Business to increase investment in risk management – Nexia International
A global survey of companies and their professional advisers reveals that companies are set to invest more in risk management in the face of growing business risks, says Nexia International (Nexia), a leading network of independent accounting and consulting firms.
Nexia’s Global Risk Management Survey provides a unique combination of perspectives on current risk management practices among mid-market corporates, based on concurrent surveys of over 70 companies and more than 40 advisory firms around the world.
Awareness of risk management is clearly on the increase. Almost half (48%) of companies surveyed expect to increase spending on risk management in the coming year. This is supported by the views of Nexia member firms surveyed – 63% expect the level of risk management services they provide to increase in the year ahead.
Over half of Nexia member firms believe that the risk profile in their country has increased in the last year, reflecting current widespread political, economic and social uncertainties. Bashier Adam at Nexia International member firm Nexia SAB&T, says: “Risk management has become critically important as businesses are challenged to remain competitive while grappling with uncertain operational and financial conditions.”
- Almost half (48%) of companies surveyed expect spending on risk management to increase in the coming year.
- Over half (51%) of Nexia member firms believe the risk profile in their country has increased in the last year.
- Compliance and operational risks were ranked as the most significant among the companies surveyed.
- Two-thirds (67%) of participating companies have a formal risk assessment process in place, but a third (33%) rate these as only partially effective or lower.
- Over half (57%) of companies surveyed have yet to put a formal risk management training programme in place
- 38% of companies say that risk tolerances are only reviewed annually or less frequently.
Overall, the companies surveyed ranked compliance and operational risk as the most significant risks facing their businesses. Respondents indicated that they are least prepared to deal with social media, succession planning, and natural or man-made disasters. Respondents also highlighted the risks surrounding global expansion as a key area.
“Regardless of the size of the entity, the risks are broadly the same, but the ramifications are much greater for small and mid-sized organisations”, says Adam.
While two-thirds (67%) of participating companies reported that they have a formal risk assessment process in place, a third (33%) rated these as only partially effective or lower. A high proportion (24%) of companies reported being only partially effective, and a further 19% ineffective, in their use of IT to mitigate risk.
Nexia member firms appear less confident in the effectiveness of their clients’ risk management practices, with half of member firms believing that their clients are only partially effective in undertaking formal risk assessments.
Risk management training
The survey indicates growing recognition of the need for formal risk management training programmes aimed at promoting awareness about risk within companies. Yet over half (57%) of companies surveyed have yet to put a formal training programme in place, and of those that have, a third (33%) believe that their effectiveness could be improved significantly.
Nexia member firm respondents also appear less confident in the effectiveness of their clients’ formal risk management training, with 61% rating it as only partially effective.
Ownership and oversight
On a more positive note, survey respondents indicate high levels of senior oversight and ownership of the risk management process. Nearly three-quarters (74%) of companies surveyed rated the involvement of senior management executives in discussions regarding risk management as effective or very effective. Two-thirds (64%) have a designated senior executive as the owner of the process, with another 14% in the process of doing so.
“These survey results are encouraging,” says Adam. “They demonstrate the active involvement of boards and business owners in the risk management process, providing reasonable oversight and largely engaging in discussions with the individual responsible for the risk management process.”
Where clients have a risk management process owner, 30% said that the person’s role, responsibilities and authority were very well defined, while another 41% said that they were reasonably well defined. However, a quarter (25%) of Nexia firms said that only a “few” of their clients clearly define the risk management owner role.
It is reassuring that the risk tolerances of nearly two-thirds (62%) of companies are established by management and approved by the proper authority, although this leaves a substantial minority that do not follow this practice. Of those companies with a formal risk tolerance mechanism in place, 38% say that risk tolerances are only reviewed annually or less frequently.
“Risk tolerances should serve as an ongoing guide to business managers to perform at optimal levels, but in a controlled manner,” explains Adam. “Merely establishing and approving risk tolerances are insufficient safeguards – it’s equally important to review them on a continual or frequent basis.”