Enterprise Risk Spring 2020 / Enterpriseriskmag .

Transcription

Enterprise RiskSpring 2020 / www.enterpriseriskmag.comThe official magazine of the Institute of Risk ManagementSecond front: IRM’s initiative for ex-service personnel / Face value: facial recognition technologies / Familyfortunes: IRM supports Indian family enterprises / Business conscience: the social role of risk managementFinding a safe haven: the world crisis in displaced people requiresstrong risk management, says UNHCR’s Hanne Raatikainen

ADVERT02Enterprise Risk

Enterprise RiskSpring 2020EditorArthur PiperProduced bySmith de WintCobden Place, 5 Cobden ChambersPelham Street, Nottingham, NG1 2EDTel: 44 (0)115 958 2024risk@sdw.co.ukwww.sdw.co.ukSponsorship andAdvertising Sales ManagerRedactive MediaIRMsales@redactive.co.ukTel: 44(0)20 7324 2753Enterprise Risk is the official publication ofthe Institute of Risk Management (IRM).EditorialProtecting displaced peopleThe world refugee crisis has never been more acute than atpresent. With the war in Syria reaching a more intense phase,all eyes are on those people fleeing conflict in the region.But that catastrophe is part of a bigger, slow-motiondisaster that has been playing out over the past decade orso. With a decline in multilateral collaboration, with an increase innationalism and protectionism, and with the spread of xenophobicrhetoric and fake news across the internet and social media, the picturelooks bleak for over 70 million people displaced from their homes.In response to these challenges, the United Nations has beefedup its risk management efforts at its refugee agency UNHCR.Its chief risk officer, Hanne Raatikainen, is not without hope, asshe explains in our cover feature “Finding a safe haven”.ISSN 2397-8848About the IRMThe IRM is the leading professionalbody for Enterprise Risk Management(ERM). We drive excellence in managingrisk to ensure organisations are ready forthe opportunities and threats of the future.We do this by providing internationallyrecognised qualifications and training,publishing research and guidance, andsetting professional standards.For over 30 years our qualifications havebeen the global choice of qualification forrisk professionals and their employers. Weare a not-for-profit body, with membersworking in all industries, in all risk disciplinesand in all sectors around the world.Institute of Risk Management2nd Floor, Sackville House, 143-149Fenchurch Street, London, EC3M 6BNTel: 44 (0)20 7709 9808Fax: 44 (0)20 7709 0716enquiries@theirm.orgwww.theirm.orgCopyright 2020 Institute of RiskManagement. All rights reserved.Reproduction without written permissionis strictly forbidden. The views of outsidecontributors are not necessarily the viewsof IRM, its editor or its staff.Sometimes good riskmanagement can save livesSince 2016, agreements between the world’s leaders have led to a moreholistic approach to such disasters that has risk management at its core. Thathas led to UNHCR working more closely with organisations such as the WorldBank than any time before. The central idea is UNHCR works from the outsetwith development agencies for a lasting solution to the immediate crisis.Risk management’s job is complex and difficult. Refugee projectsare located in remote areas. Mismanagement, fraud and corruptionand other potential problems must be detected early and dealtwith. UNHCR is dealing with these challenges by embedding a riskmanagement culture throughout its global staff of over 17,000 people.Sometimes good risk management can save lives. In somerespects, those serving in the military face similar problems –and although they do not generally refer to their work as riskmanagement, that is what it is. Peace keeping, helping with aid work,and managing logistics and people are their bread and butter.IRM’s recent decision to sign the Armed Forces Covenant paves the wayfor those coming out of the military to choose a career in risk management.Our feature “Second front” talks to some of those who have already takenthat route – and provides a direction for others considering such a move.Arthur PiperEditorSpring 202003

AdvertorialOperational resilienceHave risk functions detected the opportunities presented by operational resilience?BY GARY LYNAMOver the past ten years, consumer bankingbehaviours have significantly changed. Today, themajority of customers engage banks via digitalchannels. The change has pushed the resilienceof digital-led services under the microscope.During this transformational shift, multiple highprofile incidents have transpired, often linked to digitalservices, bringing scrutiny on the operational riskfunction. The media has ensured customer impact hasbeen front-page news while highlighting the bank’sstruggle to effectively manage recovery plans.risk function to demonstrate depth of existing knowledgegained from historical scenario analysis and oversight ofincident management. We must also consider and preparefor some of the key challenges when implementing:Access denied(!): Detailing process flows in any firm,especially large and complex firms, is difficult. Validatingprocess design can require multiple iterations; this exercisemay be frustrated by components of the process whichare not under direct control (i.e. cloud data services).The new approach requiresa shift in mindsetShifting the organisational mindsetThe well-worn cliché “prevention is better than cure” is astrue now as ever. Focusing on understanding the root causeof a risk and maximising preventive and early detectivecontrols is critical. This has quite rightly remained afocus of good risk management. However, even good riskmanagement can only achieve reasonable assurance thatmajor incidents can be avoided; there is no guarantee.The new approach requires a shift in organisationalmindset. Firms need to start from a position of “assumingfailure” and demonstrate how quickly recovery plans canbe executed for critical services under extreme stressincluding defining impact tolerances for such events.Adding vigour to existing risk processes?While risk appetite focuses management attention onmanaging the likelihood of operational risks occurring, impacttolerances seek to increase management focus on operationalresilience before operational risks have crystallised.An opportunity may exist for risk functions to introduceimpact tolerances to the traditional risk-evaluationmatrix. This integration could also enhance the RiskControl Self-Assessment (RCSA) process, which is underpressure to be more efficient and informative. Linking thetwo methodologies could drive board engagement andassist the risk function’s engagement with the business.Navigating the critical pathVisualisation is essential: Boards and seniormanagement will require an integrated view of resilienceoutputs (i.e. tolerances). Dashboards should be able toconnect impacttolerance andscenarios to the riskappetite statement andother risk components,such as KRIs.Beware of bias:The FinancialConduct Authority(FCA) has saidthat firms may be guilty of “ostrich bias”, ignoringdangerous or negative information associated withincidents. Firms must be prepared to challenge thevarious biases which scenario setting can contain.We live in a world of increasing uncertainty on a globalscale, whether from extreme weather events, globalpandemics or a targeted cyberattack. Due to globalisation andchange in customer behaviours, the impact from these eventson organisations is ever increasing. Operational resilienceis therefore becoming a key component of enterpriserisk management, the “cure” when prevention fails.Gary Lynam is director of risk advisory Protecht Group,UK and Europe. www.protechtgroup.comEffectively delivering resilience outcomes will requireskilled collaboration. This presents an opportunity for the04Enterprise Risk

ContentsSpring 202010FEATURES10 Finding a safe havenDealing with the world’scrisis in displaced people involvesstrong risk management, says HanneRaatikainen, chief risk officer atthe UN Refugee Agency UNHCR16 Second front16REGULARS0720 Face valueFacial recognition technologiespresent both technical and moral issuesfor the organisations that use themIRM ViewpointIRM has been through a periodof rapid growth and change over thelast few years. Incoming chairman IainWright explains his aspirations for thefuture of the profession24 Family fortunes08 Trending20The stories and news affectingthe wider business environment asinterpreted by our infographics team34Family businesses andsmall companies are poweringthe Indian economy. An initiativeby IRM aims to help them get abetter grip on risk managementwith30 BusinessconscienceIRM FocusRisk professionals have a keyrole to play in supporting themodern organisation takeits share of responsibility formanaging risks to societyA range of recent andforthcoming projects by IRM and itspartners are helping risk managerstackle the pressing issues of today,says Carolyn Williams35 Directory24In need of insurance services,risk management software andsolutions, or training? Look nofurther than our listings38 TofflerWhile artificial intelligencecompanies are ploughing millionsinto reading facial emotions, somepsychologists remain scepticalSpring 2020It may not be called riskmanagement on the ground, butfor military personnel, managingdifficult situations is a dailyreality. IRM’s decision to sign theArmed Forces Covenant aims tohelp more ex-service personnelto thrive in the risk profession0530

EWNSupply Chain RiskManagement CertificateIdentify, analyse & prevent.About the Supply Chain Risk Management Certificate (SCRM)This qualification introduces the concepts of SCRM and equips risk practitioners with theability to apply their risk management knowledge in a world where value is increasinglyadded via a supply chain. It explains how globalised outsourcing, specialisation andjust-in-time production are changing the risk environments for many organisations.It looks at how appropriate risk management tools and techniques can be applied,adapted and developed in an increasing digital context. The qualification also provides abroad understanding of SCRM principles and practices. The relevance of the qualificationis explained in the context of increasingly extended organisations facing an expandedrange of complex interconnected risks.ADVERTWhat our experts sayRobert J Trent PhDProfessor of Supply Chain Management, Lehigh University“Far too many companies gain an appreciation of supply chain risk only after sufferingdirectly the adverse effects of risk. This certificate provides people with the knowledge,concepts, and tools to enable them to become a valuable part of their organisation’sefforts to survive and prosper in an ever changing world.”Nick WildgooseIndependent Supply Chain Risk Consultant“There are supply chain disruption and reputational incidents happening every day,that could have been better managed to drive value. This new qualification will helplearners develop a clear understanding of supply chain risks, and the tools andtechnology which can help organisations stay protected.”In collaboration withFind out more at:www.theirm.org/scrm-mag06Enterprise Risk

IRM ViewpointOPINIONBuilding on strengthIRM has been through a period of rapid growth and change over the last few years.Incoming chairman Iain Wright explains his aspirations for the future of the professionAs this is my inaugural column for IRMas chair I’d like to thank outgoing chairSocrates Coudounaris for his unerring workin this post over the last couple of years.I am in the fortunate position ofbeing able to build on the good work done by thechief executive officer, staff and the immediatelypreceding chairs in stabilising the Institute’s financialposition, building a strong board and starting thenext phase of our growth. We are now in a positionwhere we can capitalise on that financial strengthto drive towards fulfilling the Institute’s vision.Here are my four priorities:In addition to the leading qualifications inEnterprise Risk Management in the insurance sector,the IRM International Certificates, we also havelaunched our new Supply Chain Risk ManagementCertificate; this has been developed with theSupply Chain Risk Management Consortium.IRM is at an exciting timein its history, where wecan look forward andreally make our mark1. A focus on the heart of the Institute –in particular, qualifications, training andthought leadership, really fulfilling our roleas the pre-eminent global risk management body.2. Integration of the Institute of OperationalRisk, which joined the IRM group in 2019.3. Having received members’ approval to change theArticles at the 2018 AGM, exploring whether nowis the right time to move to a “professional” chair.4. Leading the board in exploring whether it is rightto move to charitable status for IRM, which wouldnaturally involve approval from the membership.IRM is at an exciting time in its history, wherewe can look forward and really make our mark.We will be increasing the diversity and content of ourproduct portfolio, in both qualifications and training.I am particularly keen to see the Institute continue tooperate in global markets and expand internationally.I aim to lead the board with vigour and commitmentthrough this next stage. During Socrates’ term wehave gone from strength-to-strength, and I’m lookingforward to continuing his good work and playing a keypart in professionalising risk management globally.Spring 2020This qualification introduces the concepts of supplychain risk management and equips risk practitioners withthe ability to apply their risk management knowledge in aworld where value is increasingly added via a supply chain.It explains how globalised outsourcing, specialisationand just-in-time production are changing the riskenvironments for many organisations. It looks at howappropriate risk management tools and techniques canbe applied, adapted and developed in an increasing digitalcontext. The qualification provides a broad understandingof supply chain risk management principles and practices– a valuable asset in any risk manager’s toolkit.IRM is also continuing to lead debate about riskglobally. Carolyn Williams, our director of corporaterelations, has written another article in this issue aboutour most recent publications and events and about ourongoing projects with our partners around the globe.I am looking forward to working with ourteam and members to further professionaliserisk management during my tenure.Iain Wright isIRM chairman.07

TrendingDATAThe latest stories and news affecting the wider businessenvironment as interpreted by our infographics teamBritish chief executives top gloom registerBusiness confidence drops in 2020, especially in the UKDo you believe global economic growth will improve, staythe same or decline over the next twelve months?GlobalImproveWestern EuropeStay the sameDeclineUnited Kingdom0%20%40%60%80%100%Source: 23rd annual global CEO survey, PWCCyber threat edges into lead position among risk managersTop risks by ranking among risk managers in 202039%37%27%21%21%CyberincidentsBusiness interruption,including supply chainsChanges in legislationand rce: Allianz Risk Barometer 202008Enterprise Risk

Infrastructure investorsfret over regulatory riskWorld EconomicForum shortterm risksRegarding the performance of yourinfrastructure investments, whichfactor concerns you the most?Percentage of respondentswho think a risk willincrease in 2020Regulatory risksFrothy marketPolitical cpoliticalpolarization77.1%Extremeheat waves76.2%Destructionof ructureRising interest ratesOther0%10%20%30%40%Source: Infrastructure investor, Perspectives 2020UK employment rate at record highThe UK employment rate wasestimated at a record high76.5%Estimated vacanciesin the UK for November2019 to January 2020810,000Source: Labour market overview, UK: February 2020, Office for National StatisticsSpring 202009Source: The Global Risks Report2020, World Economic Forum

InterviewPRACTICEFinding asafe havenDealing with the world’s crisis in displacedpeople involves strong risk management,says Hanne Raatikainen, chief risk officerat the UN Refugee Agency UNHCRBY ARTHUR PIPERThere are 70.8 million people on the planet whohave been forcibly displaced, more than at anytime since the Second World War. That includesaround 41.3 million who have left their homesbut not their countries, just under 26 millionrefugees and 3.5 million asylum seekers, according to theUN Refugee Agency UNHCR. Over half of all refugees (57 percent) have fled just three countries – Afghanistan, SouthSudan and Syria – and 85 per cent of refugees globallywho make it out of danger are hosted in low- or middleincome regions in the developing world. Turkey, Pakistan,Uganda, Sudan and Germany are the top destinations.Since 2017, when UNHCR set out its five-year strategicvision to help tackle this growing phenomenon, the globalenvironment for displaced people has worsened both inscale and complexity, says Hanne Raatikainen, chief riskofficer at the agency. It can be difficult for the refugeehosting countries to cope with the sheer volume of peopleseeking shelter – Turkey, for example, is currently hometo an estimated 3.7 million people fleeing war in Syriaand elsewhere. In Africa’s Sahel region, the situationis rapidly worsening. In Burkina Faso, for example,attacks by militants have been forcing a daily average ofmore than 4,000 people to flee their homes and searchfor safety since January this year. So far, some 765,000people have already been displaced in the country.“The whole environment is just so challenging,” she10UNHCR’s highcommissioner,Filippo Grandi, hasbeen calling forrenewed effortsto reinvigoratemultilateralismEnterprise Risk

Where countries havea commitment toallowing refugeesto work, for instance,or allowing refugeechildren to take partin the national schoolingsystem, there is progressImage credit: UNHCR/Susan Hoppersays. “We try to remain presentin these very difficult, high-risklocations, and sometimes we arein situations where you don’t reallyhave solutions in sight. However,we always try to help, even in themost challenging circumstances.”Multilateral crisisThis increase in need has beencompounded by challenges to theglobal multilateral system. That iswhy the UNHCR’s high commissioner,Filippo Grandi, has been callingfor renewed efforts to reinvigoratemultilateralism to both curb thenumber and nature of conflicts andto help people return home safely.The rise of nationalism in Europeand elsewhere has not helped,charging the language of politics,which he said, had “become ruthless,giving licence to discrimination,racism and xenophobia”.Some member states havebecome more reluctant to take in andSpring 2020support refugees in this climate. ButGrandi has been a strong advocateof risk management (more aboutwhich later), not just to better dealwith crises and protect its 17,000members of personnel working inover 130 countries, but to ensurethat the agency seeks out andmaximises opportunities for theforcibly displaced, wherever possible.AgreementsThat has meant working to buildinternational co-operation andsupport for refugees and migrantsthrough a new series of globalarrangements. In 2016, the ballstarted rolling with a declaration bystates to renew their commitmentand solidarity with displacedpeople, including a reaffirmationof obligations to respect therights of refugees and to pledgefinancial support. Out of thisso-called New York Declarationcame the Comprehensive Refugee11Response Framework (CRRF),which is being implemented nowand is changing the way UNHCRoperates – placing more emphasison partnerships with others.A further milestone was achievedin December 2018, when the UnitedNations General Assembly affirmedthe Global Compact on Refugees thatbuilds upon the CRRF and presentsa framework for more predictableand equitable responsibility-sharing,recognising that a sustainablesolution to refugee situations cannotbe achieved without international cooperation. A year later, the first-everGlobal Refugee Forum took place inGeneva, drawing 3,000 participantsfrom across the world to pledgesupport to the millions of refugeesuprooted by wars and persecutionand the communities that host them.“It’s a new challenge for usbecause it means working in avery different way, not just amonghumanitarian actors but by engagingmore development actors to shareresponsibilities and burdens,”Raatikainen says. As well as cooperating with actors such as theWorld Bank, civil society andthe private sector, each initiativenow aims to tackle what usedto be called the humanitariandevelopment gap. In the past, whenthe initial emergency was over,aid agencies struggled to sustain aresponse as humanitarian fundingdeclined, while host countries andcommunities struggled to addressdevelopment challenges that hadoften deepened as a result of therefugee presence. Now, the aim isfor the various actors to move in atthe same time and start buildingfor success from the beginning.That has also entailed trying to

empower refugees by increasingtheir self-reliance and autonomy and,above all, finding what Raatikainencalls “durable solutions”. Thoseinclude local integration whererefugees are unable to returnhome, voluntary repatriation whenthe conditions improve in theirhomelands, and resettlement wherevulnerable refugees are transferredfrom a state where they havesought protection to third countries.Resettlement has, however, becomeincreasingly challenging due to thelimited number of places availablecompared to the number of those inneed of resettlement. With some 900pledges in the current framework,Raatikainen is pragmatic.“There is an element of learningand seeing what good practice onrefugee issues we can transferfrom one country to another,” shesays. “The most important pledges,in my view, are those that have acommitment to allowing refugeesto work, for instance, or allowingthem to move on in life, or allowingrefugee children to take part inthe national schooling systems.”Difficult workingenvironmentsBut the recent pledges that havecome out of the New York initiativeand its unfolding development areonly as effective as the situation onthe ground allows. While there maybe political will within a country’sgovernment, in reality they mayhave little control in some areas oftheir territory. In practice, it canmean that UNHCR staff have tooperate under increasingly difficultworking environments and facethreats for both the persons ofconcern that they are aiming toprotect as well as for themselves.In some cases, internationalagency workers have had to leavea country and work remotely.As well as working with differenttypes of agency, donors arebecoming more demanding abouthow transparent and accountableUNHCR’s operations are. News andmisinformation travel fast on socialmedia, which means the agencymust be able to respond in a timelyand effective manner when risksmaterialise. Many projects takeplace in remote areas, often withAbove: Zambia. Raatikainen with Towa Chaiwila, associate protection officer from UNHCR’sField Office in Solwesi, visiting refugees with special needs in the Meheba refugee settlementpoor transport infrastructure, orin war zones, and this increasesthe risk of fraud or malpractice.Donors are aware and keep a closeeye, which is understandable. Theagency needs to adjust to this newadditional dimension that was notso prevalent five or ten years ago.“This is why we strive to furtherstrengthen accountability andgood management practices,”says Raatikainen. “Efforts are alsotaken to continuously improve theway in which the organisation isresponding to identified risks – andhere technology and innovationplay an important role,” she adds.Risk Management 2.0Raatikainen joined UNHCR as chiefrisk officer (CRO) in 2018, partly tohelp implement the Risk Management2.0 initiative that the agency hadlaunched in late 2017. The CRO rolehad been created in 2014 as partof a unit of two risk professionals,and it was still only a three-person12operation when she joined. Whenshe took up her role, she found thatUNHCR had a solid foundation inplace: risk policy had been approved,and a risk framework and a riskmanagement tool developed; therewere risk management processesthat people had started to follow, ane-learning programme in place andsome face-to-face training for staff.But Risk Management 2.0 wasabout creating a culture of riskthroughout the organisation. Theinitiative’s architect, Grandi, saidhe wanted the department toexpand in order to focus more onintegrity-related risks, includingfraud and corruption, potentialrisks for diversion of aid and riskslinked to potential misconduct. Theultimate aim was to enhance theprogramme delivery of UNHCR.Some people said that riskmanagement was already doing agood-enough job, but Raatikainenagreed that it could do better. “Whenwe are in these often emergencysituations, dealing with massiveEnterprise Risk

The risk departmentunder Raatikainenhas been througha rapid period ofinvestment, growthand restructuringImage credit: UNHCRinflux of refugees for instance,we are focused on the day-to-dayactivities and do not always take thetime to take a good look at what’shappening out of that context,”she says, “to understand what ourrisks are and to build all that intothe culture of the organisation.”The risk department underRaatikainen has been through a rapidperiod of investment, growth andrestructuring. There are now ninerisk experts at UHNCR’s head office– two of whom are designated rovingrisk advisers. That means they spendmost of their time in the field, whereabout 90 per cent of the agency’s staffwork. She has also been helping tobuild risk management capacity intothe first line of defence in operationsfacing the highest levels of risk, suchas Libya, Afghanistan, Sudan andKenya operations. That has led to therecruitment and deployment of 11 riskadvisers in country operations whosejob it is to bring risk management tothe core of the project. They do thisby working with senior managersin the operation who are not riskexperts but have a risk focus.“The risk advisers in countryoperations have a core role inawareness raising, training, helpingwith the risk analysis and workingwith country representatives whoare the risk owners, and accountablefor putting in place measures toBelow: Jordan. Raatikainen with Stephen Gibson, a UNHCR senior risk managementand compliance advisor based in Greece, in conversation with a Syrian refugee whois working in a community centre run by refugee women in the Zaatari campImage credit: UNHCR/Shawkat HarfoshSpring 202013treat the risks,” she says. “They arethere to support and bring peopletogether.” That entails bringing goodpractice into the country to addresskey risks, helping with root-causeanalysis, identifying controls andsystematically helping to integratethem into the operation. “In a fewyears’ time, they should be workingthemselves out of the job,” she says.It is not without challenges – not leastbecause they are due to rotate everytwo years if they are based in dutystations such as South Sudan. Butthey are supported by seven regionalsenior risk advisers based in UNHCR’sRegional Bureaux, acting as a secondline of defence to both give supportand provide some continuity. Finally,in addition to in-situ and regionalrisk advisers, the organisation alsohas about 200 risk focal points – atleast one in each country operationand headquarters’ division – whodeal with risk management inaddition to their core responsibilities.They have all been trained byRaatikainen’s team. This structureforms UNHCR’s risk network.Risk networkSince the network is meant topromote a much stronger culture ofrisk across the agency, Raatikainenhas focused on an enterprise riskmanagement (ERM) approach. Thathas meant bringing in people fromall functions in the organisation toshare experiences, brainstorm onrisk and come up with solutions.“Everywhere I go, I talk about the ERMapproach,” she says. “There has tobe really a strong risk managementculture in all of our operational andmanagement areas, in every singlelocation. The greatest challengefor us is indeed that we are so bigand we are so decentralised.”Raatikainen has first-handexperience of what that means fromher missions to the field. “Duringdiscussions on the prevention ofsexual exploitation, abuse, corruption,what’s right and wrong, you have tounderline that what happens here inyour field office could actually havean impact on the whole organisation,”she says. “That realisation requiresa lot of walking and talking,but I still find risk managementan easy sell when people startunderstanding it and when they

Image credit: UNHCR/Roger ArnoldThere has tobe really a strongrisk managementculture in all of ouroperational andmanagementareas, in everysingle locationstart engaging in discussions abouttheir own risks and opportunities,and what they can do about them.Dialogue is important, and ourrisk network is crucial in ensuringthat this dialogue takes place”.Above: Bangladesh. Rohingya refugees prepare for the monsoon by buildingnew reinforced shelters with materials supplied by UNHCRToolsThe organisation uses a softwaretool to record its risk informationand to share it across the agency. Themandatory annual risk assessment islinked to the organisation’s planningcycle, and Raatikainen is trying tobuild momentum across the agencyfor people to review their risks onan ongoing basis. This is the secondyear her team jointly with operationalcolleagues has reviewed all of therisk registers in the organisationand, through dialogue between thedifferent parts of the organisation,she believes that UNHCR now hasa more robust reporting frameworkthat people are able to use to improvetheir decision-making and controls.The Risk Management 2.0initiative is due to end this year.An ind

Finding a safe haven: the world crisis in displaced people requires strong risk management, says UNHCR’s Hanne Raatikainen Enterprise Risk Spring 2020 / www.enterpriseriskmag.com The official magazine of the Institute of Risk Management Second front: IRM’s initiative for ex-service personnel /