CHENG, Nam Sang

FOO S.L.,

Institutional Knowledge at Singapore Management University

Singapore Management UniversityInstitutional Knowledge at Singapore Management UniversityResearch Collection School Of Accountancy School of Accountancy4-2016Risk Management in a VUCA Environment: Somekey considerationsFOO S.L.Singapore Management University, slfoo@smu.edu.sgNam Sang CHENGSingapore Management University, nscheng@smu.edu.sgNam Sang CHENGFollow this and additional works at: https://ink.library.smu.edu.sg/soa_researchPart of the Accounting Commons, Risk Analysis Commons, and the Strategic ManagementPolicy CommonsThis Magazine Article is brought to you for free and open access by the School of Accountancy at Institutional Knowledge at Singapore ManagementUniversity. It has been accepted for inclusion in Research Collection School Of Accountancy by an authorized administrator of InstitutionalKnowledge at Singapore Management University. For more information, please email libIR@smu.edu.sg.CitationFOO S.L.; CHENG, Nam Sang; and CHENG, Nam Sang. Risk Management in a VUCA Environment: Some key considerations.(2016). IS Chartered Accountant. Research Collection School Of Accountancy.Available at: https://ink.library.smu.edu.sg/soa_research/1554Risk Management in a VUCA Environment: Some Key Considerations  BY FOO SEE LIANG, LEX LEE, CHENG NAM SANG  Published in IS Chartered Accountant, 2016 April, 7pp.  What is VUCA? Why is it relevant to accountants, the C-suites and Board of Directors? Companies are in the business of taking risks for rewards. Situated between the companies are in the business of taking risks for rewards. Situated between the companies and the rewards are risks. Critical concepts in this process are volatility, uncertainty, complexity, and ambiguity (VUCA), a trendy managerial acronym1 that conflates the reality of the business environment and the challenges of risk management.  The omnipresence and growing intensity of VUCA in the business environment present roadblocks to most companies’ journey towards their objectives. Increasingly, VUCA changes how they view the world, interact with each other, and respond to their environments.  In extreme cases, corporate continuity can be at stake. The manifestation of VUCA can be seen in many forms – a massive collapse in oil and commodity prices, the Zika pandemic, acts of terrorism, cyber security threats, natural disasters, technological glitches, and many more.  Inter alia, the Economist Intelligence Unit’s 2012 white paper, “Agent of Change”, based on a global survey of 567 top executives and 23 in-depth interviews with leading technology and business thinkers as well as senior executives, identified advancements in technology as a mega trend shaping the business world. Driven by an increase of low-cost computing power, greater storage and bandwidth capabilities, and the intensified harvesting of data (or big data trends), disruptive technologies will affect the fabrics of future workforce and business models. At the individual level, the Internet of Things is transforming living lifestyle to a smart platform of extending the concept of connecting everyone to connecting everything (example, smart offices and homes which have appliances controlled by smart phones).                                                            1 “What VUCA really means for you”, Harvard Business Review, Jan–Feb 2014, p.27  What is VUCA? The VUCA tapestry is a reality and an integral part of today’s business landscape.  So, what characterises a successful company in the midst of the VUCA landscape? So, what characterises a successful company in the midst of the VUCA landscape?  While risk management principles will continue to be relevant, companies need to proactively adopt a VUCA lens when implementing risk management, including each phase of the risk management process.  Stated differently, a risk-savvy company is one that proactively embraces VUCA – it is a risk survivor and also a risk overcomer. At the epicentre of its governance DNA is a smart, risk-based, decision-making process embedded across different levels of the organisation.  In the corporate governance arena, the principle of establishing of a sound system of risk management is a generally accepted global norm in the Code of Corporate Governance. Risk governance is gaining traction as a core competence along with other technical, business and personal skill sets. It is an integral part of a company’s strategic initiative. Fundamentally, it facilitates the creation as well as the preservation of corporate values.  Although risks need to be treated for their adverse effects, they can also be harnessed for their opportunities.  However, setting up a system of risk management is not a panacea. The framework and process must be continuously strengthened to be fit for purpose in the constantly-changing face of VUCA.  In other words, the goal is how to navigate the company effectively at the speed of change in the VUCA environment?  … a risk-savvy company is one that proactively embraces VUCA – it is a risk survivor and also a risk overcomer. At the epicentre of its governance DNA is a smart, risk-based decision-making process embedded across different levels of the organisation.     DON’T BITE OFF MORE THAN YOU CAN CHEW AND STOMACH  The forces of VUCA can have a severe impact. As responsible stewards, the board and management have to exercise due diligence to ensure that the company is resilient to the adverse impact of VUCA. Risk taking without boundaries is recklessness. The significance of having a risk appetite is to set an enterprise perimeter for risk taking and risk management.  In recent years, there has been a growing awareness and adoption of risk appetite statements by companies. Such a statement serves to align the boundaries for risk taking in addition to expounding the exploitation of opportunity for the companies.  For instance, it is common for some companies to disclose risk appetite statements in their annual reports. In its 2015 Annual Report, SingTel states that “the Group shall not compromise our integrity, values and reputation by risking brand damage, service delivery standards, severe network disruption or regulatory non-compliance”. As a mechanism for opportunity seeking, it is “prepared to take measured risks to seek new growth in the digital space by providing global platforms and enablers, targeted at a global footprint, while leveraging our current scale and core strengths”.  While there are many interpretations of what a risk appetite means and what risk statements are, the lack of a uniform interpretation must not negate the fact that formalising and communicating risk appetite underscores sound business sense. It aims to provide a safeguard that companies must not bite off more than they can chew and stomach (that is, the amount and type of risk to take to achieve the appropriate returns).   RISK HINDSIGHT, INSIGHT AND FORESIGHT  Looking at the past and current risk landscape may provide hindsight and insight into the potential risks ahead. It is like driving a car and using the rear-view mirror while simultaneously looking ahead at what is beyond the windscreen.  But, can one anticipate what is lurking around the bend?  The many moving and evolving parts in the VUCA environment call for existing risk identification methodologies to incorporate a more robust risk foresight. This requires a risk-sensing mechanism that moves with the pace of the dynamic VUCA landscape.  In this context, there are companies adopting the Formula 1 “pit wall” approach. It helps to identify risks using predictive analytics for F1 drivers who are constantly vying for the lead, with the ultimate reward of championship points. The pit wall teams provide the drivers with real-time pictures of what lie ahead and around the corners. At the same time, information, pertaining to details about the condition of the cars during the race (example, tyres, engine, etc.), is filtered. They use data technologies and predictive data visualisation to improve driver performance and decision-making in the precarious world of F1 racing.  A case in point is DBS Singapore. Its internal auditors leverage the pit wall approach2 , inter alia, for risk management. Such an approach provides timely information, helps sense emerging issues from a risk and control perspective, enhances insight on what can go wrong, and sharpens foresight on                                                           2 14th SIAS Investors’ Choice Awards. Internal Audit Excellent Award 2013; The Winners’ Perspective, p.8 the appropriate response strategy. Big data, technology, and human interface lie at the heart of this endeavour.  Competencies, resources, and commitment by those charged with governance and management are necessary factors for it to succeed and to operate effectively on the ground. Proper communication is also required to keep all key stakeholders on the same page.  The many moving and evolving parts in the VUCA environment call for existing risk identification methodologies to incorporate a more robust risk foresight. This requires a risk-sensing mechanism that moves with the pace of the dynamic VUCA landscape.   RESPONDING TO VUCA RISKS  Companies’ risk responses include avoidance, reduction, transfer and retention. In relation to the externalities and disruptive nature of VUCA, these risk responses call for greater contingency planning and collaboration with external stakeholders. For example, responding to terrorism threats usually entail multi-agency efforts.  So what does this mean for companies?  Standard Operating Procedures (SOPs) can help but their effectiveness may be limited since the responses and the outcomes are dependent on external parties and other factors. In most cases, companies would have to adopt a “trial-and-error” approach when faced with VUCA risks. Without the certainty of outcomes, companies are increasingly considering secondary risks that may arise from the initial response. For example, the use of sea water may potentially address the overheating of the Fukushima reactors, but, unfortunately, it led to massive radioactive pollution of the sea in the region and beyond.  In a similar vein, VUCA risks manifest a business reality, that is, the companies’ controls over them may be limited. There are no perfect solutions. Hence, the issue calls for critical thinking. More precisely, it calls for thinking out of the box in a collaborative manner – harnessing a diversity of views to address VUCA.   STAYING CONNECTED, EYEBALLING RISKS  Risk identification is not an end in itself. By its very nature, risks that arise in a VUCA environment are not static. Risk levels do change – they may decline or escalate. Even when risks are acknowledged, it is not a matter of inertia and accepting them as status quo; indeed, they need to be monitored.  But what should a company be on a lookout for, exactly?  Key performance indicators serve as a useful monitoring mechanism. In a VUCA environment, attention is increasingly being focused on early warning indicators for more efficient and timely risk management. Leveraging data analytics has been mentioned as one approach, and the use of technology to provide real-time streaming of images of critical facilities is also being utilised. In other words, establishing a platform for data and imagery interface is emerging as a practice. For example, a hotel corporate headquarters can have live data feedback on guest receptions at its overseas operations. Simultaneously, management can also view and monitor the reception activities on a real-time basis.  To summarise, risk monitoring is about watching what matters. This requires selecting the pertinent risk triggers and establishing the appropriate escalation protocol.   ALL ABOARD: DOING THE RIGHT THING  Having the relevant risk management framework and process are essential building blocks in response to risks in a VUCA world. But will the risk mandate be properly executed, and will the right things be done?  The way risk is embraced by personnel within the organisation and whether each one “walks the talk” serve as the foundation for sound risk management.  Having a system of risk management must not provide a false sense of comfort that everything is satisfactory and will continue to be normal. Complacency can become an insidious problem and needs to be countered by a clear assignment of risk ownership and accountability. With VUCA, the notion of a centrally risk-driven risk management protocol has to be enhanced and extended to embrace greater engagement with those on the frontline, as well as with key stakeholders. All employees of the company must be empowered and equipped with the appropriate capability, and they must also embrace a risk-aware culture to face VUCA.  In short, to better meet the challenges of VUCA requires the concerted and coordinated efforts of everyone in the organisation. The board and management necessarily have to depend on those at the frontline. Concomitantly, the frontline needs the board and management to provide clear direction, resources, and incentives against the threats of VUCA in order to remain on the same page.   ENSURING RISK MANAGEMENT SYSTEM IS FIT FOR PURPOSE  Navigating the VUCA landscape is challenging. It is ever changing. Indeed, change is the only certainty. An important question to ask, therefore, is whether the risk management is appropriate for the VUCA context faced by the company. Put differently, is it fit for purpose?  Sound stewardship requires the stewards to establish robust management practices, and having a sound system of risk management is no exception. Nevertheless, the question remains as to whether or not there are weaknesses and blind spots in existing practices.  In this respect, a pillar of robust corporate governance is assurance, that is, having an independent eye that reviews whether risk management is VUCA-ready, design-effective, and operationally-effective. In today’s environment, those charged with governance face a higher degree of oversight for the system of risk management. An independent, objective assurance (example, internal audit) serves to inspire confidence in key stakeholders that the system is fit for purpose in the creation and preservation of corporate values. More importantly, the openness to having an independent review goes a long way in conveying that the board and management take the threat of VUCA seriously – both in word and in the spirit of corporate governance excellence.   Foo See Liang and Cheng Nam Sang are both Associate Professor of Accounting (Practice), Singapore Management University. Lex Lee is Director of Business Innovation Services, Deloitte Singapore and Southeast Asia. The writers would like to thank J.J. Williams, Associate Professor of Accounting (Practice), SMU, for his input. The writers acknowledge that risk management is a vast and diverse topic. There are also a myriad of issues and challenges. The aim of this article is to provide an appreciation of some of the key risk areas from a strategic viewpoint through the VUCA lens.   

Risk Management in a VUCA Environment: Some key considerations

https://ink.library.smu.edu.sg/cgi/viewcontent.cgi?article=2581&amp;context=soa_research

Risk Management in a VUCA Environment: Some key considerations

Abstract

Similar works

Full text

Available Versions

Institutional Knowledge at Singapore Management University