Enhancing the risk assurance process through improved risk quantification and communication

A major international telecommunication services provider wanted to understand how the application of risk appetite could enhance the group’s risk processes. Zurich Strategic Risk (ZSR) consultants provided the company with a fresh insight into the issue and began discussions on how to make progress towards better risk assurance.

• The Board and senior executives began by considering how to improve the way in which the company’s most important risks should be represented and communicated. The aim was to develop a process by which the most critical risks could be consolidated in a more consistent way and evaluated in a manner that could be easily portrayed and interpreted.
• In consultation with ZSR, the company developed an advanced approach for risk evaluation. This approach involved the quantification of risks to determine the extent to which exposure can be reduced given various degrees of mitigation success. Once quantified in this way, the key risks could all be represented on a two-dimensional diagram, enabling rapid visual assimilation of the most important areas while losing none of the detail behind the analysis.
• The approach needed to be integrated into the existing risk management process through which business line risks were elevated to the Group for consolidation. (These risks are summarised and presented to the Board periodically and the company’s key risk factors are published annually in the Report and Accounts).
• ZSR consultants facilitated a workshop aimed at introducing business line risk managers to the new approach. As a result of the workshop a number of issues arose which shed light on the areas for improvement. ZSR is now working with the company to implement the approach in a way that will ensure it will be successfully adopted for the benefit of the Board and senior executive management whilst not disrupting the risk management processes already in place in the businesses.
• A best practice review of the company’s overall risk management and communication practices is also planned.