The Risk/Performance Equation

August 18, 2009

There is an emerging trend for closer convergence of risk management software with Corporate Performance Management (CPM) that should help businesses to understand the risks that are associated with their strategies better. The big appeal of CPM is in its ability to help organisations close the gap between strategy and execution; monitoring performance against goals and targets, and making corrective decisions/changes in order to maximise opportunities and minimise threats. Risk is closely associated with performance and must not be left out of the CPM equation. However, organisations should beware of increasing complexity of software applications and the potential to oversimplify risk management within them.

Risk management is a broad term for considering anything that could possibly fail or generally go wrong in an organisational-sense. To make studying the subject easier, it tends to be broken down into three broad areas. Market risk is associated with market and trading conditions that change over time, including exchange rates and in burneet terest rates. Credit risk is centered on managing earnings and expenditure uncertainties. Banking institutions, insurance companies, and other financial services focus strongly on these areas of risk management as a core part of their business. Operational risk is more concerned with the day-to-day running of things within the business and the implications of something going awry; it incorporates information risk, theft, fraud, and loss of employees/assets.

Market and credit risk are relatively well-accepted elements of risk management. This is no doubt aided by the fact that the data that underpins the associated risk dimensions is fairly readily available. Granted each particular organisation will then undertake its own analysis on the data sets, for example in the form of developing advanced forecasting models, simulations, and risk profiles. Operational risk is ‘softer’; for example, how many organisations are able to comprehend the impact of information falling into the wrong hands, or the risks associated with a key manufacturing sequence failing. To these we have to add the impact of increased levels of regulations with national bodies imposing a variety of requirements on companies.

From the CPM angle, solutions centralise and co-ordinate Business Intelligence (BI) disciplines with elements of planning, budgeting, and monitoring. The goal is to achieve a series of views of business performance across operational activities and departments, and in doing so creating a link between the strategy of the business and the execution of that strategy. If the business is to make a decision based on inputs and forecasts from a CPM solution, it needs to understand the associated risks, otherwise, it could be that the organisation is exposing itself to significant unknown risks, for instance, when entering a new market.

CPM’s greatest strength is its ability to abstract control and deliver clear and concise views of company performance. However if not managed closely, strategies, plans, and forecasts can become over-simplified, leading to a false sense of security. The key is to ‘keep it real’ by formulating CPM to give a reasonable view of the world – one that balances business performance with business risks. Given that, it is important that risk management is brought in from the cold to work as part of the bigger performance management picture, and software applications should support this requirement.

The downside of the closer convergence of risk management and CPM software is that it increases complexity, potentially making applications more difficult to deploy and use. For example, it could increase the scope of data integration requirements as more departmental stovepipes are crossed in order to gain a more holistic view of risks. Additional resources and expertise would also be required for the design stages of the implementation, and although most of CPM platforms are modular in nature, organisations are likely to end up purchasing functionality that they do not require. Whilst complexity is not so much of an issue for large enterprises, it is often a big barrier to smaller companies that do not have the resources or the expertise to implement complex solutions, nor the budget for expensive professional services.

The closer convergence of risk management with CPM increases the pressure on software vendors to deliver applications that are simpler to deploy and easier to use. This is generally true of this software segment and should be possible thanks to standards-based software development, improved data integration capabilities, and advances in user interfaces.

The fact of the matter is that there is more to successful CPM and risk management than deploying software applications. It takes time and effort to define the right strategy and to execute it. All the same, opportunities for a more integrated approach to risk and performance management should be grabbed by organisations and worked on. These can be small at first but grow big enough to help businesses out of a piecemeal and a reactive approach to risk management.

–Sarah Burnett

Sarah Burnett is a member of the Advisory Board of The IT-Finance Connection.

She is a Senior Research Analyst with Butler Group, a Datamonitor company. Sarah specialises in Business Intelligence and related fields. Sarah’s responsibilities include researching developments in her specialist fields, evaluating software products, and writing and speaking regularly about them. Her recent publications include technology audits of leading BI and CPM software products, data warehouse appliances and data quality and integration tools. A regular speaker at conferences, Sarah also provides personalised advice to Butler Group clients.

Sarah is an experienced analyst and consultant. She has worked in a variety of IT roles in the past 20 years including software development, project management and programme management. Sarah holds a BSc in Physics and Electronics and an MSc in Applied Optics. She has Prince 2 practitioner qualifications and is a fully qualified member of the British Computer Society.

Posted by Carl · Filed Under Business Intelligence, Risk and Compliance, SaaS, partnership pages