The other day I came across an EY white paper called Turning Risk into Results that I first read a couple of years ago. What struck me is just how on the button the paper was, and we are certainly seeing many of the trends discussed reflected in our own customer base currently.


The paper is all about how leading companies use risk management to improve business performance. The original research was based on a global, quantitative survey (with 576 interviews and a review of over 2,750 analyst and company reports), that assessed the level of risk maturity and its relationship with financial performance.


It highlights some stark contrasts between the top performing companies (in terms of risk maturity) and those at the bottom. For example, companies in the top 20% of risk maturity generated three times the level of EBITDA as those in the bottom 20%. And interesting to us, one of the key findings is that effectively harnessing technology to support risk management is the greatest opportunity (or weakness) for most organizations.


The paper outlined where most organizations were looking to drive results. These were from three areas;


Risk Mitigation – the ability to identify and understand the risks that matter, and then do something about those that are deemed mission critical.


Cost Reduction – looking for ways to drive cost savings in every area, so a new risk operating model may improve cost structure.


Value Creation – how risk management can help drive business performance. Something which we are seeing increasingly.
The authors then go on to discuss how organizations are achieving results, with an emphasis on what the most successful companies do.
Enhance risk strategy – starts at the top with clarity around risk strategy and governance. Includes good two-way communications about risk, which is transparent and timely, and supports good decision making. A common risk framework has been adopted and implemented across the organization.
Embed risk management – it used to be the case that organizations were focused on mitigating risks and controlling costs, now increasingly they are looking to develop risk to enable the business. Typically planning and risk reporting cycles are coordinated so that risk information is incorporated within business plans.
Optimize risk management functions – this involves using consistent methods and practices, based on common information and technology used throughout the organization, eliminating duplication and lack of coverage.
Improve controls and processes – lines of business have key risk indicators (KRIs), controls have been optimized to improve effectiveness, and reporting tools standardized.


In summary, the paper comments that moving from being a risk averse to a risk ready company is a culture shift, which needs support from the top of the business. Organizations need to leverage technology as a catalyst for change to gain maximum benefit. Companies that have successfully negotiated the transformation of going beyond compliance to harnessing risk to add strategic business value, have succeeded in turning risk into results and creating competitive advantage.

It certainly makes interesting reading.
For a copy of the report go to:

Leave a Response