The recent news of risky investment portfolios, oil spills and contaminated drug products highlight the magnitude of risks that businesses face and the devastating consequences if they are not visible or well managed. But, whose job is it to manage risk and how well is this effort being performed?
We recently explored the topic of Enterprise Risk Management at our second gathering of Maxiom Group’s Life Sciences Financial Executives Working Group. We examined the recent headlines and discussed the impact on Life Sciences in the context of risk management. While not a scientific survey, it was a reasonable sample and many useful insights were developed including:
- Risk management is certainly being taken more seriously by many companies than in the past. No one wants to experience significant failures in their business or the consequences of those failures. To make matters worse, the 24/7, shoot-from-the-hip, globally connected news media exacerbates the consequences of a bad event.
- Companies that have experienced a significant failure are clearly taking it more seriously. Unfortunately, there are not enough proactive planning and risk assessments being done by the rest in the industry.
- Many of the risks in Life Sciences are well known – science, process scale-up, patient safety, financial exposure, etc. What are not nearly as clear, however, is who is responsible for developing the mitigation plans for these risks and how solid those plans really are.
- Generally, senior management does not have sufficient visibility into the level or quality of risk planning and risk assessments being conducted in the company. When an event occurs, it often exposes the level of “assumptions” that have been made that the organization had sufficiently mitigated the risks and had a plan for an effective response.
- The large risks faced by Life Science companies are always connected to Finance – either Finance is allocating resources to the prevention of risk or Finance ends up allotting even more resources to clean up the mess.
- Risk Management is garnishing more attention, but significant gaps remain between the current levels of thinking and planning taking place versus what is desired, given the devastating consequences.
- Most companies lack a systematic approach to risk management that brings more visibility to the major risks they face, assigns specific ownership of the planning process, ensures adequate mitigation strategies and plans, performs regular assessments and develops response plans in case risk events happen.
CFO’s and other senior financial executives are well-situated to more centrally coordinate or drive a systematic process for risk management in most companies. They can and should tie it all together – risk identification, the planning process, ownership of plans, resource allocation, and accounting for risk. They can also ensure that the right level of visibility is achieved, integrated with the strategic/business planning process and properly addressed at the Board level.
Scott Chizzo
Tags: Finance, Risk Management
This entry was posted
on Tuesday, July 27, 2010 at 11:25 am and is filed under Uncategorized.
You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site, or 
Forward
I have noticed that many companies seem to face ERM shortcomings because their viewpoints are too insular. All too often, they rely on internal signal detection as an indicator of increasing risk. Unfortunately, internal signals (even weak ones) are indicative of existing underlying problems.
The best risk signals are the ones that trigger a response before you have a problem. This means examining your competitors and learning from their challenges. This also means that prospective risk identification should be performed to identify potential black swan scenarios before they occur. While this may sound simple and obvious, it requires management to take a step outside of their comfort zone. They must shed the assumption that while catastrophic risk scenarios may have impacted their competitors, it will never happen to them. After all, how many times have we heard management declare that “this won’t happen to us because we have systems in place to protect us”. That’s an assumption that needs to be objectively challenged, better prospectively than retrospectively.