Understanding the processes and procedures of risk management is crucial. Training and awareness sessions should be scheduled regularly to develop competence in these area. Risk focal persons should be identified as change agents at all levels in the company because risk management is not the job of just one person; as many as possible have to be involved. Individually and collectively, the organisation’s personnel have to develop the ability to anticipate risks, know when and how to report issues of concern, and respond to situations appropriately. Additionally, they need to be aware of how all this aligns with the organisation’s goals and objectives.
Those identified as risk focal persons should be given more training as an effective way of embedding risk further in the firm, and spurring transformation at their respective levels. What needs to be developed is a risk mindset that sees risk as natural and manageable, she said. Risk matters but it should not be viewed as something completely negative. Taking responsibility and being proactive is the key to managing risk. “Risk is about uncertainty but we need to take charge,” she said. “Be the victor, not the victim.”
Together with an awareness of risk should come the alertness to the opportunities that may arise from it, which could benefit the organisation, as well as subsequent threats which could erode the firm’s value. This level of awareness can only come about if risk culture is internalised, when staff know how to anticipate risks and report issues of concern. Having the right strategy is not enough; organisations need the right culture as well which will enable it to respond to the dynamic environment in line with its risk appetite and corporate goals.
Following her presentation, Nurul was also one of the panellists of the forum discussion on Building a Healthy Risk Culture, together with Ahmad Azwang Aisram Omar, Head of Enterprise Risk Management, SME Bank Malaysia, and Zulhisham Zolkepli, Head of Risk Management, Insurans Islam TAIB Holdings. Among the issues discussed was what corporate-wide risk culture looked like; its key elements; how to get it to work effectively; and what to leverage on, to develop the right kind of culture in the organisation.
29 The IERP® Monthly Newsletter December 2021