Enterprise risk management is often criticized as being remote from the real strategic needs of the organization. Is this fair comment and, if so, what can be changed to make ERM more relevant? Peadar Duffy gives his viewpoint.
I recently spent a couple of hours talking with the senior independent director of a major FTSE. He opined that in his experience, risk management consistently fails to deliver value. It is led by people who are more administrators than leaders, and more bureaucrats than doers. The director in question has himself been a spectacularly successful CXO in a number of significant organizations.
Around the same time another senior executive with impressive credentials remarked that in his experience ‘risk has been done to him’ by folk in risk management. He speaks of the parallel universes of the operational front lines, risk support, and audit. Whereas the theory and rationale (three lines of defence) is sound, the method of execution is often sub-optimal, and sometimes even counter-productive.
I am sympathetic to these perspectives, as I think that whilst harsh, they are representative of generally held opinions of many in both front line decision making, and strategic leadership positions.
…
Source: DRJ New feed
