Risk management: When to respond and when to accept risk

A coordinated risk response helps companies determine how to respond to risks and which risks may be overmanaged.

Once you’ve aligned your risk universe across the entire risk ecosystem and turned data into insight to determine which risks matter most, how do you determine that you’re taking a connected risk approach? In this fourth installment of our connected risk series, we explore the third quadrant of the integrated risk management wheel and the benefits of a coordinated risk response to reduce redundancy and achieve the desired coverage.

A connected risk approach relies heavily on exactly that: connection. Coordination, communication and complementary actions are at the core of the connected risk approach. Organizations are transforming at an unprecedented pace because the world is changing faster than ever before. Resources must be deployed in the most efficient and effective ways to mitigate risk to an acceptable level, not eliminate it.

Think of the old belt-and-suspenders analogy. In some instances, multiple layers of assurance are required, but sometimes, enough is more than enough. Having an integrated ecosystem with a shared view of risk helps determine when to respond and who is best positioned to take action. Having a centralized command and control function driving risk management activities across the three lines can drastically reduce cycle time and eliminate redundancy to better manage the risks that matter at the right time and with the right resources.

Leading companies and startups alike use the following considerations to develop risk management strategies that instill confidence and build trust among internal and external stakeholders by determining who is best positioned to respond to achieve the desired level of assurance.

Four risk management items to consider when coordinating a risk response

• Gather information: Gather information on internal and external assurance functions and activities, their scope of work and mandates. Once you have a better understanding of the risks that matter, consider revisiting the work you already did when getting started.
• Understand requirements: Obtain an understanding of the executive and board committees and their requirements with regard to risk oversight and reporting (e.g., risk thresholds). When do they want the belt, and when do they want suspenders?
• Map risk coverage: Create an assurance map by plotting your risk ecosystem on the x-axis and risk universe on the y-axis. Develop a scoring system for the desired level of assurance and perceived actual level based on current mandate and response. Identify where you have “assurance gaps” in current coverage and where you may be over-responding based on assessed risk and desired level of assurance.
• Activate: Hold the risk steward accountable for coordinating the actions across the organization to address residual risk where appropriate. Think about your response strategy using the following framework: