What Are Barriers in Risk Management?

Enterprise risk management (ERM) can be a challenging endeavor, but it is also rewarding. While the benefits of effective ERM may not always directly impact the balance sheet, they enhance a company’s resilience against potential dangers.

Numerous barriers to effective ERM can exist within a corporate organization. To fully benefit from ERM, risk management teams must understand these barriers and the techniques to overcome them. This enables the company to pursue its business objectives with greater confidence, knowing that risks are being managed in a disciplined and rigorous way.

Common Barriers to Risk Management

The barriers to effective risk management processes are not insurmountable. Awareness is the first step to overcoming them.

Inadequate Communication

Communication among teams, departments, and organizations can be difficult or even non-existent in some businesses. This may result from competitiveness, poor relationships, or lack of coordination. Poor communication can prevent critical information from reaching those who need it for decision-making and effective risk management. For example, if personnel are unaware of specific risks, such as underground electrical lines at a construction site or a patient’s medication needs, things can go wrong.

Risk managers must also communicate the firm’s risk position to senior management and the board. If this information is not communicated well, decision-makers may make poor choices or develop an inaccurate perception of the firm’s risk position.

Poor Prioritization

A corporate culture that prioritizes business objectives over critical risks poses a significant challenge to risk management. If CROs underestimate the probability or magnitude of risk events, resources may be insufficient or misallocated within the ERM program. Proper prioritization of key risks is essential; otherwise, the ERM program may be marginalized, leaving the company vulnerable.

Inadequate Training and Supervision

Training provides employees with the skills needed for their jobs, while supervision offers direction, support, and correction. Both are important risk management and mitigation activities. Training helps prevent errors, and supervision ensures work is done correctly. However, both come with costs, and during difficult times, training budgets and middle-management positions may be cut. This increases the likelihood of errors and poor performance.

Failure to Use Appropriate Risk Metrics

Value at risk (VaR) is a popular risk metric, but it only indicates the most significant loss expected at a given confidence level. Its application does not guarantee successful risk management. The effectiveness of VaR also depends on market liquidity. For example, if a company holds an illiquid portfolio, daily VaR measures may not accurately reflect portfolio risk.

New Technologies

The pandemic accelerated the adoption of new technologies, revealing deficiencies in systems and processes, especially in areas like cybersecurity and third-party governance. As companies adapt, significant changes in risk management execution are expected, including improved data quality, increased automation, and more sophisticated use of technology and artificial intelligence.

How Can Businesses Avoid Barriers to Risk Management?

Organizations that work to achieve common risk assessment objectives and overcome barriers are more likely to thrive. Here are some best practices to overcome these barriers:

Organizational Risk Culture

A corporate culture that does not take risk seriously can paralyze the ERM program and organizational decision-making. A strong risk culture starts with the board and senior executives and extends to all employees. Vigilance is enhanced through diligent daily activities, enabling skilled resources to alert the company to imminent threats.

Good Technology

Reliable risk assessment software provides a competitive advantage by delivering critical information for better decision-making. Technical support from vendors ensures solutions are cost-effective and easy to implement, allowing businesses to focus on growth and compliance.

Effective Risk Approach

Risk assessments can seem daunting, leading some organizations to avoid them. Instead, companies should adopt a simple, consistent strategy to identify risks. Starting small and being consistent is better than doing nothing.

Achieve Regulatory Compliance

Overcoming obstacles to effective risk management involves viewing regulatory requirements as practices that contribute to business objectives. Adhering to compliance helps avoid financial penalties, reputational loss, and firm closures. Companies should integrate regulatory compliance into their ERM program to maximize the benefits of risk assessments and compliance requirements.

Implement an Enterprise Risk Management Framework

Frameworks such as those from the Committee of Sponsoring Organizations (COSO) and the International Organization for Standardization (ISO) help organizations overcome risk management hurdles. These frameworks focus on identifying opportunities and threats and allocating resources to address risks.

Implementing governance, risk management, and compliance (GRC) software can help track and automate risk management tasks. GRC software can map internal controls to various frameworks and regulatory standards, aiding in compliance monitoring and reporting.