AIRMIC and Cass Business School - Study of Major Risk Events

I blogged last week about a number of references at the AIRMIC 2011 conference regarding some research conducted by the Cass Business School. A sneak preview of this substantial piece of research on the origins, impact and implications of major risk events is available here (you may need to do a quick registration).

This is an excellet idea in principle, with a very astute summary in this document, so I cannot wait for the full research to come out in July. My take on this summary document was;

• 18 companies who experience "high profile corporate crises", but thankfully they have selected a range of crises, not just straight-up financial implosions (much better for reverse stress testing purposes)
• Talk of "severe, uninsurable" losses as the effect of the crises, which again will make for good reverse stress testing
• The seven "underlying" risks that they identify as being present across industries all seem fair, some more than others.
• That the risk profession is identified as being unable, through lack of experience, remit or courage, to intervene in the materialisation and occurrence of these 7 types of risk is a bold statement (bearing in mind who commissioned the research!) is also fair to varying degrees. It is not so much that the profession is not cognisant of them, more that one is generally not in a room full of strategists as an equal.
• Strong comment that many of the 7 underlying risks are "taboo", as tabling them as a risk professional is tantamount to questioning a director's professional competence.
• "Risk of self-deception" by not receiving this challenge from either an INED or a CRO-type
• Strange comment that Risk and Internal Audit would not be comfortable questioning strategy and leadership risks without further training/experience - personally, if it is in my remit, it gets done.
• Followed by a more conventional flag that questioning leadership can put careers at risk (true for Risk professionals, but not for internal audit surely.

Concluding points were;

1. Rethink risk analysis techniques to cover non-routine risk
2. Extend skills of profession to be able to analyse risk emerging from ethos/culture/strategy/behaviour
3. Change role and status of Risk to ensure open discussion at all levels, including board
4. Boards need to recognise importance of non-routine risks

Unsackable CRO and robust reverse stress testing should do most of that...