Risk and performance reporting some way apart

A CGMA study finds boards of directors need a holistic, balanced look at risk.

Risk reporting is often siloed and has varying levels of integration with performance despite boards’ frequently taking a holistic approach to analysing risk. There is a tendency for board members to look at risk in terms of both threats and opportunities.

These are the major findings of a CGMA study, Integrating Risk Into Performance: Reporting to the Board of Directors, which was released in London last week. The report explored how performance and risk are being integrated into management reporting by studying non-financial companies in Europe.

Risk management has become an important issue for business because of volatile capital markets, uncertainty over the economy, fears about reputational damage and broader concerns over the sustainability of companies and the environments they affect.

And board members increasingly are using risk information in their decision-making process, the study found. The report was featured in a panel discussion about risk Wednesday in London.

Lacking focus?

In organisations, much attention is focused on performance – such as the P&L and return on investment – but there is insufficient focus on risk-adjusted return, despite risk and performance information being different sides of the same coin.

“Risk and return are being looked at very much in isolation, and there is no risk culture that has been embedded in people’s thinking and actions,” said report author Professor Regine Slagmulder, of the Vlerick Leuven Gent Management School in Belgium.

Delegates who attended the report launch event were not confident risk information is fit for purpose.

In an impromptu poll of 80 delegates at the report launch, only 28% thought their boards were receiving the right type of risk information to make decisions effectively, 49% thought risk information is inadequate, and the rest were unsure.

The study found companies are too often focused on risk from a compliance perspective, which means effort is spent on process and documentation rather than linking risk to strategy. A side effect of this is that board members are subject to risk information overload.

This finding was backed up by the impromptu poll. Nearly half (48%) of the attendees believe their boards are being caught up in operational detail while missing the big risk picture.

Identifying risk

Doug Bonthrone, ACMA, CGMA, director of global services strategy at Coca-Cola and one of the panellists, said an important aspect of risk management is having a robust process to identify risks.

“The [aspect] that’s often forgotten is then to go through [a process] which says what’s the probability, because it’s no good focusing on every single risk,” Bonthrone said. “So, if a risk is high probability, high impact, clearly it has to take your focus. If it’s low probability, low impact, you forget it. If it’s high probability, low impact, you may look at some self-assurance. And, if it’s high impact, low probability, you may look at what programmes you are going to put in place to ameliorate this.

“That lens of probability is absolutely essential to feed up to the board and for the board to feel they have a good robust process for getting that.”

Siloed reporting

The study found risk management and reporting tended to be siloed across different business functions, rather than integrated across the whole enterprise.

“For example, you have people in operations looking at supply-chain risk and people in finance looking at financial risks,” Slagmulder said. “That’s good from a specialisation point of view but not so good if each of these functional silos do their own separate reporting up to the board because then you get a very fragmented and uncoordinated insight.”

While risk information travelling up the corporate ladder may come from many sources, Slagmulder said board members of many larger companies take a holistic approach in the way they use it.

“They are looking at it from a portfolio perspective – how well balanced is the whole portfolio of strategic initiatives across strategic themes, and how well balanced is it across different levels of risk to make sure the overall portfolio is aligned with the risk profile of the company.”

Risk is not just negative

Another key finding of the study is that board members don’t just look at the negative aspects of risk, such as threats, they also consider positive aspects, such as value-creating opportunities.

“Coca-Cola is in 200 countries. … We are investing over $1 billion a year in the likes of China, India, Russia, Brazil, etc. Those aren’t really paying out in the short term, but that’s what we are looking at in ten, 20 or 30 years’ time,” Bonthrone said.

He said Coca-Cola also uses risk assessments to help guide resource allocation.
“Where are you going to put your money when you are in 200 countries, and brands and packages, etc.? If you are not bringing risk into that opportunity assessment, then you are likely to put your resources in an inappropriate place,” he said. Not seizing these opportunities is a risk in itself because of the importance of emerging markets to future growth.

SMEs challenges

Panellist Jim Morrison, CPA, CGMA, CFO of Teknor Apex Co., said risk-management considerations were different for small and midsize businesses. For example, at Teknor Apex, a midsize private company, risk analysis is focused on threats and how to avoid them. Risk management is more challenging for SMEs because of stretched resources and a lack of corporate governance regulation compelling them to address risk, Morrison said. There’s also a need to address the opportunities that lie within risk.

David P. Norton, co-founder of the Balanced Scorecard and a special guest at the event, said it is important for organisations to embed risk information into operational and strategic reviews.

“The process of conducting those reviews and looking for the downside is one way to mitigate it,” he said.

Slagmulder agreed, citing the importance of board members’ having “early warning signals”.

“In my view the board should not be involved in the operational details but should have a good view of the top ten risks affecting the business. It’s also important for board members to see the correlations between risks. So in one area you may have relatively small risks, but that might have repercussions elsewhere in the business.”