Using IT to Drive Effective
Risk Management

As a company evolves towards a more mature enterprise risk management framework, its risk management relies on the information, expertise and ability to take corrective action already contained in its lines of business. By simplifying or automating risk management processes, business owners have access to more accurate and useful risk management information. This drives better operating results and increases the likelihood of business owners embracing the risk management program.

With technology, companies can more easily incorporate risk management into critical business processes and improve performance. Technology solutions can provide several of the key features of a mature risk management program, including:

Collaborative process support. Risk management software offers collaborative process support that makes collecting and analyzing risk information easier. A centralized tool provides a standardized vocabulary and quantification methodology that is critical when managing risks across business units. When everyone is speaking the same risk language, the resulting information is easier to compare and act upon. This leads to more timely and consistent insight that helps executives prioritize risks and take appropriate actions.

For example, IT tools that track incidents and losses provide a wealth of information to business owners about the root causes of losses and the effectiveness of risk responses used in the past. Collaborative information sharing means that companies can learn from their experiences and avoid repeating mistakes.

Audit and security. Advanced IT tools can also create an audit trail for risk management information. For many industry and legal mandates, it is important to produce timely and accurate reports that tie back to source information. A lack of audit trails requires time-consuming document tracking and expensive manual audits, and often leads to errors. Additionally, the confidence of stakeholders may erode if reports cannot be easily audited. Instead, companies should look for systems that closely document and monitor information and automatically create auditable reports.

Because some risk management information is incredibly sensitive, security is another important issue. IT tools can provide data security by employee level, limiting a user's access by time, line of business, business activity and individual risk. For example, a business owner with a narrow mandate may only be allowed to see the information for one or two risks in his or her immediate area of responsibility, while an executive can access the risk management information for a broader line of business.

Proactive automation. Technology can provide companies with a single platform for automatically collecting and tracking key risk management issues. This frees up time for the risk manager to focus on analyzing risks, providing recommendations and becoming a trusted partner to the business owner. Whenever possible, information from the disparate IT systems within the enterprise can be leveraged by the risk management application to provide early warning indicators for potential loss situations. And, by leveraging next generation technology, such as enterprise service-oriented architecture, risk management can be extended across the network to partners, suppliers and customers.

Integration with performance management. Using technology, companies can create an important link between risk management and corporate performance. When strategies and initiatives are linked to risks, mature risk management practices can make executing against plan and measuring business performance easier. Risk information presented in the business context is more relevant and easily understood, making it more valuable for decision making. Tools like tailored risk scorecards and watch lists with aggregated information for specific areas of responsibility can help present information within the appropriate business context. Users can then drill-down into results for detailed analysis, better supporting accurate decision making.

Incorporating early warning indicators effectively into business processes can turn risk management into a proactive tool for achieving goals, not just minimizing losses. These indicators and reports blend performance management with risk indicators, allowing business managers to better manage expectations of senior executives, partners and analysts, minimizing any surprises that could negatively impact company value.

-------------------

Holly Roland is the vice president of marketing for SAP AG's governance, risk and compliance business unit.