Reporting and managing risk:a look at current practice at Tesco, RBS, local and central government

These case studies from CIMA highlight the need to embed risk management within more easily understood behaviours, consistent with the overall organisational culture. In each case, some form of internal audit team provides either an oversight function or acts as an expert link in that feedback loop. Frontline staff, managers and specialists should be completely aligned on risk, in part just to ensure that there is a consistency of approach. They should understand instinctively that good performance includes good risk management. Tesco has continued to thrive during the recession and remains a robust and efficient group of businesses despite the emergence of potential threats around consumer spending and the supply chain. RBS, by contrast, has suffered catastrophic and very public failures of risk management despite a large in-house function and stiff regulation of risk controls. Birmingham City Council, like all local authorities, is adapting to more commercial modes of operation and is facing diverse threats and opportunities emerging as a result of social change. And DCMS, like many other public sector organisations, has to handle an incredibly complex network of delivery partners within the context of a relatively recent overhaul of central government risk management processes. Key Findings: •Risk management is no longer solely a financial discipline, nor is it simply a concern for the internal control function. •Where organisations retain a discrete risk management cadre – often specialists at monitoring and evaluating a range of risks – their success is dependent on embedding risk awareness in the wider culture of the enterprise. •Risk management is most successful when it is explicitly linked to operational performance. •Clear leadership, specific goals, excellent influencing skills and open-mindedness to potential threats and opportunities are essential for effective risk management. •Bureaucratic processes and systems can hamper good risk management – either as a result of a ‘box-ticking mentality’ or because managers and staff believe they do not need to consider risk themselves.

Risk management in FTSE 100 companies

In recent years the science of risk management has developed substantially, and many large companies and public sector organisations have established separate risk functions employing specialist staff. The reasons behind such developments are varied but they denote an increasing consciousness of a need to actively manage risks and, in compliance with regulations on corporate governance, ensure that an effective internal control system is in operation.

The paradoxes of risk management in the banking sector

This paper uses empirical evidence to examine the operational dynamics and paradoxical nature of risk management systems in the banking sector. It demonstrates how a core paradox of market versus regulatory demands and an accompanying variety of performance, learning and belonging paradoxes underlie evident tensions in the interaction between front and back office staff in banks. Organisational responses to such paradoxes are found to range from passive to proactive, reflecting differing organisational, departmental and individual risk culture(s), and performance management systems. Nonetheless, a common feature of regulatory initiatives designed to secure a more structurally independent risk management function is that they have failed to rectify a critical imbalance of power - with the back office control functions continuing to be dominated by front office trading and investment functions. Ultimately, viewing the 'core' of risk management systems as a series of connected paradoxes rather than a set of assured, robust practices, requires a fundamental switch in emphasis away from a normative, standards-based approach to risk management to one which gives greater recognition to its behavioural dimensions.