ERM: From Compliance Function to Strategic Driver

Authored by: Perushka Kalipershad, Senior Manager: Governance, Risk and Compliance at the Multichoice Group, MBA, GRC professional

The current business environment is complex, dynamic and continuously evolving. We have witnessed a global pandemic, mass rioting, severe weather changes and cyberattacks as some of the more recent high-impact risks in South Africa. We are in a state of “deep uncertainty” in which businesses are unaware of what it is that they do not know. We thus need to focus not only on developing strategic flexibility to deal with these uncertainties but also on adopting a forward-looking perspective that will promote the continuous exploration of new strategies in response to threats and opportunities.

It is widely accepted that enterprise risk management (ERM) plays a key role in ensuring that the strategic goals of an organisation are achieved through the comprehensive assessment and mitigation of key risks. ERM also aids in the successful implementation of business opportunities. ERM is therefore inherently positioned to positively enhance strategic flexibility. There are, however, mixed views regarding ERM – many still view it as a compliance function and opt to apply only the minimum requirements to meet corporate governance requirements.

Although ERM should be positioned as a key strategic resource, the required integration between ERM and strategic planning is not common practice. Current risk management practices are often limited to the strategic execution phase, with limited involvement in strategic planning. In addition, the theoretical side of ERM has exploded into a number of processes that can skew the very objective of ERM when greater effort is made to embed these processes in the organisation. Various stakeholders drive the direction of risk management, each with their own authoritative pull, which results in the possible counterproductivity of limited ERM resources. These are some possible reasons why ERM is not effectively contributing to informed decision-making and, as a result, not enhancing the organisation’s strategic flexibility.

The point to be made here is that much more effort is required from organisations to position ERM correctly and allow this strategic flexibility to be driven from within the organisation, through the already established ERM function. Equally, ERM professionals need to demonstrate their ability to positively contribute towards building the organisation’s strategic flexibility. A shift is required wherein risk professionals begin to focus on the provision of strategic advice and assume forward-looking practices.

Risk management practices then also need to be promoted to the strategy formulation and planning phases. ERM professionals need greater autonomy in the execution of their roles and should take the lead in directing the future of organisations or stand to lose credibility in terms of their value offering during these crucial times.