Strategic risk management

Another important component in a board’s strategic leadership role is the identification and oversight of risk and risk management.

This section introduces the concept of strategic risk. For a more detailed consideration, together with explicit tools, please refer to the recently released standard Guidelines for Risk Management in Sport and Recreation SNZ HB 8669:2004. This has been developed with Sport New Zealand input and is available through Sport New Zealand or directly from Standards New Zealand.

The Sport New Zealand risk management tool is available online.

Does the board have the right type of focus on risk?

Achieving a strategic direction doesn’t happen by chance. Even the clear expression

of strategic intentions doesn’t guarantee success. The board must have an effective system in place to help it identify potential barriers to success. A board should regularly review the main strategic and operational risks facing the organisation.

Often the principal focus of board-level risk analysis tends to be on the organisation’s financial position. Logically, however, this is a ‘cart before the horse’ approach as an organisation’s financial position is often a consequence of more fundamental performance-related issues.

What is risk?

Risks are uncertain future events that could impact on the organisation’s ability to achieve its objectives. Risk management is the process by which the board and chief executive ensure that the organisation deals with uncertainty to its best advantage.

Generally, a risk encompasses threats of losses and opportunities for gain. The challenge is to determine if the gains will outweigh the losses.

Although there is a natural tendency to think of risk as protecting the organisation from something ‘bad’, such as loss of reputation, a risk-averse board can damage an organisation just as easily as a board that’s too lenient or reckless.

Strategic risk management

Strategic risk management embraces both possible gains and losses from risk. It seeks to counter all losses, whether from accidents or poor judgement calls, and seize opportunities for gains through innovation and growth.

Effective strategic risk management is vital.

What a board expects in the future and how it prepares for it greatly affect the amount of risk confronting the organisation. Strategic risk management is about visualising futures and having a Plan B, C and even D in place to respond accordingly. A board prepared for a broad range of potential future outcomes faces less uncertainty and less risk.

There are at least four good reasons why a board needs to ensure its organisation takes a strategic approach to risk management and that it can handle risk effectively:

1. to counter losses;
2. to reduce uncertainty;
3. to take advantage of opportunities; and
4. to fulfil a worthwhile purpose.

Countering losses

Countering accidental losses typically involves reducing their probability, magnitude or unpredictability. Reducing accidental losses usually involves either avoiding or modifying the activities that may generate them in the first place.

Reducing uncertainty

Access to salient data can reduce uncertainty.

Reducing uncertainty removes doubts and makes boards and managers more confident in moving forward, and more optimistic in making needed changes. Good strategic risk management enables boards and managers to avoid the worst and capture the best.

Taking advantage of opportunities

Organisational success is often characterised by innovation and the ability to see possibilities others have overlooked. Strategic risk management helps identify opportunities while better positioning an organisation to seize them.

Clarifying the board’s responsibility for risk

Because of their public funding and profile, sports and recreation boards have a duty to observe the highest standards of corporate stewardship. A board must ensure the organisation has sound internal management systems and controls, delivering value for the resources entrusted to it. Because the board is ultimately accountable for organisational performance, it must be clear how much risk is acceptable in achieving its goals.

Among the various dimensions of the board’s risk management role is the need to:

• characterise risk, ensuring it knows the key risks facing the organisation and that it has a good understanding of their probability and potential impact; and
• set the tone and influence the risk management culture within the organisation.
• The challenge has been neatly summed up in the following group of questions:
• Is it a risk-taking or a risk-averse organisation? Which types of risk are acceptable and which are not? What are the board’s expectations of staff with respect to conduct and probity? Is there a clear policy that describes the desired risk culture, defines scope and responsibilities for managing risk, assesses resources and defines performance measures?

The board should also:

• participate in major decisions affecting the organisation’s risk profile or exposure, ensuring important questions such as “Should the risk be spread by working with another organisation or transferred through the use of funder/sponsor underwriting or insurance?” are addressed;
• monitor the management of significant risks to reduce the likelihood of unwelcome surprises by, for example, receiving regular reports from management focusing on key performance and risk indicators, supplemented by audit and other internal and external reports;
• satisfy itself that less significant risks are being actively managed, possibly by encouraging a wider adoption of risk management processes and techniques; and
• report annually to key stakeholders on the organisation’s approach to risk management, with a description of the key elements of its processes and procedures.
• The board’s expectations regarding risk management and the delegation of its authority to management should be formally documented in policy. This creates accountability and an explicit framework for performance monitoring.