Shifting risk responsibilities to front line will help reduce vulnerabilities: PwC Canada

Canadian businesses are more vulnerable to disruption than their global counterparts and need to make each line of service responsible for risk decisions, monitoring, oversight and assessment of vulnerabilities to bolster protection, suggest Canadian insights from a recent PwC report.

“By moving risk management closer to the front line, management will have a greater understanding of risks and a greater capacity to manage them in an agile way,” Kishan Dial, partner, risk assurance for PwC Canada, suggests in Managing risk from the front line: Risk in review 2017: Canadian Insights, released Wednesday.

The findings – the first time Canadian-specific results from PwC’s global study have been released – reflect input from respondents in consumer and industrial products, 39%; financial services, 35%; technology, infocom, entertainment and media, hospitality and leisure, 9%; government and education, 7%; health services, 5%; and other, 5%.

The findings report defines first line of defence as the specific business units undertaking the risks, while the second line is risk management/compliance and the third line is internal audit.

Risk management from the second and third lines does not give upper management a clear understanding of their own vulnerabilities, argues a statement from PwC Canada, a member of the PwC network of firms with people in 157 countries.

“This type of risk management structure has resulted in an inability to manage risks effectively and adapt over time,” the report contends.

“In every area surveyed, Canadian organizations were below global respondents in terms of how effective they are at managing risk, although they continue to catch up,” it points out. The only areas where Canadian respondents are more likely than the global average to manage risks from the front line are regulatory and compliance risk (33% compared to 26%) and technology risk (44% compared to 42%).

Related: 35% of top global insurers have appointed a chief digital officer to oversee business transformation: PwC’s Strategy&

“Companies excelling today have intuitively grasped that risk management must be shifted to the first line of defence,” Dial writes in the report. “But that’s not to say that the second and third lines no longer play an important role in this process.”

To address business vulnerability, it is recommended organizations shift duties and assign responsibilities, define risk appetite and establish a risk reporting system. More specifically, PwC Canada cites the need for the following:

• each line of service should have a defined role regarding risk decisions, monitoring, oversight and assessment of vulnerabilities;
• organizations must define risk appetite and leverage the technical tools available to them, including aggregation tracking and reporting; and
• reporting structures should enable the first line of service, but also require the second and third lines to monitor the first line’s effectiveness.

“To address current and future challenges, Canadian firms must commit to strong risk management structure and processes in order to excel in ever-evolving economy of the future,” Dial emphasizes.

Polled firms in Canada were found to be lagging their global counterparts in their risk management approach, PwC Canada reports, which appears to be contributing to being more vulnerable.

“Compared to their global counterparts, Canadian companies say they’re more liable to undergo disruption in a variety of business areas while being less successful at dealing with these disruptions,” states the report.

Future areas of risk and disruption for Canadian businesses will be in technology advancements, it indicates, with 70% disruption predicted compared to 55% disruption globally. Canadian business also lag with regard to human capital (49% at home compared to 40% globally) and operations (37% compared to 26%).

Related: Report reinforces correlation between risk management, financial success of businesses: Aon

“Only 35% of [polled] Canadians that experienced a disruption caused by digital innovation managed the issue effectively (compared to 42% of global respondents),” the report notes. “Human capital disruptions had a similar effect (24% in Canada compared to 36% globally).”

Asked which issue caused disruption for the company in the past two years, 44% of Canadian respondents noted technology advancements compared to 34% globally; human capital changes was 44% compared to 34%; financial challenges was 44% compared to 36%; operational disruption was 37% compared to 30%; digital innovation was 30% compared to 28%; and culture and compensation changes was 30% compared to 23%.

While polled Canadian businesses acknowledge moving risk management to the front line could help address vulnerability, many business operations continue to keep risk management at the second or third lines. Why?

“A lack of sufficient resources (skilled people) is the primary factor in preventing a shift in risk management to the first line,” respondents indicate. Another hurdle seems to be that Canadian respondents note their business units do not have enough authority and resources to manage risk from the first line.

“The fact that Canadian companies recognize they’ll be better off with a first-line strategy for risk management, but aren’t acting on it is one of the bigger surprises of our survey,” state the findings. “This suggests that while Canadian acknowledge the benefits of shifting this responsibility to the first line, the change will take longer, as they’re likely more confident in their second and third lines of defence.”

It is clear the approach of “deferring to the second and third lines isn’t paying off. This is particularly an issue in non-regulated industries, as those companies seem to be falling behind their global peers in terms of how they manage risk overall,” it adds.

Other survey findings include the following:

• less than 33% of Canadian businesses – versus 50% globally – reported periodic staff education about new or existing potential risks;
• 59% of Canadian respondents – versus 69% globally – reported they are less likely to use risk management tools and techniques such as risk rating systems to define risk appetite; and
• 66% of Canadian respondents – versus 75% globally – reported they had mandatory ethics and compliance training for all employees.

“Our study suggests that Canadian respondents have slipped behind global respondents in several areas of risk culture. In general, building and maintaining a strong risk culture has proved an uphill battle – especially in the area of training,” the report points out.

Ongoing training, it emphasizes, “should be mandatory, as risk is continuously evolving. The risks a company faces today will likely be different from those it will face just a couple of months later.”

Related: Canadian executives investing in tech skills training, but still struggle to keep up with technology change: PwC Canada

The good new is that “regulated industries such as banking and other financial institutions have made progress in dealing with risk and disruption relative to non-regulated industries,” the report notes.

“While Canada has come closer to its global peers in the past couple of years when it comes to managing risk, there’s still a gap that needs to be addressed for Canadian businesses to develop the ability they need to continue to excel in the current economic landscape,” Dial writes in the report.

“Risk management needs to be part of both strategic planning and tactical execution for company management. This creates the ability needed to rapidly respond to risk and disruption and, ultimately, to get ahead of risk,” the Canadian findings add.