How will future risks and trends impact your risk management framework?

One of the reasons why some companies are losing a cybersecurity war to bad actors is the fact that their risk management toolkit doesn't not respond to new risk schemes fast enough. To stay up to speed, a company has to frequently reassess and enhance its risk management framework. Additionally, companies have to exchange knowledge and lessons learned with peers through participation in industry associations. Joining forces allows to stay ahead of threats and use risk prevention as the best strategy.

Cybersecurity issues are one of the top strategic risk concerns for company executives and board directors. Most of the C-suite, unfortunately, do not have cybersecurity backgrounds or expertise. This presents tremendous opportunity for your RMF to reach into and beyond the organization, and build processes to build resilience through networks and partnerships. Likewise, it presents opportunities to enhance communication with leadership, including through scenario planning and table-top exercises. Every business is an IT business, and your RMF should consider how work addressing cybersecurity risks can identify new products and services, delivering customer value and competitive advantage.

To effectively address the impact of future risks and trends on a risk management framework, organizations should adopt a proactive and forward-thinking approach. This includes regularly reviewing and updating the risk management framework, conducting scenario planning and stress testing, engaging in horizon scanning to identify emerging risks, fostering a culture of risk awareness and learning, and integrating risk management into strategic decision-making processes. By staying agile, adaptive, and responsive to future risks and trends, entities can enhance their resilience and ensure effective risk management in an ever-changing business environment.

Climate risk management, both for physical and transition risks must be a part of a company's ERM. Climate risk management is still an evolving space and available data used for risk management purposes (for example, Scope 3 CO2 estimates) can still be questionable. Don't hesitate to question data and methodology behind it as you aquire data from vendors. Also, remember that risk management aims at identifying both threats and opportunities. As you assess climate risk, strive to discern potential opportunities for business.

The US fire service has not given adequate attention to the reality of climate change; as more parts of the country experience water scarcity, firefighting will become more difficult. Lackadaisical attitudes toward building and fire code enforcement hinder resilience in the name of short term gain, and EMS providers are going to start seeing patients with illnesses and injuries related to the new environment. The industry-wide embrace of community risk reduction and mobile integrated health will mitigate many of the emergency response issues (i.e. fewer emergencies) but implementing those changes in a notoriously regressive industry slow to recognize and adapt to changing circumstances has been a tall mountain to climb.

Climate risks present an opportunity for your RMF to incorporate processes that consider second order consequences (positive and negative) too. Indeed, they present opportunities to test for bias, think across short and long term time horizons, and align with company mission and values.

In many instances, executive leadership and business managers, government relations executives, human resources, and others will have valuable insights. Often, they will be better informed about what is happening behind the headlines. This presents an opportunity for your RMF to establish frameworks to elicit their inputs, and connect with the business.

Lack of innovation is a frequent cause of business failure. So, it presents perhaps your biggest opportunity for your RMF to be oriented towards “positive risk taking’. The RMF shouldnt be designed to prevent all bad things from happening at the expense of taking any risk. The RMF must empower good decisions, by collecting data and supporting good judgement calls on where the business can go.

Managing human capital risk starts with putting people first. Create a culture where employees have the space and grace to be themselves. When leaders lead and are the examples of open communication, diversity and inclusion, and well-being, it empowers employees to do the same. We’ve heard “attract and retain” a lot; tack on “adapt” as companies must do so given the new reality of the workplace. Proactively managing human capital risk positions companies for long-term success.

A Qualified Risk Director, certified by the DCRO Institute, can benchmark maturity. In financial services holders of Financial Risk Manager (FRM) or other certificates can help too.