Jessica Chew Cheng Lian: Innovative risk management - GO BOLA!
(Go Beyond, Go Original, Go agiLe, Go Ahead)
Opening speech by Ms Jessica Chew Cheng Lian, Deputy Governor of the Central Bank of
Malaysia (Bank Negara Malaysia), at the Malaysian Association of Risk and Insurance
Management (MARIM) Conference 2018, Kuala Lumpur, 17 July 2018.
* * *
It is my great pleasure to be here today at the MARIM Conference 2018. With well-documented
lessons on the links between corporate management and sport, and the 2018 FIFA World Cup
final just behind us, the "GO-BOLA" theme must have been much too tempting to resist! As
displayed on the football pitch, the quest to anticipate, defend and overcome continues to
challenge risk and insurance management practitioners as we grapple with profound changes in
the operating environment.
The Allianz Risk Barometer for 2018 revealed that today's risk management world is more fluid
than it has ever been. The impact of many of the top risks identified is also more interlinked. Not
surprisingly, business interruption and cyber incidents are the top threats for corporations of all
sizes and sectors. Risk scenarios have also expanded - going beyond traditional risk exposures
such as natural catastrophes and fires, to new risks associated with technological and social
change.
There is no question that risk and insurance managers today face significant uncertainty. This
can arise from simply not knowing what we don't know as the world rapidly changes around us;
from changing paths of risk due to more complex multidimensional networks; or from
developments (such as social media) that amplify the probability and impact of risk events. This
in turn calls for new ways of managing and thinking about risk. For many organisations, this
represents a fundamental shift in current approaches to risk management.
Reflecting on our own work in the financial sector and within the Bank's own organisation, risk
management practices would appear to be at an inflection point. More traditional approaches to
risk management have come under increasing pressure for their tendency to overcompensate
for risk-taking, resulting in missed opportunities that are likely to cost businesses, and society at
large, much more today than before.
On the other hand, managing risks by instinct or intuition can produce massive payoffs. But I
suspect none of us in this room would advocate abandoning the principles, disciplines and
methods of risk management that help leaders make sound decisions, particularly when those
decisions can have significant negative externalities.
So, where to from here?
Clearly, risk and insurance management must innovate and adapt ahead of growing, new and
evolving business risks. Five years ago, Steve Culp, a Senior Managing Director at Accenture,
told Forbes that innovation and risk management are partners, not adversaries - "When properly
fused, the two disciplines can help organisations pursue opportunities that a risk-averse culture
might leave on the cutting room floor". Opportunities that not only profit businesses, but that
enable private enterprise to help solve real world problems confronting society today - including
poverty, climate change and growing inequality.
As you can imagine, worrying about risks is in the DNA of central banks given our mandates to
promote monetary and financial stability. So the idea of innovative risk management itself would
typically set off alarm bells within the Bank, and probably among a number of you in this room.
But in reality, we are living in a world where exceptional conditions exist. Monetary and financial
conditions that prevailed since the Global Financial Crisis have increased financial risks. Thanks
to globalisation, regulatory and political developments have a far wider international reach. And
social media that has become deeply ingrained in our daily lives has led to a world described in
the latest Global Risk Report by the World Economic Forum as "a world without common facts
and objective truth".
Innovative risk management is therefore not just about allowing businesses to take on more risks
in a responsible way. It is as much about strengthening our defences against new and emerging
risks. And perhaps, most importantly, it is about providing businesses with the confidence to
move beyond the present to embrace and build a better future.
For many organisations, current approaches to risk management are likely to be already severely
deficient in this new environment.
Today, I would like to focus my remarks on three important shifts that I believe will underpin
innovative risk management practices going forward.
· First is the changing role and focus of risk managers in supporting business
decisionmaking.
· Second, is a shift from risk measures to risk narratives.
· And third is an increasing emphasis on building resilience alongside the prevailing focus
on averting risks.
Changing role of risk managers
One of the most important changes that corporations can make to strengthen risk management
is to appropriately position the risk function to effectively support enhanced business decision
making.
An effective risk management function should interact with other business functions to deliver
value. This itself is hardly an innovative idea. But you would be surprised (or maybe not) to learn
that despite an increasing involvement of risk managers in business decision-making, poor
alignment between decisions that are taken by business leaders, and the intentions of senior
management and the board, continue to persist in many organisations.
A common reason for this is the absence of, or a poorly defined risk appetite framework. And
very few organisations, if any, have gone further to articulate their risk appetite for managing
innovation specifically.
This has important implications for risk managers. We cannot expect risk managers to be very
helpful to business leaders who have explicit growth and revenue targets to meet, if risk
managers are not themselves guided by a risk appetite that is equally well-defined. At best, risk
managers end up being tolerated as a necessary evil and constraint to innovation, rather than
valuable partners to significantly lift a firm's growth potential.
Today, risk managers are tasked to identify and mitigate risks in day-to-day business decisions.
This inherently assumes that risk managers in the office are going to be always better at
identifying risks in new business ventures than the individuals on the ground who are charged to
lead and execute them. In a fast changing world, this is particularly problematic because it is
more likely to place unrealistic expectations on risk managers. Of greater concern, it may not
permit timely responses to emerging risks. It also slows the pace at which a firm can learn from
and adapt their risk tolerance to new ways of doing business as it gains experience.
The path forward therefore lies in making business leaders better risk managers. The role of risk
managers in turn should evolve from directly supporting individual business decisions, to
continuously pushing for more clearly defined risk appetite frameworks through engagements
with the board, senior management and business leaders; by ensuring that management
guidance is consistent with the risk appetite; and communicating the risk appetite in precise and
specific terms across the organisation.
Organisations will rarely get it right the first time. But encouraging a strong focus on providing as
much clarity as possible in setting the risk appetite for the organisation sets the tone and internal
conditions for ongoing improvements in risk culture; it provides better alignment between
business decisions and a firm's risk tolerance; and ultimately, delivers a better balance between
taking on too much risks and inhibiting the kind of innovation that we depend on to build
successful businesses and economies.
Achieving these outcomes is more urgent than we might think. In an online poll by Marsh last
year, 91% of risk professionals agreed that understanding technological innovation is crucial to
stay at the forefront of their industry. This corroborates the 2017 Excellence in Risk Management
report - also by Marsh and the Risk & Insurance Management Society - which revealed that
more than 90% of companies are either using or evaluating disruptive technologies, such as the
Internet of Things and wearable technologies.
Yet, more than half of organisations have not conducted risk assessments to deeply understand
the risks associated with disruptive technologies, much less define the organisation's appetite for
such risks. Less than half (48%) of respondents said they have a cross-functional risk
committee that manages these risks, never mind how effectively. And even this percentage has
dropped from 52% in 2016 and 62% five years ago.
These observations point to considerable scope to improve current approaches to risk
management - at a time where business lines are already venturing into unchartered territory.
Moving beyond risk measures to risk narratives
Innovative risk management will also require new ways of looking at measures of risk. While
financial measures of risk are not likely to go away anytime soon, a good place to start is by
acknowledging that financial models do not, nor are they likely to, fully and perfectly account for
how firms will be affected by risk events.
In his book, "The End of Theory", Richard Bookstaber who was also a former regulator at the US
Securities and Exchange Commission, wrote that we cannot know where we will end up until we
take the journey. And we cannot retake that journey once completed.
This raises some important issues for how firms set and maintain limits that define their risk
tolerance. It does not mean that we should necessarily throw out conventional risk measures.
But it does mean that we need to supplement them with the ability to develop and maintain a
richer risk narrative that is perhaps less precise, but much more informative.
Moving away from more mechanistic approaches to controlling risk calls for strong discipline and
higher levels of competence among business and risk managers. Where there are no bright
lines, effective risk responses will depend on firms setting up a process that can bring together
diverse perspectives and data sets; encourage rigorous debate and dialogue on risk
developments; and build an informed consensus on how much risk an organisation should be
willing and able to take to achieve its business goals.
Such a process is undeniably messier, less predictable and possibly harder to explain in a
consistent way. But it is also precisely these very characteristics that make it much more
relevant in the world that we live in today.
At the Bank, our work on proportionate regulation and risk culture aims to support this evolution.
For example, the innovation sandbox allows financial institutions greater regulatory room to test
innovations within a controlled environment and learn from emerging experience. We are also
examining options to better tailor the regulatory framework to the size and complexity of financial
institutions. And we are directing greater supervisory focus on an institution's prevailing risk
culture to determine the degree of supervisory intensity that we apply to individual institutions.
We expect these developments to pave the way for more constructive dialogue with institutions
to achieve regulatory frameworks that will deliver a sensible balance and greater synergies
between risk and innovation.
Building resilience
The third important shift that I want to mention concerns a stronger focus of innovative risk
management approaches on building resilience, in addition to simply averting or reducing risks.
In the area of network security, organisations are increasingly adopting an "assume breach"
paradigm where they operate on the assumption that a risk event has already occurred. In the
financial world, reverse stress testing is being incorporated into risk management approaches to
identify the scenarios that would break an institution. These approaches acknowledge the
practical limitations of risk mitigation when there is little clarity on risk triggers or their
impact.
In the aftermath of the Global Financial Crisis, financial regulators vowed to end the risks that
institutions deemed too-big-to-fail posed to the financial system. This led to strategies that were
developed for the resolution of distressed or failed financial institutions without causing
disruptions to the financial system or heavy costs to public finances. The implementation of
recovery and resolution plans has been by far among the most significant post-crisis reforms
undertaken - with far reaching financial, legal and operational implications that also extend
across borders.
While not all businesses pose the same kind of externalities as financial institutions, the push to
move beyond a cursory treatment of business recovery and resolution plans is worth heeding.
The idea of innovative risk management would ring hollow if everything came to a screeching halt
because an organisation had failed to correctly anticipate a risk incident, and business continuity
plans failed to support the organisation's rapid and effective recovery from the incident.
In a more uncertain world, the likelihood of this occurring is far from trivial.
Despite a heightened appreciation of risk and new methods to managing risk, business recovery
and resolution plans have generated little attention in most organisations beyond the operations
of recovery centres. This is not only misguided; it misses a valuable opportunity for organisations
to design operations in a way that would enhance an organisation's ability to reinvent itself as
circumstances change, and achieve wider options for recovery in a business disruption
scenario.
At its most basic level, building resilience is about helping organisations better understand their
operational and financial interdependencies and how this can affect their ability to recover and
respond to disruption and change. This not only assures an organisation's own survival, but
enhances its prospects for creating value.
Development priorities for insurance and takaful
In speaking on innovative risk management, I would be remiss not to touch on the Bank's
development priorities in the Malaysian insurance and takaful sector to support risk management
by businesses. Let me mention some of the ongoing initiatives that are relevant to those in this
room today:
· We are raising professional standards for insurance brokers to improve the quality of advice
and risk information provided to risk and insurance managers;
· We are reviewing existing industry arrangements to further develop domestic underwriting
capacity for large and specialised risks;
· We are progressing a review of capital requirements to further strengthen the resilience of
insurers and takaful operators to support more complex and diverse risks; and
· We will continue to facilitate access to the domestic insurance market by strong global
insurers that can bring new and innovative risk solutions to meet the needs of Malaysian
businesses and reduce insurance outflows.
Of note, payments abroad for insurance and reinsurance services, largely by corporates, grew
significantly by 45% since 2010 to reach RM10.2 billion in 2017. As our needs increase, it is
imperative that efforts be intensified to optimise onshore insurance capacity. Risk and insurance
managers play an important role in supporting broader efforts to develop domestic insurance
capacity. More can and must be done to improve the quality of risk information and work
collectively with brokers and onshore insurers - both Malaysian and foreign - to develop
costefficient and innovative solutions that are tailored to business needs. This will go a long way to
build domestic capacity while contributing to a stronger domestic economy.
In closing, I am reminded of the famous Italian poet, Pietro Metastasio, who said this of risks:
"Every noble acquisition is attended with its risks; he who fears to encounter the one must not
expect to obtain the other". I cannot think of a better reason for advancing innovative approaches
to risk management that will provide the confidence and economic freedom for businesses to
grow and evolve.
On that note, let me once again thank MARIM for the opportunity to share some thoughts with you
today and I wish you a productive conference ahead.