A collective reconsideration
Marinus de Pooter | 2015
For those who listen in various sectors, the picture quickly emerges that risk management is not successful in practice. And that despite all the investments made and the energy that has been put into it in recent years. If risk management does indeed bring so much good (as is usually claimed), how is it possible that line managers do not flock to training and conferences? Why don’t they queue up to learn more about all those wonderful concepts and tools (including the many impressive software applications)? As a management system, has it sold so badly or can it simply not deliver what is promised? Perhaps it is a combination of both. It’s time for something better. As far as I am concerned, the end of conventional risk management is near. I refer to the instrumental approach from a separate staff function. The limited enthusiasm for this usual setup is due to several factors. I will mention a number of observations from the consultancy practice.

Usually, risk management is invested in a separate function or in different specialised functions such as Security, Quality and Safety, et cetera. This easily leads to responses from line managers along the lines of: “We hired you to take care of those (information security) risks!” Regulators have devised the creation of a separate Risk Management department (or even a separate CRO function) as a counterbalance to the overthrown ambitions of line managers. However, just because of the differences in personalities, its effectiveness can only be limited. If you do something about risk management, because your supervisor requires it or because the head office requires it from you, it will not easily be embedded in your day-to-day operations. If you use it as an accountability tool, it will at most help to give supervisors a sense of (false) security.
Lees verder



