality of risk management The ultimate common mode failure would be a failure of risk management itself. A weak risk management approach is eﬀectively the biggest risk in the organization. The Failure of Risk Management: Why It’s Broken and How to Fix It (2009)

Douglas Hubbard Management consultant Chicago, IL

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

In financial terms . . .

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

At the Sharpe end . . .

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

. . . more formally . . .

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

from Fama & French (2004)

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

All based on portfolio theory

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

It all seemed so simple . . . . Source National Association of Active Investment Managers’ website: www.naaim.org

calculated by Rydex Investments using information and data presented in Ibbotson Investment Analysis Software

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

‘The signal’ v. ‘the noise’

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

How we portray risk management

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

The myth •  AS/NZS 4360 •  ISO 31000

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

. . . the reality

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

Define / assign accountabilities

Oversee firm’s risk system

PREFace_! risk enterprise framework active control environment

Describe risk-taking " preferences / tolerances

Define risk scenarios and interdependencies

Draft / circulate guidance

Identify plan & variance metrics

Link risk to resources / capital & operating indicators

Anticipate risk / exposures

TRANSFER

SCAN

Develop resilience

EXERCISE

REACT

COMPARE

Evaluate performance & provide assurance

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

The wisdom of Mr Rumsfeld “The message is that there are no ‘knowns.’ There are things we know that we know. There are known unknowns. That is to say there are things that we now know we don't know. But there are also unknown unknowns. There are things we don't know we don't know. So when we do the best we can and we pull all this information together, and we then say well that's basically what we see as the situation, that is really only the known knowns and the known unknowns. And each year, we discover a few more of those unknown unknowns. “It sounds like a riddle. It isn't a riddle. It is a very serious, important matter.” US Secretary of Defense, Donald Rumsfeld Press Conference, NATO HQ, Brussels, 6 June 2002

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

Our ‘reframing risk’ agenda •  A framework for risk should be focused on taking more risk not less >> •  Competitive advantage in risk-taking

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

A more robust organisational risk framework

THOMSONACCA REUTERS’ CRSA BREAKFAST FORUM BRIEFING | HOW ABOUT | BOARD THE RISK NUMBERS? OVERSIGHT

A framework for risk governance •  Getting risk governance right is not just about ticking boxes •  Putting the capabilities and processes in place to control your analytic core to use the information and insight it produces to lead risk taking and risk bearing in the firm.

use of risk analysis"

analytic core"

governance!

assurance"

risk strategy!

appetite | tolerance"

systems!

controls!

data! modeling!

deployment! behaviour" drivers"

capital!

limits!

risk competencies risk framework" |" risk & internal governance"

THOMSONACCA REUTERS’ CRSA BREAKFAST FORUM BRIEFING | HOW ABOUT | BOARD THE RISK NUMBERS? OVERSIGHT

A framework for risk governance •  Setting the firm’s risk strategy – its appetite, tolerance and limits system – is a vital step in establishing the firm’s competitive advantage.

governance! use of risk analysis"

risk strategy! systems!

analytic core"

appetite | tolerance" controls!

data!

deployment! behaviour" drivers"

assurance"

modeling!

capital!

limits!

risk competencies |" risk framework" risk & internal governance"

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

•  We live in a shrinking, overpopulated, networked and thus interconnected world •  Risk transmission and amplification can be unavoidable

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

Conclusion •  Boards have made almost no inroads in to discussions over –  quality and focus of risk methods and frameworks –  incorporation of a behavioural aspect to risk management •  What would ‘eﬀective’ look like? •  MOST BOARDS ARE NOT EVEN CLOSE AT THE MOMENT •  Acceptance that the world is a complex place –  methods must reflect the complexity inherent in the world •  Discussion of culture has emerged as a catch-all for our unwillingness to confront our inability to eﬀect control instrumentally over a complex environment

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT

The danger The KISS principle . . . •  Dumbing something down that is inherently complex results in dumb not simple •  Dumb things will fail . . . but change will not come overnight . . .

THOMSON REUTERS’ BREAKFAST BRIEFING | BOARD RISK OVERSIGHT