Jessica Chew Cheng Lian: Integrated risk management approach for
maintaining resilience & sustainability
Speech by Ms Jessica Chew Cheng Lian, Assistant Governor of the Central Bank of
Malaysia (Bank Negara Malaysia), at the Business Continuity Management Conference
"Integrated Risk Management Approach for Maintaining Resilience & Sustainability", Kuala
Lumpur, 15 September 2015.
* * *
I would like to thank the Disaster Recovery Institute, Malaysia and Sterling Risk Solutions for
the invitation to speak at this Business Continuity Management (BCM) conference. Today,
the ability of corporations to effectively manage risks has become a key factor that
determines the agility and resilience of businesses. Business imperatives are changing so
dramatically that risk management has become a more significant part of most organisations
out of sheer necessity - largely driven by regulation, the desire to avoid costly sanctions, or
to respond to increasing environmental and political risks. In leading organisations, the
successful integration of risk management with strategic and commercial decision-making is
creating important competitive advantages that are likely to be sustained over the longer
term. This distinct organisational strength is one that cannot be easily replicated for the
simple reason that building and maintaining a complete organisational response to strategic
risk management, unlike say introducing a new product or marketing strategy, is not
something that is accomplished within a short period of time.
This morning, I would like to talk about some of the changes we are seeing in the practice of
risk management and reflect on important priorities for risk management as observed from
our work at Bank Negara Malaysia with the financial industry. I will then offer some brief
perspectives on business continuity management and close with some final thoughts on the
prospects for the insurance industry in Malaysia to contribute towards the advancement of
risk management capabilities across Malaysian businesses.
Changing practices in risk management
Since the financial crisis, risk management practices have come under intense scrutiny. The
spectacular failures in risk management in the lead up to the crisis prompted deep reflections
on what had gone wrong with risk management systems and practices - not least of all
among companies that had invested heavily in sophisticated risk measurement and
management systems only to have them ultimately fail to detect or control risk exposures.
Closer to home, businesses in Malaysia are currently facing a set of challenging business
conditions and some are likely to find themselves ill-prepared to respond to the challenges,
with important implications for their future prospects.
So what can we learn about the changing practice of risk management from these
experiences? A first observation to my mind concerns the importance of building a strong risk
culture supported by governance arrangements that are explicitly aligned to a firm's risk
appetite. It is striking that, in the last five years, global standard setting bodies such as the
Basel Committee on Banking Supervision have moved to address risk culture, risk appetite
setting and risk governance more explicitly in regulatory standards. This was not the case
prior to the crisis, when emphasis was predominantly placed on risk management processes
and systems, believing that this ought to be sufficient. Organisations largely failed to take into
account behavioural biases that play such an important role in senior management decisions
which ultimately affect the risks that a company will be willing to take or tolerate. These
decisions include how performance targets are set for staff, how incentive structures are
designed, and the stature and resources that are provided to risk management functions
within the organisation - all of which can create a constant uphill struggle for risk managers
to have any meaningful impact on risk outcomes. To illustrate the point, a report published by
the Office of Financial Research in the United States observed that much of the
advancements in risk management over the last decade have resulted in a highly
analyticalfocused discipline, while largely ignoring the fundamental drivers of risk-taking that are
rooted in more subtle behavioural characteristics.
Within the financial industry, financial institutions in Malaysia are required to establish a
wellresourced independent risk management function that reports directly to a board risk
committee, and take active measures to promote a prudent risk culture in the organisation.
This includes properly designed incentive structures that must reflect risk outcomes.
Financial institutions are also required to regularly review their risk management
methodologies and processes to account for the changing business environment. This aims
to ensure that risk management does not become something one does to check off a box on
a list and then forgets about.
A second notable observation has been the broader focus of risk management. While
financial risks remain a key focus of risk management practices, risks from reputational,
human capital and environmental concerns can have equally significant repercussions for a
firm's business. Recovering from reputational damage is a hugely expensive endeavour,
takes a long time, and success is often not assured. We have observed in our own work that
where institutions take a broader view of risk management in these areas, conversations
around the role of risk management at the senior management and board levels are more
likely to shift beyond avoiding losses, to enhancing strategic opportunities for improving the
institution's competitive position. This itself can have a mutually reinforcing effect of directing
more resources towards risk management and creating better synergies between business
and risk functions.
While more firms are acknowledging the importance of reputational, human capital and
environmental risks, actions however have generally not measured up. Many companies still
have weak succession plans in place and remain vulnerable to key-man risks. Few
companies have robust risk management frameworks that incorporate measures of how their
products and services affect the well-being of consumers or if consumers are being treated
fairly, as long as legal exposures are contained. And efforts to adopt triple bottom line
approaches to reporting firm performance are only beginning to gain traction. Within Asia,
fewer than 10 banking institutions today subscribe to the Equator Principles for assessing
and managing the environmental and social risks for projects.
Clearly the gap between the existing risk management practices and a whole-of-business
approach which fully embraces broader aspects of risks remains large. Regulation and
greater shareholder activism will remain important drivers of change, and in my view, so will
a new breed of risk managers who effectively integrate traditional and emerging risk
perspectives, and who can speak to these perspectives in a compelling and cohesive way to
an organisation's key stakeholders.
A third observation that I want to make today relates to the increasing importance of viewing
risks over a longer-term horizon, and imagining the unthinkable. I mention these together for
a reason. When one is focused on looking both backward and forward over a reasonably
long horizon, the universe of what is unthinkable becomes smaller and our vision is less
likely to be blinkered by limited experiences of only the most recent past. We are also likely
to become more open to broader possibilities of new and emerging risks on the horizon. In
the world of creative arts, it is often said that we are limited only by our imagination. I think
the same can be said of risk management. If we can stretch our imaginations a little further,
then there is a higher chance that risk management will be more proactive in anticipating
future problems, especially problems that we may have never encountered before. This
requires risk managers to go beyond estimating the probability of risk events occurring, and
allowing a greater role for uncertainties, no matter how remote, to feature more prominently
in risk management approaches. While easier said than done, innovations like reverse stress
testing and the increasing degree of internal and external collaboration that goes into
constructing stress testing scenarios are positive indications of how firms are responding to
this challenge. On this score at least, risk management is increasingly proving to be more of
an art than an exact science.
Organisations also continue to face significant challenges in efforts to break down risk silos
and achieve an integrated view of organisational risks that adequately takes into account
operational dependencies and common exposures that can significantly amplify risk
outcomes. A key challenge often overlooked is the failure to effectively integrate human
resource management strategies with enterprise-wide risk management goals. This can
create significant inertia, with organisations often falling back to managing risks in silos as
the default position. Successful organisations have recognised that silos are fundamentally a
cultural phenomenon. If we can build and nurture people within an organisation to be always
attuned to risks that may affect the organisation, whatever their nature or origins, then there
is a good chance that any system, process and framework constraints will be more easily
overcome and less likely to inflict major losses on the organisation. When faced with
challenging business and financial conditions and a highly dynamic environment, it is always
more important to have excellent people than excellent models.
BCM as part of enterprise risk management
This brings me to the more specific area of business continuity management, or BCM. A
paper published in 2008 by the Chartered Management Institute of the United Kingdom
found that 76 percent of the survey respondents reported that business continuity
management is seen as important in their organisations but only less than half revealed that
they have specific business continuity plans. There are several reasons for this which I will
not get into here, but a major one is the lack of metrics to measure success in the absence of
a major institutional crisis. One commentator put it this way - the return on investment is
simply that business stays open.
Two contrasting examples of BCM help to underscore this point. Investigations by the
Japanese Government into the Fukushima tsunami disaster revealed material inadequacies
in the handling of complex risks associated with managing a nuclear power plant. This was
demonstrated in poorly executed emergency procedures in evacuating residents during the
incident. Consequently, the operations of the power plant were suspended. In contrast,
during the 9/11 attacks on the World Trade Centre, a sustained commitment by a large
multinational financial service provider to strengthen its BCM and continuously improve its
evacuation procedures over almost a decade, enabled it to reduce the time taken to
evacuate its employees from four hours to 45 minutes, saving thousands of lives.
Within the financial sector, a key focus of reforms since the global financial crisis has been
on the development of recovery plans which aim to protect the continuity of critical functions
and core business lines in a situation of financial stress. Work has also been initiated to
implement this in Malaysia. Financial institutions are expected to develop a menu of options
for recovering from events of severe stress in order to restore business to a stable condition.
These plans must be regularly updated to reflect changes in a firm's business model and
operational arrangements. At its most basic level, recovery plans are helping financial
institutions to better understand their operational and financial interdependencies and how
this can affect recovery options that are available to the institution. Some institutions are
finding through this process that their operations have become far too complex to support
credible recovery strategies. These institutions are taking or considering steps to restructure
parts of the business to achieve wider options for recovery. Indeed, an important
development emerging in the recent period has been the more explicit consideration of
implications for recovery plans in key strategic decisions, such as decisions to hub
operations at a particular location or service provider.
As much as organisational resources are put into enhancements of business continuity
management, it is important for businesses to always keep in mind the inherent limitations of
business continuity plans and not be lulled into a false sense of confidence that these plans
may provide. Scenarios featured in these plans are often based on assumptions, which are a
simplification of reality at best. Such scenarios should always be rigorously challenged to
account for changing conditions. Business recovery or resumption actions should also
contemplate a range of conditions to build agility within the organisation to execute required,
but potentially untested, responses. Firms should expect that they will rarely get to a point of
precision in their scenario planning and BCM responses. This does not mean that BCM is
necessarily reduced to an exercise in futility. A commitment to continuous improvements in
BCM is almost certainly likely to prepare firms better for disasters and tail risk events even if
those specific events were not exactly contemplated. This is because the organisation will be
naturally better at coming together in a crisis, and would be able to leverage on some of the
core elements of response plans that have already been developed and tested.
The world today is encountering more extreme disasters such as epidemics and
unpredictable weather-related calamities. In our own country, the worst flood disaster
experienced in decades last year saw over 250 thousand people displaced with estimated
costs of more than two billion ringgit to repair damaged infrastructure. This presents a sober
reminder of the responsibility of all corporations to ensure that they are well prepared for and
remain resilient against calamities, not just for their own survival, but in the interest of
employees and the community that depend on them.
Role and prospects of the insurance industry in advancing risk management
The cost associated with negative tail-risk events will only escalate as business networks
grow in complexity. The use of insurance continues to be an important way in which
companies can reduce this cost by transferring risks to insurance providers. Insurers are
well-placed to assume such risks given their long standing history in risk analytics which
enables them to effectively exploit the law of large numbers and benefit from risk pooling.
Among emerging economies, however, there is still a sizeable protection gap in spite of the
increased frequency and severity of weather related disasters and other natural
catastrophes. In 2014, insured losses in Asia only covered about 10 percent of total losses
incurred as a result of natural and man-made disasters. Combined insurance premiums
written from emerging markets accounted for only 18 percent of global premiums in 2014,
against 82 percent recorded from the advanced economies. Given the concentration of
growth and development in emerging economies, going forward, the extent of
underinsurance is a concern. In many of these economies, efforts are being aggressively pursued
to increase awareness of the importance of insurance protection in helping one manage
risks, and to develop an effective insurance market to meet these needs.
The insurance industry in Malaysia currently stands at crossroads of implementing important
reforms being introduced by Bank Negara Malaysia both in the general and life insurance
sectors. The objective of the reforms is to further enhance the competitiveness of the
industry, ensure its continued resilience, and encourage greater innovation in solutions
offered for households and businesses to better manage risks. To this end, two aspects of
the reforms are significant. The first is the progressive strengthening of prudential standards
that aim to improve underwriting and risk assessment capabilities within insurance
companies, while substantially strengthening incentives for insurers to differentiate
themselves in the market. The second is the structural changes that are being introduced to
reduce market distortions and drive efficiency improvements. Beyond domestic borders, the
Bank also continues to pursue further liberalisation in the cross border provision of insurance
in certain sectors, such as the Marine, Aviation and Goods in International Transit (MAT)
sector, both to enhance capacity and reduce costs for businesses. This is primarily being
advanced under regional integration plans, focusing in particular on ASEAN.
Taken together, the reforms are expected to result in wider product offerings and delivery
channels, service quality improvements, greater market transparency, and more
differentiated pricing that is reflective of risk.
This will help risk managers for whom the decision to purchase insurance is increasingly
driven by wider considerations which go beyond just the intention to transfer risk. Significant
advancements in risk management practices and financial innovations have substantially
broadened the actions that risk managers can take to control risks. For many companies,
insurance solutions are no longer viewed as the only, or even the most important, way to
reduce risk exposures. The insurance reforms will allow the industry to better respond to
changing demand drivers. Importantly, it will also create opportunities to build stronger
partnerships between corporate risk managers, insurance companies and insurance brokers
in elevating risk management practices more generally. This includes a wider role envisaged
for the industry in providing risk advice to clients, and initiatives to advance the quality and
coverage of risk information that is useful to risk managers across a broad spectrum of
areas, such as information on hazard exposure, demographic changes and technological
risks.
Conclusion
In conclusion, maintaining that delicate balance between extreme risk aversion and
wellreasoned risk taking, which is essential for businesses to grow and prosper, will always
involve difficult judgements. We should be careful to ensure that advancements in risk
management practices are serving to sharpen, and not blunt, such judgements. This requires
that investments in people and processes are firmly supported by good information,
confidence in a strong risk culture, and compelling risk managers who will ensure that
organisations do not become complacent, and remain focused on doing their very best to
prepare for any possibility.