From Risk Management to Risk Leadership

As I engage with risk professionals around the world, I can’t help but notice a distinctive shift in risk management thinking and approach that is evolving. I have increased mature interactions, particularly in Europe, where risk management seems to be more intricately aligned with business objectives, transcending the mere compliance exercise often associated with risk management in the USA with Sarbanes Oxley.

The key to this is whether risk management is strategic or tactical to the business. Are we simply managing a list of risks and going through the motions? Are we strategically providing value in risk leadership to the organization to ensure that we minimize surprises to achieve the objectives of the organization?

During a recent Risk and Resilience Management by Design Workshop I facilitated, I interacted with a Chief Risk Officer (CRO) from a European life sciences company. His story encapsulates the transformation from traditional risk management to a more leadership-driven approach. Upon being appointed as the Chief Risk Officer, he had his first meeting with the CEO. In that crucial moment, the CEO asked: ”So, you are the new CRO. Tell me what that means to me?” In response, the CRO offered a succinct and powerful definition: ”My job is to ensure you have no surprises in achieving the organization’s objectives.” The CEO found this definition brilliant, considering it the best encapsulation of risk management he had ever heard.

The CRO’s assertion that his role is to manage uncertainty and ensure ”no surprises” in achieving organizational objectives reflects a proactive approach to risk leadership. While surprises may still occur, the Chief Risk Officer is tasked with minimizing uncertainty and ensuring that executives and the business are well-informed about potential risks to their objectives.

What sets this CRO’s response apart is the shift in risk accountability. Rather than burdening solely on the risk management function, the CRO emphasizes that risk management’s role is to facilitate, communicate, and engage on risk in the context of objectives. The onus of owning and driving risk decisions lies with executives and the broader business. In this paradigm, risk management serves as a support function, ensuring that risks are communicated within objectives, enabling informed decision-making. This is true risk leadership and not simply routine risk management of lists and repeated assessments.

ISO 31000 defines risk as ”the uncertainty on achieving objectives.” This European CRO’s narrative reinforces the idea that risk requires context and that context is provided by the organization’s objectives. Whether financial, operational, or ethical/ESG-oriented, objectives serve as the foundation for risk management. These objectives cascade from high-level entity objectives down to division, department, process, project, and asset-level objectives, forming the framework for risk management across various organizational levels.