More art than IRM International Geared up Getting it

science Diploma special for success? back on track

Time for a greater All you need to know Is your operation ready Why product recalls
focus on the softer about IRM’s key to take advantage of don’t have to
aspects of risk? qualification unexpected growth? be a PR disaster

The official magazine of the Institute of Risk Management www.rmprofessional.com | Autumn 2014

Space race
Is the final frontier for
tourism a risk worth taking?

RMPAut14 pp01 Cover.indd 1 09/09/2014 13:34

 A LITTLE LESS
‘WHAT IF?’
A BIT
MORE
‘WHO
CARES?’
Schillings Reputation Radar helps you predict the
events that will affect your reputation tomorrow by
understanding those shaping public opinion today.

R E P U TAT I O N
R ADAR

Strategic risk forecasting www.schillings.co.uk

RMPAut14 pp02-03 Editorial.indd 2 09/09/2014 13:34

 More art than IRM International Geared up Getting it
science Diploma special for success? back on track
Time for a greater All you need to know Is your operation ready Why product recalls
focus on the softer about IRM’s key to take advantage of don’t have to
aspects of risk? qualification unexpected growth? be a PR disaster

The official magazine of the Institute of Risk Management www.rmprofessional.com | Autumn 2014

Space race
Is the final frontier for
tourism a risk worth taking?

RMPAut14 pp01 Cover.indd 1 09/09/2014 13:26

IRM CHAIRMAN:
Richard Anderson FIRM
editorial

Naked
CHIEF EXECUTIVE OFFICER:
Jeremy Harrison FIRM
business development
director:
Sophie Williams MIRM

truth
head of marketing:
Fiona Duhig
fiona.duhig@theirm.org
Tel: +44 (0)20 7709 9808

A
managing editor:
Sush Amar
sush.amar@theirm.org nother week, another cyber breach, another batch of headlines. While the
Tel: +44 (0)20 7709 4114 hacking/stealing of celebrities’ intimate cameraphone images may generate
more ethical hand-wringing newspaper articles than your average corporate
editor: Phil Lattimore
phil.lattimore@ institution’s data loss, both reflect the ongoing issue of cyber security in an
rmprofessional.com ever more connected, data-reliant – yet sometimes cyber risk-unaware –
Tel: +44 (0)7802 870008 society. From the private to the professional, the loss of sensitive data can be
design and production: traumatic and damaging.
CPL (Cambridge Publishers Ltd) The variety and complexity of the cyber threat – and how risk professionals should address
275 Newmarket Road it – was discussed in detail by leading experts at IRM’s recent Cyber Risk Summit, held in London
Cambridge CB5 8JE over the summer. One of the key speakers at the event, chief information security officer of the
Tel: 01223 477411 Bank of England Don Randall MBE, delivers his views on the topic on pages 19-20 of this edition,
Web: www.cpl.co.uk while IRM’s comprehensive guidance for risk professionals in its report, Cyber risk: resources for
advertising manager: practitioners, remains an essential read for anyone looking to understand the issues and take
Michael Niskin practical steps to mitigate these risks.
Tel: +44 (0) 1223 273 535
michael.niskin@ Positives and negatives
rmprofessional.com
Of course, risk management is about positives, too. Risk managing for success is, perhaps,
Risk Management Professional is the undervalued by some outside the profession, but ensuring that your organisation is prepared for
official publication of the Institute of Risk surges in demand or unexpected growth can be critical for a business’ operations. We look at how
Management (IRM). ISSN 2042-4078
to navigate the risks involved and take full advantage of the opportunities on pages 16-18.
IRM is the world’s leading professional
body for risk management. We are
On the flip-side, a potentially negative situation – such as a product recall – doesn’t have to
independent, well-respected advocates of prove a disaster if risk management processes and plans are in place to manage the situation
the risk profession, owned by practising risk
professionals and operate internationally,
promptly and effectively. We explore recent examples of both successes and failures when things
with members and students in more than go wrong in our feature on pages 12-15.
100 countries.
Meanwhile, our cover story for this issue looks at the final frontier for extreme tourism – space
Institute of Risk Management travel – and how this out-of-this-world holidaymaking experience requires the ultimate in rigorous
2nd Floor, Sackville House, 142-149
Fenchurch Street, London EC3M 6BV risk management. You can read all about it on pages 29-32.
Tel: +44 (0)20 7709 9808
Fax +44(0)20 7709 0716
www.theirm.org
The right knowledge
enquiries@theirm.org Being prepared and having the right knowledge is crucial as the scope and importance of risk
Copyright © 2014 Institute of Risk functions in organisations grows. In this edition, we also include a special section on IRM’s
Management. All rights reserved.
Reproduction without written permission International Diploma in Risk Management, which has been revised and updated to reflect the
is strictly forbidden. The views of outside changes in knowledge and new challenges facing global business. You can find out all you need
contributors are not necessarily the views of
IRM, its editor or its staff. to know about the new qualifications on pages 21-28.
Enjoy the magazine.

Phil Lattimore
Cover image: Editor
Virgin Galactic
RMProfessional

| Autumn 2014 | www.rmprofessional.com | 3

RMPAut14 pp02-03 Editorial.indd 3 09/09/2014 13:34

 Regulars
6 News
T he latest risk management news,
including the establishment of a
UK Food Crime Unit in response to
food fraud scandals, celebrity cyber
breaches, warnings on debt, and
threats to the economic recovery
10 Talking points
Reader feedback on some of the key
issues facing the risk profession
11 CEO’s message
Increasing regulation is boosting the
demand for risk professionals, but
having the right knowledge and
experience is crucial, says IRM interim
chief executive Jeremy Harrison
38 Book review
Featuring Risk-based performance
management: integrating strategy
and risk management, by Andrew
Smart and James Creelman
12
4 | www.rmprofessional.com | Autumn 2014 |
RMPAut14 pp04-05 Contents.indd 4
IRM focus 44 In the name game
Career questions answered by
21 Enter the next David Imison, delivery director of risk
generation of risk at Schillings
managers...
An eight-page focus on the launch 46 Member profile:
of the IRM’s revised International Monika Narula
Diploma – an essential guide We talk to the operational risk manager
at RBS India who is a self-confessed tea
39 Glocal hero inventor with a shelf of awards – and a
IRM board director Nicola Crawford passion for books
FIRM reflects on ‘glocalisation’ and
the challenges it presents to risk
professionals
40 IRM news
IRM updates, including details of the
Risk Leaders 2014 conference, key
events and training opportunities, plus
news from IRM’s special interest and
regional groups
29
09/09/2014 13:09
 CONTENTS
AUTUMN 2014

Features
12 Total recalls 33 Handle with care
A badly-handled product recall can have a huge Recently published NHS data signal a warning
impact on both reputation and the bottom line. Yes, for the medical devices industry about the risks
So what lessons can risk professionals learn negative of inflated expectations from patients
from recent high-profile examples?
risks must 34 The case for risk leadership
16 Dream nightmare come first, Now is the time for a greater focus from risk
Would your organisation be adequately professionals on the softer behavioural aspects
prepared for a sudden surge in demand or but then of risk, argues David Hancock
popularity? We explore how risk professionals you should
should prepare for opportunities and over-
performance turn the
19 Banking on it
conversation
Among the experts presenting at IRM’s sell-out around
Cyber Risk Summit, RMProfessional caught
up with Don Randall MBE – chief information
security officer at the Bank of England – for
his views on the cyber threat
Page 16
29 To boldly go...
As Virgin Galactic prepares to take fare-paying
passengers into space, we explore how the risks
associated with space tourism are being managed

34 19

| Autumn 2014 | www.rmprofessional.com | 5

RMPAut14 pp04-05 Contents.indd 5 09/09/2014 13:09

 Celebrity hack
highlights data risk
The risk of having personal
data and images hacked
has been highlighted with
the release of naked images
of high-profile Hollywood
celebrities on an image-
sharing forum.
Among those targeted
by the unknown hacker
posting on site 4chan
were Oscar-winning
actress Jennifer Lawrence
(pictured), model Kate
Upton, and singers Ariana
Effects of ebola Ukraine crisis threatens
reach UK economy eurozone recovery
The economic effects of the
African ebola crisis continue
to be felt, with the UK hit by
ongoing repercussions on
both travel and businesses.
Liberia, Sierra Leone and
Guinea have all suffered
economic effects, which
have, in turn, hit British
businesses. Among these is
British Airways, which has
suspended flights to Sierra
View Apart / shutterstock
6 | www.rmprofessional.com | Autumn 2014 |
RMPAut14 pp06-09 News v3.indd 6
Gil C / shutterstock
Grande and Victoria Justice. denied that its security was
Both Justice and Grande breached.
have denied the images are Accounts can be
of them, but a spokesman accessed relatively easily
for Lawrence has confirmed
the authenticity of her
if a hacker can guess a
user’s password, or reset RBS hit
pictures. Legal action is
being taken, together with
the account password by
answering basic security
with £15m
an FBI investigation. questions. However, Apple fine over
s_bukley / shutterstock
The images – said
to come partly from
is now tightening iCloud
security, with additional
mortgage
celebrities’ phones – were measures to alert users if advice
reportedly susceptible to data is restored to a new
hacking, though Apple has device. Taxpayer-controlled
Royal Bank of Scotland
(RBS) has been hit
with a £15m fine by
the Financial Conduct
Authority (FCA).
The fine has been
imposed after the bank
Leone and Liberia until at Even Germany is was found guilty of
giving poor sales advice
least the end of the year. experiencing an to mortgage customers
Other businesses unforeseen slowdown in in the latest scandal to
affected have been industrial production. affect the troubled bank.
associated with the mining ‘Heightened It is not the first time
RBS has been landed
industry, especially in the geopolitical risks, as
with extensive fines,
wake of falling iron ore well as developments with past penalties
Stringer / getty
prices, and the need to in emerging-market including £390m for
impose travel restrictions economies and global rigging the Libor rate,
on staff and visitors from financial markets, may and £8.75m for money-
laundering irregularities
affected regions. have the potential by its Coutts subsidiary.
Further problems have The head of the to affect economic A further fine is
included: delays in shipping European Central conditions negatively,’ expected to be imposed
vital equipment and the Bank (ECB) has said said Draghi, after the by the FCA over the
failure of its computer
export of the finished the political crisis over ECB’s governing council
systems in 2012.
product; palm oil and Ukraine threatens to kept the benchmark rate The bank is also
rubber manufacture; and oil derail Europe’s ‘weak, at a record low level of currently under
and gas production. fragile and uneven’ 0.15 per cent. investigation in
Matt Robinson, senior recovery. Moscow’s decision to connection with alleged
collusion in the foreign
credit officer at credit ratings Mario Draghi has impose a full embargo exchange market.
agency Moody’s, warned warned that tit-for- on food imports from The RBS fine means
that if an outbreak hit the tat sanctions between the EU, USA, Australia, the total in FCA penalties
Nigerian capital, Lagos, ‘the the EU and Russia are Canada and Norway was this year stands at
approximately £265m.
consequences for the West sharply increasing likely to have an impact
Last year, fines reached a
African oil and gas industry downside risks within on European exports, record £447m.
would be considerable’. the 18-nation eurozone. economists warned.
10/09/2014 13:23
 industry focus
news round-up

FOOD FRAUD squad IMF fears

A new Food Crime Unit is to
be set up in the UK to tackle
the fraudulent food trade
and strengthen consumer
confidence in Britain’s food.
The establishment of
the special force comes
in the wake of last year’s
horsemeat scandal, and is
part of the government’s
well as the establishment of
a new Food Crime Unit, the
government has announced
further measures to make
sure consumers know
where their food is coming
from and ensure consumer
confidence. These include:
n Improved labelling, with
new country of origin
catering services to provide
schools and hospitals with
high quality British food and
boost UK farming.
n Improving food education
in schools through a
new national curriculum
to give children a better
understanding of where
their food comes from and
for global
effective responsibility for the
growth if
traceability of their products, rates rise
supporting local authorities’
target enforcement activity The global economic
based on risk, and ensure recovery could be
consumers have an increased derailed if interest rates
understanding of where their return to normal levels
food comes from. in Britain and the United
States, the International
Monetary Fund (IMF) has

Monkey Business Images / shutterstock

response to Professor Chris
Elliott’s report into food
integrity and assurance of
food supply networks. All
of the recommendations in
the Elliott report have been
accepted by the government,
environment secretary
Elizabeth Truss confirmed. As
FCA limits sale of high-
risk, high-yield bonds
labelling introduced from
April 2015.
n Making it easier for
food procurers to make
decisions about the locality,
authenticity and traceability
of their food.
n Improving public
procurement of food and
why it is important to know warned.
what is in our food. In its annual Spillover
Professor Elliott’s review Report, the IMF claims a
examined ways to prevent percentage point could
food fraud incidents from be wiped off growth in
happening. It also looked at the UK and cause a panic
how to improve the culture in emerging markets.
of Britain’s food supply chain Developing economies
to support industry taking could suffer a flight of
capital to the west when
interest rates begin to
BoE concern over UK rise and quantitative
easing is reduced.

The UK’s Financial Conduct Authority (FCA) has placed a

borrowing sensitivity The Bank of England
is expected to announce
one-year ban on the sale of risky complex bank bonds to Bank of England (BoE) – which exceed annual an increase in interest
individual investors. governor Mark Carney has income by 40 per cent – rates later this year,
In the first use of its new consumer protection powers,
the financial industry regulatory watchdog says it will limit voiced concerns over the are making the economy having held them at
the selling of contingent convertible securities – or ‘coco ability of UK households to ‘particularly sensitive to 0.5 per cent since 2009.
bonds’ –from 1 October, as the high-yield investments are cope with the cost of higher interest rates’. In the US, the Federal
inappropriate for a mass retail market. borrowing. If the interest rates rose Reserve is winding down
Coco bonds offer yields in the region of six to seven per
Indicating that the by even a comparatively its quantitative easing
cent, but their value can be written down if the issuing bank’s
capital drops below a minimum level. economy is returning to modest 2.5 per cent, more programme, and is
Christopher Woolard, director of policy, risk and research normal, Carney said that as than half of homeowners forecast to start raising
at the FCA, said: ‘They are complex and can be highly risky, it regains its footing, ‘the would need to economise interest rates in June.
and the FCA has used its new powers to ensure that cocos Bank rate will need to start on spending, while one The IMF has warned
are not inappropriately made available to the mass retail
market, while still allowing access for experienced investors.’ to rise in order to achieve the in five borrowers would that global growth could
Caspar Rock, chief investment officer at Architas, agreed. inflation target’. spend more than 35 per fall by as much as two
He said: ‘Although default rates are still relatively low, it However, the BoE is cent of their disposable percentage points.
is also important to be aware of the risk inherent to these alarmed that any rise in income paying back ‘Much will depend
instruments.
interest rates will cause mortgages. on how well the
richard barnes / shutterstock

households to tighten their Despite the concerns, normalisation process

belts rather than default on
mortgage payments, spend
less and push the economy
back into crisis.
Carney said that high
levels of mortgage debt
however, the BoE has made can be managed
it clear that low interest in major advanced
rates are also a threat economies, and on policy
to the economy, as they frameworks in recipient
can encourage excessive economies,’ it said.
borrowing.

| Autumn 2014 | www.rmprofessional.com | 7

RMPAut14 pp06-09 News v3.indd 7 09/09/2014 12:55

 UK borrowing Personal insolvency
down, BUT storm warning
deficIT UP Fears are growing that
interest rate rises could
UK government has now risen to £37bn. lead to a sharp increase
borrowing has fallen In addition, the national in personal insolvency, as
compared with this time debt has also increased to figures for the second quarter
last year, although the £1.3tn taking it up to 76.5 of 2014 show a significant
deficit has increased, per cent of the national upward trend. The three-
according to figures from income. month period saw 27,029
the Office for National This was slightly offset personal insolvencies in
Statistics (ONS). by a £1.6bn reduction in England and Wales, a 5.1 per
The deficit for the government borrowing in cent increase on a year earlier.
first quarter of 2013-14 the period since last July. It was the biggest rise

Tupungato / shutterstock
stood at £35.2bn, and The deficit levels since 2010, and was driven
are still a long way by a 20 per cent jump in the
from their record number of people entering
yearly high of £137bn into individual voluntary
in 2009-10, but could arrangements, to a record
still put the Chancellor high of 14,571, said the
George Osborne under Insolvency Service.
considerable pressure to Some experts claim Bev Budsworth, managing accountant HW Fisher &
meet his planned target the figures show creditors director of The Debt Advisor, Company, is also reported
of £95.5bn for the year. are more confident about in a Guardian report. ‘The acid as saying: ‘With as many
The figures come at recovering debts, but others test will be when the Bank as a quarter of mortgage
a particularly tough time insist it shows people are on of England starts to raise holders facing unaffordable
Peter Macdiarmid / getty

for him in the pre-election a financial knife-edge after its base rate and people’s payments, if interest rates
period, as it was hoped years of falling wages and mortgage payments follow rise to a more normal level
the full-year forecast government cuts. suit.’ of three per cent, a personal
could be met, allowing ‘It’s clear that people Brian Johnson, insolvency insolvency storm could be
him breathing space in are really struggling,’ said partner at chartered gathering.’
the run-up.

Wall Street banks warn US Treasury about risk-taking

A group of leading Wall Street
banks has warned the US Treasury
that low market volatility is
heightening ‘excessive risk-taking’
by investors.
Volatility is now at record lows
Stuart Monk / shutterstock
markets that encourage them to
take progressively larger amounts
of risk. Recent times have seen
sales of high-risk investments,
such as junk bonds, soar because
of increased demand from yield-
used by large Wall Street banks
also incorporate volatility data to
calculate how much a trading
portfolio might be expected to
shed during a given day, with a
calculated probability.

because of bank policies that
restrict sharp market movements
and deter investors from hoarding
funds. This, in turn, has led to
concerns that larger investors
have grown complacent following
years of dealing with one-way
hungry investors.
Because banks and investors
include volatility in their internal
risk management, there is now a
chance that previously-suppressed
markets are amplifying more risk-
taking. Value at Risk (VaR) models
With volatility having sunk
lower, VaR models are suggesting
there are very small chances of
sustaining large losses, meaning
more banks can take on more
risk, without breaching internal
standards for risk management.

8 | www.rmprofessional.com | Autumn 2014 |

RMPAut14 pp06-09 News v3.indd 8 09/09/2014 12:55

 industry focus
news round-up
Self-driving cars face
Ban hits Standard

Jeremy Reddington / shutterstock

Chartered
British banking and financial services company Standard
Chartered is to be barred from handling transactions for
high-risk clients as part of a hefty US$300m settlement
with New York’s banking regulator.
The ban was imposed by the New York Department
of Financial Services (DFS) after Standard Chartered failed
to improve its methods for recognising suspicious activity.
Standard Chartered has stressed that the bar will
only affect a small number of clients and services,
which includes clearing activity for high-risk Hong
Kong businesses and the withdrawal of certain client
relationships at branches in the United Arab Emirates.
The embattled company’s UK banking arm
will also no longer be able to accept new customers for
dollar clearing without a go-ahead from DFS.
A Standard Chartered spokesman said: ‘The group
accepts responsibility for, and regrets the deficiencies
in, the anti-money laundering transaction surveillance
system at its New York branch. The group has already
begun extensive remediation efforts and is committed to
completing these with utmost urgency.’
Daniel Fung / shutterstock
virtual carjacking
Defending self-driven cars against the risk
of cyber attacks that could cause drivers to
lose control of their vehicles has become
‘essential’, according to Daimler chief
executive Dieter Zetsche.
The increasing use of electronic control
systems could theoretically create an
‘nightmare vision’ opportunity for a third-
party hacker to create ‘actions not intended
by the driver’.
Zetsche stressed that Daimler was already
working to combat cyber crime, saying: Over-regulation
‘We are working with all our strength to
implement firewall-related technologies that risk flagged
make this impossible.’ Bankers who say that heavy-handed
It is thought that self-driving cars could regulation is making banks too averse
be on the streets by 2020, following to risk need to ‘demonstrate that this
Google’s experiments in the area, is the case’, the UK’s parliamentary
with many manufacturers developing Treasury Committee chairman has
autonomous driving systems. said.
Car manufacturers are already employing Speaking in the Financial Times,
specialist ‘penetration-testing’ firms to check Andrew Tyrie said that MPs were
vehicle system security. Daimler itself used lacking detailed figures – one of
an external company to try to hack its partly- the main tools for assessing claims

autonomous S-class saloon. by senior bankers that regulation is

Record fines for Bank of America for
sub-prime mortgage role
Bank of America has been
ordered to pay a record fine of
US$16bn for its part in selling
flawed mortgage securities in
the build-up to the financial
crisis.
The Department of Justice
found that Bank of America,
Last year, researchers demonstrated about to become disproportionate.
cyber attacks on Ford and Toyota vehicles Bankers claim that regulation
that could cause steering and brakes to is stifling the banking sector and
malfunction, while Chinese researchers have pushing activity into other areas of
hacked a Tesla Model S. finance.
Tyrie said: ‘It’s crucial that
politicians exercise judgement, too,
and don’t drive regulators into a
corner where they protect themselves
from criticism by over-regulating.’
His comments followed the
The fine is the largest publication last week of plans by
applied so far in a string of banking watchdog, the Financial
similar settlements paid by US Conduct Authority, which were based
banks as the Justice Department on a report from the parliamentary
investigates their behaviour commission on banking standards
during the sub-prime mortgage that Tyrie chaired last year.
crisis. Tyrie also highlighted the
The US$16bn fine will be risk that regulators ‘endlessly
Northfoto / shutterstock

and companies it owned,
purposely misrepresented the
level of risk involved with loans
that were used to back its
residential mortgage-backed
securities (RMB).
paid to several US states and pile on regulation in an effort to
government agencies, as well demonstrate activity that could all
as the Justice Department, with too easily act as a substitute for
US$7bn of the sum going to thinking through what is really
customers seeking to pay off needed’.
high loans.

| Autumn 2014 | www.rmprofessional.com | 9

RMPAut14 pp06-09 News v3.indd 9 09/09/2014 12:55

 irm
READER VIEW
TALKING POINTS
WHAT YOU HAVE BEEN SAYING ABOUT THE RISK PROFESSION
VIA SOCIAL MEDIA, email AND OTHER CORRESPONDENCE
Scrap the ‘R-word’
I was recently told by another risk
management ‘student’ that ‘risks’ and
‘opportunities’ are not the same and
shouldn’t be managed as if they are. And
he’s not the only one.
I disagree. We need to manage ourselves
and our organisations to anticipate all
possible futures, focusing on those with the
highest probabilities. A future event carries
a range of outcomes – favourable for some,
adverse for others. Grant Purdy’s hurricane
example is spot on – it destroys crops and
homes but also creates new work for home
and road repairs. It is anticipation that’s key.
Proper anticipation can even allow firms
to improve their customer reputation and,
thus, their competitive position. The now-
famous Johnson & Johnson response to the
initial Tylenol tampering incident saw the
company actually increase its market share in
the following year. Now that’s converting a
downside event into an opportunity.
The word ‘risk’ has been almost
completely transformed. In the 1920s, Frank
Knight defined it as a measure of probable
likelihoods and consequences. Picking up
the idea of risk management in the late
1950s, insurers – naturally – considered only
downsides. Ask anyone today, and chances
are they will define ‘risk’ as a bad event.
It’s time to scrap the word. It is totally
misleading. Use ‘uncertainty’ instead.
FELIX KLOMAN FIRM, Lyme, UK.
Playing it safe and missing
the point
The volatility of mining share prices this
summer highlights a dual danger for
environmental risk managers. When
reviewing many risk reports filed on the stock
market, it becomes clear that environmental
risk reporting is driven by compliance – the
easiest risk to report. Yet, in too many
companies, compliance is pushed by internal
10 | www.rmprofessional.com | Autumn 2014 |
RMPAut14 pp10 Letters.indd 10
and external auditors. As the basis for many
KPIs and KAIs, auditors play it safe and do
not risk recommending something out of the
ordinary. Lack of transparency about what
these firms do creates a corresponding lack
of transparency about the associated risks.
Shareholders are inevitably left unaware of
the risks these companies actually run.
Yet, aside from political risk, some of
the greatest share price falls have been
triggered by environmental events. Given
these can be among the largest share price
influencers, are shareholders aware of the
actual environmental impacts or only of the
compliance-related components? Shouldn’t
the stock market already have taken this into
account when evaluating the share price? If
they have, then why the volatility in the face
of an environmental event? Risk-averse but
profit-greedy shareholders?
As swathes of Africa open up to foreign
investment in mining, this is an issue the
industry needs to get to grips with, urgently.
ADRIAN CLEMENTS FIRM, Mertesdorf,
Germany.
The new normal is now
Recent articles in RMProfessional raise an
interesting challenge to risk managers
universally: the move from focusing on ‘risk’
to giving greater attention to uncertainty.
In the wake of the financial crisis in 2011,
Josef Ackerman – then-CEO of Deutsche
Bank – said: ‘We should resign ourselves
to the fact that the “new normality” is
characterised by volatility and uncertainty.’
He has been both right and wrong.
Despite significant stock market volatility in
2011, it has since declined consistently. From
2013, it has returned to pre-financial crisis
levels, with the odd higher spike. In contrast,
uncertainty seems to be increasing.
RMProfessional stories bear this out:
reduced security of energy supply; the
perceived risk of Britain’s stance on the EU;
conflicts in Syria and Iraq; the Ukraine crisis;
stalling growth in the Eurozone and China;
uncertainty over the monetary tightening
in the West; and the world’s largest Ebola
epidemic. Uncertainty is suddenly everywhere,
but has not been reflected by similar growth
in market volatility – a usual measure of ‘risk’.
Uncertainty remains unchanged: the
future is always uncertain. What changes –
as both Knight and Keynes argued – is our
confidence in our expectations of the future,
and the speed and vectors of transmission
and amplification of risk. The challenge
is how risk managers respond to this loss
of certainty and our understanding of risk
propagation when the market indicators that
assess volatility are at seven-year lows.
Stress and scenario testing are increasingly
used by the financial services industries,
but, often, too narrowly. As the Financial
Reporting Council urged, these tools must
make the leap to the mainstream of risk
management in the corporate sector. They
need to become central to the risk manager’s
toolkit. Not just for long- or fat-tail risks – but
as the basis of a focus on risk and uncertainty
in setting strategies and understanding
uncertainty in the strategic environment.
The move for risk managers in all sectors
from focusing on risk and volatility to
uncertainty and flexibility is long overdue;
few have accepted the challenge. It needs to
become ‘the new normal’.
PETER BONISCH, London, UK.
We want your letters, comments
on articles, opinions and
viewpoints. We don’t want
promotions or bland sentiments!
Please send your letters, ideally
no more than 350 words, to Sush
Amar at sush.amar@theirm.org.
We reserve the right to edit letters
if necessary.
09/09/2014 12:56

Brave new
world?
THE RISK PROFESSION IS EVOLVING TO MEET EVER MORE COMPLEX NEEDS, SO KNOWLEDGE
AND EXPERIENCE ARE CRUCIAL, SAYS INTERIM CHIEF EXECUTIVE JEREMY HARRISON FIRM
N
ovember will find me co-hosting a breakfast
discussion on why legislation is not the
answer to bad behaviours. Given the
increasingly entrenched positions of regulators
and regulatees, I suspect the conversation may be louder
than I am used to at that time of the morning.
While legislation may not be universally viewed as
A Good Thing, there’s no doubt it has been very good
for our profession. The banking liquidity provisions in
Basel III, the ‘will they, won’t they’ speculation about the
introduction of EU insurance directive Solvency II, and
the apparently endless revelations about bad behaviour
in financial services are driving a significant increase
in risk management roles in that sector. One global
recruiter has put the increase at more than 20 per cent
in the past year.
However, insurance, retail and investment banking –
while huge creators of risk management roles – form
just part of the picture. As our centrefold supplement
on the launch of IRM’s revised International Certificate
and Diploma shows, a perfect storm of globalised supply
chains, the impact of geopolitical risk, and the boom
in energy extraction and infrastructure is creating new
demand for skilled risk managers in all sectors.
Unsurprisingly, competition for risk professionals is
intense, with some industries and global regions forced
into a merry-go-round of poaching. However, the
plum roles and greatest options continue to belong to
the experienced and qualified. As one of our diploma
interviewees points out: ‘A university degree is no longer
enough for a risk-related career; you need to be able
to demonstrate you’ve got the right knowledge and
qualifications.’
Standards and competence
As risk management arguably becomes the world’s
newest profession, our industry cannot just be about
qualifications passed, or time served. Those who advise
others about risk hold the commercial and physical
safety of millions of people in their hands. Perhaps the
most enduring legacy of both the lack of knowledge
and ethics shown by some in professions as diverse
RMPaut14 pp11 CEO's message.indd 11
irm focus
ceo’s message
as journalism, banking and politics, is the renewed
importance placed on standards and competence in
boardrooms across the world.
No profession is, or should be, exempt from these
expectations – least of all ours. As a previous IRM
chairman argues, in this issue of RMProfessional: ‘The
time when we are treated like a profession is when we
act like a profession.’
At IRM, we have spent an already exceptionally busy
Those who summer further developing our professional standards,
drawing on best-practice examples from more than 30
advise other competency frameworks from around the world.
others about These are currently under review by a panel of experts,
risk hold the and we will publish our framework by the end of the
commercial year. We will expect graduates of our certificate and
diploma to sign up to these standards, and to adhere to
and them throughout their risk-management careers.
physical
safety of A new era for IRM
This will be my last column as IRM’s interim CEO, as
millions of
I return to the role of deputy chair. I hand over the
people in reins to our director of operations, Gail Easterbrook,
their hands who will be acting CEO until our new, permanent CEO
starts. During my seven months in the role, I have been
impressed by the knowledge of our IRM members, and
your passion to communicate it.
You are a constant inspiration. You give up your
time to drive our thought leadership forward, taking
topics – such as extended enterprise, which will be
published next month – to new levels of insight. You
share emerging risks and practical solutions through our
network of special-interest and regional groups, and
you help to build excellence in risk management in your
workplaces.
I would also like to extend my appreciation to
IRM’s staff, a much smaller team than I suspect many
members imagine. Their knowledge and commitment
has played a vital role in driving IRM’s growth.
As we enter a new era of reach and influence, I look
forward to seeing the growing impact of IRM’s work in
industries and organisations worldwide.
n jeremy.harrison@theirm.org
| Autumn 2014 | www.rmprofessional.com | 11
09/09/2014 12:58
 TOTAL
RECalls
A BADLY-HANDLED PRODUCT RECALL
CAN HAVE A HUGE IMPACT ON BOTH
REPUTATION AND THE BOTTOM
LINE. SO WHAT LESSONS CAN RISK
PROFESSIONALS LEARN FROM RECENT
EXAMPLES, ASKS HELEN YATES
H
istory is littered with examples of companies
taking too long to recall a product
and seeing their reputation and brand suffer
as a result.
In an increasingly global world, with complex
supply chains and tightening regulatory oversight in
many markets, it is easy to see why product liability is
a growing concern for many companies. In a highly-
regulated environment, particularly in markets such as
the US and EU, a supplier’s faulty component can have
a big impact.
Take Toyota’s latest recall. This involves a supplier
12 | www.rmprofessional.com | Autumn 2014 |
RMPAut14 pp12-15 Total Recall v2.indd 12
of spiral cables in the deployment mechanism of the
airbags, which may have broken. In addition to the recall
replacement of these vehicles, Toyota has agreed to pay a
fine of US$1.2bn.
Manufacturers and exporters face a growing list of
legislation, the latest of which are new food labelling
requirements in the European Union that will apply from
December 2014. The rules will require allergy information
to be put on all food products sold in Europe.
Complying with regulatory frameworks becomes more
complex when you consider that between 65 per cent
and 90 per cent of the content of any given end-product
is provided by suppliers, often on the other side of the
world. Manufacturing and product quality standards do
not always match those in developed markets.
‘Some of the claims we’ve seen involve complex
supply chains, which means they can be extremely
difficult to deal with in terms of understanding where
some of the contamination has actually taken place,’ says
Ross Macdonald, team leader of casualty specialty lines at
Zurich Global Corporate UK. ‘It’s important to understand
the level of due diligence that our customers are carrying
out on the suppliers they are contracting with, to make
09/09/2014 12:58
 analysis
PRODUCT RECALLS

A high-profile product
recall can result in a significant
financial loss to an organisation –
particularly if it is handled badly

than 1,000 tonnes of products were recalled in the

botulism scare, across seven different countries.
Although the contamination now looks to have been
a false alarm, the economic and reputational fallout was
significant. China instigated a temporary ban on dairy
imports from New Zealand, and French company Danone
is continuing its legal action, claiming it lost US$500m of
sales due to the recall.

Voting with their feet

HuMAnnet / SHutterStock

Another factor exacerbating modern recalls is consumer

sure they are dealing with someone who is providing
them with a safe product.
‘It can be very complex to go back and deal with a
claim involving a lengthy supply chain,’ he adds. ‘From
an insurer’s perspective, if you’re trying to subrogate back
into different countries around the world, that can also
be a challenge. We had a situation where our customer’s
supplier was based in China, and trying to take rights of
subrogation in China is extremely hard.’
The difficulty in discovering the source of a
contamination was aptly illustrated during the 2013
horsemeat scandal, where Dutch authorities recalled
50,000 tonnes of meat sold as beef across Europe.
A pizza containing 35 ingredients from 60 different
countries was discovered by food safety testers. This
was used as an example by the National Audit Office
to illustrate how difficult it was to verify the origins of
processed food eaten in the UK. The watchdog warned
that ‘food fraud’ was rife.
In August 2013, Fonterra Group, a New Zealand-
based firm, announced contaminated whey products
could have been sold to third-parties, which used them
to produce infant milk formula and sports drinks. More
activism. Today’s consumers have a strong voice and, if
a company takes the wrong approach to a recall, it can
quickly become a hot topic on Twitter and other social
media outlets.
Maclaren offers a cautionary tale. Back in 2009 the
company was condemned by Mumsnet bloggers for
undertaking recall action in respect of one million
‘hazardous’ pushchairs in the US, but not taking the same
action in Europe. ‘Maclaren adopted a different approach
in Europe because the regulation was slightly different in
the US, but they didn’t communicate it very well,’ says Jim
Sherwood, a partner who leads the product liability and
recall team at law firm BLM. ‘There was a perception they
were treating some consumers differently.’
Because a tarnished reputation can have a direct
impact on a company’s share price, a high-profile
product recall can result in a significant financial loss
to an organisation – particularly if it is handled badly.
‘Companies are now seeing recall as an occupational
hazard, but also something that, if handled well, can
actually strengthen confidence in brand and reputation,’
says Sherwood. ‘It’s all about the trust of customers.
‘Until companies have a recall or safety issue, often
they may not appreciate the fallout and the real problems
that can occur if the business does not have an internal
plan and response team in place to deal with customers
and regulators – including handling a press response
urgently,’ he continues. ‘I know a lot of risk managers
think they should be more involved in the social media
management of responses.’

| Autumn 2014 | www.rmprofessional.com | 13

RMPAut14 pp12-15 Total Recall v2.indd 13 09/09/2014 12:58

 Because of the importance of public perception, many
modern recalls are prompted by ‘fear of a problem’, as
was the case with Coca-Cola in 2004. The UK launch
of its new brand of bottled water, Dasani, was quickly
undermined by a cynical British media. Coca Cola acted
decisively and admitted it was just ‘purified’ tap water,
abandoning the UK launch within 24 hours.
The company understood the central importance of
its reputation, according to Airmic and Cass Business
School study Roads to Ruin. ‘The speed of Coca-Cola’s
decision, made within 24 hours of the troubled UK
launch of Dasani, indefinitely to abandon the UK launch,
shows not only that Coca-Cola had a clear crisis strategy,
but also suggests that it had set its appetite for risks to
the Coca-Cola reputation at nil,’ it says. ‘This decision
may well have been taken in the light of how its nine
per cent owner, Berkshire Hathaway, had set its own
appetite for risks to reputation.’
Berkshire Hathaway boss Warren Buffett has warned
that while it takes many years to build up a reputation,
it can take just five minutes to ruin it. ‘If you think about
that, you’ll do things differently,’ promises the Sage of
Omaha.
Except not every company heeds such advice. There
are situations where reluctance to instigate a recall
has ended badly for a brand. In June 2006, Cadbury
initiated a precautionary recall of one million bars of
chocolate contaminated by salmonella, five months after
a contamination had occurred.
Cadbury stressed the levels of salmonella were
minuscule, but cases of salmonella poisoning trebled in
StePHen BArneS/trAnSPort / AlAMy
14 | www.rmprofessional.com | Autumn 2014 |
RMPAut14 pp12-15 Total Recall v2.indd 14
the five months leading up to the recall. Health experts
were unable to say whether there was a link, but the
Food Standards Agency said it should have been reported
immediately. ‘The event, which would have seriously
impacted most companies, was mitigated by public loyalty
to a popular brand,’ comments the Airmic report.
At Toyota, the car manufacturer’s slow reaction to
safety problems was met with severe criticism in the
media and social media in 2009. Its decision to recall
more than 3.8 million vehicles after a deadly accident in
California – attributed to sticky floor mats – came too
late to protect the company name. Toyota was vilified
and accused of being ‘safety deaf’, despite a study later
finding no evidence of sudden, unintended acceleration.
Managing a crisis
As successful recalls often demonstrate, a quick, decisive
and transparent response to product safety issues is
always the most effective. ‘In our Roads to Resilience
report, we talk about companies that have amber and
red alerts when a crisis hits,’ says Paul Hopkin, technical
director at Airmic. ‘Amber is using existing management,
activating PR people, and so on, and the red alert is a
whole separation between routine management and
bringing in a crisis management team to minimise
damage to reputation and coordinate business
continuity.’
Helen Yates For many risk managers and PR professionals, Johnson
is a freelance & Johnson’s handling of the Tylenol recall in 1982 is
journalist the perfect case study for how to handle a crisis. The
painkiller was recalled when seven people died in the US
Glyn rylAnD / AlAMy
09/09/2014 12:59

PRODUCT RECALLS
city of Chicago after taking capsules of Tylenol that had
been laced with cyanide. At the time, it was thought the
drug’s brand would not recover from the sabotage.
‘They had a 37 per cent market share of painkillers
when they first identified the problem,’ says Sherwood.
‘It went down to seven per cent pretty quickly, but it
rebounded back to 30 per cent within a year because
they handled it so well. That’s a classic example of how
a business should handle a serious safety issue. Really
good communication and very good coordination. They
withdrew all the products as soon as they knew what
was going on, issued numerous press releases and
updates, and management knew what was being done
and were completely open about it.’
These days, most product recall insurance products
offer cover for reputational risk. Zurich’s customers
receive access to crisis management experts and have
a hotline they can call in case a product needs to be
withdrawn from the market. A proportion of the
premium is spent on risk improvement, mitigation and
If you can demonstrate
you’re dealing with consumers’
concerns, that will help mitigate
and protect the reputation
Paul Marriott / Alamy
RMPAut14 pp12-15 Total Recall v2.indd 15
analysis
stress-testing the organisation’s approach to a recall,
while ‘dark sites’ – websites set up to inform customers
about a recall – are prepared in advance.
‘As well as protecting their balance sheet, which is
obviously why they are buying the risk transfer, they
are looking to us to protect their reputation,’ says
Macdonald. ‘We give direct access to crisis consultants
who will be able to give them advice and tell them what
statements they should be making to the media, and
to certain government bodies that need to be notified.
‘These consultants also help them manage social media,’
he adds. ‘What you don’t want is for it to get out of
control on Facebook and Twitter. If you can demonstrate
you’re dealing with consumers’ concerns, that will help
mitigate and protect the reputation.’
For appropriate risk financing, buyers should be
looking to take out dedicated product recall cover, thinks
Macdonald. This covers: the cost of recalling the product
itself; its destruction; repair or replacement; business
interruption costs; and the public relations expense
inherent in protecting and rehabilitating the brand.
‘Many people who aren’t familiar with product recall
think they will have coverage under their product liability
policy,’ he explains. ‘One of the main differences between
the two is that – in order for the product liability policy to
be triggered – it has to have caused actual injury to third
parties, and is restricted to third-party damages and costs.
Conversely, a product recall policy is triggered where it has
– or would – cause injury or damage, and covers the recall
costs and financial losses of the policyholder, so it is very
different in trigger and coverage.’
Derrick Alderman / Alamy
| Autumn 2014 | www.rmprofessional.com | 15
09/09/2014 12:59
 Dream
Would your organisation be adequately prepared for a sudden surge
in demand or popularity? risk discussions typically focus on potential
problems, but Tom Bovingdon explores how risk professionals also prepare
for opportunities and over-performance
W
hen white goods and floor-care specialist
Hoover was sitting on surplus stock in
1992, it struck upon a novel way to
get rid of it. Anyone purchasing more
than £100 worth of products would receive free airline
tickets. The company had gambled on the public being
put off by the small print – but it vastly underestimated
demand and the tenacity of consumers.
After 600,000 purchases, a consumer pressure group
was formed to force the firm to honour the promotion.
After six years of legal wrangling, Hoover was left with
a bill for £48m – and three senior executives were
ushered out of the door.
With many risk discussions focusing on negative
scenarios, this episode is a reminder of the risk of
over-performance – unexpected surges in demand for
a service, product or offer.
Take, as another example, the Need A Cake bakery,
based in Reading, in the UK. Eager to expand, the
business owners advertised a 75 per cent discount on
12 cupcakes through voucher site Groupon, hoping
to attract some extra custom. However, 8,500 people
Yes, negative risks should
come first, but then you should
turn the conversation around
16 | www.rmprofessional.com | Autumn 2014 |
RMPAut14 pp16-18 Nightmare V2.indd 16
bought the deal, and the company had to shell out
£12,500 on extra staff and distribution costs – while
also losing around £3 per batch of cakes – thereby
wiping out profits for the year.
Success stories
There are numerous other
similar stories: the Toys R Us
delivery delays of 1999, when
the company failed to fulfill a
large number of online orders;
Sony’s struggles to manage
demand for its PlayStation 4 console; and a predicted
crisis for the chocolate confectionery industry, brought
about by shortfalls in cocoa production. Other risks for
businesses include unexpectedly high website traffic, or
an unpredictable event – such as a natural disaster –
that drives sudden demand.
Rob Hainer / Stefano Tinti / paul turner / shutterstock
Such examples raise an intriguing question for risk
professionals: every organisation wants its product or
service to be in demand – but what happens when this
demand exceeds supply or capability levels?
High-quality problem
Hans Læssøe, senior director,
strategic risk management at The
LEGO Group, knows all about the
challenges of a sell-out product.
The toy manufacturer consistently
creates a buzz with new lines – be
it Harry Potter, Indiana Jones,
09/09/2014 12:59
 analysis
Sudden Success
Ninjago or LEGO Friends – for which demand often
exceeds the company’s wildest expectations and
supply capacity.
Predicting demand, says Læssøe, ‘is part of standard
sales and operation planning but, if the product really
hits, that will not be enough – unless the company
has way too much capacity and, hence, a low asset-
utilisation ratio’.
Such demand can be difficult – if not impossible –
for organisations to anticipate. Recently, the runaway
success of animated Disney film Frozen resulted in
order quotas being imposed in an attempt to ensure
the supply was distributed fairly. In another example,
stocks of a stuffed toy wolf, sold by Swedish furniture
chain Ikea, suddenly ran out in Hong Kong when it was
adopted as an anti-government protest symbol.
‘At The LEGO Group, we prepare systematically,
on a monthly basis, as part of our standard sales and
operation planning process – also because we know we
have to,’ says Læssøe. ‘We launch some 20 lines/themes
annually, and we know that one, or maybe two, of
these will sell more than twice what we plan – we just
don’t know which.
‘So we deploy upside/capacity scenarios, where we
try out different combinations and decide on capacity
build-up according to these. Then, if we are still in
“trouble” – as was the case with LEGO Friends in
2012 – we sometimes postpone the launch in some
markets, and/or significantly reduce the marketing push
to reduce demand. However, we also have to realise
that if/when you have hype among children, it is very
difficult to reduce demand.’

The airline model

For John Ludlow FIRM – senior
vice-president of global risk
management at InterContinental
Newscast / Alamy

Hotels Group (IHG) – such

problems need to be considered
on a strategic, tactical and
operational level. As IHG has grown
over the past two decades, Ludlow says the business
has become ‘much smarter and more sophisticated’ at
responding to demand.
IHG strategically plans room pricing around demand
levels and customer type. Ludlow says: ‘If a hotel has
conference space, then we will always prioritise the
sale of that space and then look to sell the rooms. With
a big hotel, we might be looking at this three years
ahead. Once we have sold conference space, we will
look to sell rooms to business people attending the
event, who will typically spend more with us.
‘The old logic was to sell something at the last

| Autumn 2014 | www.rmprofessional.com | 17

RMPAut14 pp16-18 Nightmare V2.indd 17 09/09/2014 12:59

 analysis
Sudden Success
The pitfalls of a
successful pitch
When security services outsourcing company G4S
won the contract to supply security personnel
for the London 2012 Olympic Games, it was
no doubt delighted to have the opportunity
to showcase its capabilities on a global stage.
However, trouble emerged when the staffing
target was changed from 2,000 to 10,400. Months
later – despite agreeing to the increase in staff
numbers – G4S had to admit it was struggling
to recruit adequate numbers, and the UK
government was forced to draft in military staff.
In the wake of the fiasco, more than £150m was
wiped off G4S’s market value in two days. Later,
the company ruled out bidding for the 2016
Olympics, in Brazil, for fear of a repeat disaster.
It then announced it would take a hit of £70m
on the Olympic Games contract, before issuing a
profit warning. Finally, the chief executive, Nick
Buckles, stepped down.
Michael Kemp / Alamy
minute, for a discounted rate; now it’s about selling
it earlier with extra conditions – for example, around
cancellation terms. In essence, we consider this to be
part of our revenue management, so hotel prices go
up in line with demand. In this regard, we’ve followed
airlines – which have cracked this model – and now
plan our revenues over a much longer timeframe.’
Charles Toomer FIRM – former risk manager at the
BBC and Willis – thinks many organisations ‘might
dismiss this as a nice problem to have’, but stresses that
the impact can be significant. ‘If you get this wrong,
you can lose market share, or see your reputation
tumble,’ he says.
18 | www.rmprofessional.com | Autumn 2014 |
RMPAut14 pp16-18 Nightmare V2.indd 18
If you get this wrong, then
you can lose market share, or
see your reputation tumble
Arguing that the question of juggling supply and
demand hinges on the type of market you are serving,
Toomer says: ‘If you want to order a new car in the
UK, you know it will take months to arrive. They tend
to manufacture them subject to demand. However, if
you ordered it in the US and waited for more than a
week, then something is wrong. The two markets have
completely different expectations.’
Tales of the unexpected
So what should organisations and risk professionals
do to ensure these positive risks are taken into
consideration? Toomer says conversations ‘should be
had when launching any new product or service’. He
adds: ‘Yes, negative risks should come first, but then
you should turn the conversation around. “What would
we do if this was a runaway success? What would the
initial signs be that we need to be aware of? And what
can we do to mitigate this risk?” In a way, it’s about
closely monitoring your KPIs.’
Predicting success is never easy, but there are
occasions when demand spikes, in response to
unexpected events. For example, Ludlow says there are
numerous occasions when IHG hotels must respond to
incidents at competitor hotels, such as evacuations. In
these instances, organisations must be mindful of their
reputations. ‘Our first priority is to look after our new
guests,’ he says. ‘There is no gouging of pricing. The
last thing we need is to be accused of making money
from someone’s misfortune. It’s all about keeping
people safe, protecting the brand reputation, and
acting in a responsible way.’
At The LEGO Group, sales expectations are openly
discussed with customers – the retailers – well ahead of
product launch. Læssøe says: ‘We collaborate closely on
how to get the best solution for both parties when sales
exceed – or fall short of – shared expectations.’
Tom If risk professionals are able to consider the holistic
Bovingdon picture more routinely – including how best to respond
is former to a sudden surge in demand – then organisations will
managing be much better positioned for growth. In turn, demand
editor of RM for skilled risk professionals who can help navigate this
Professional growth will increase. That really would be a nice
problem to have.
09/09/2014 12:59
 Interview
on the grapevine

BANKING ON IT
New to RMProfessional, each issue we think. For example – who is the audience that needs to
interview an expert for their take on the know, when do they need to know, and what do they
need to know? Proportionality is important.
current debates in their industry. IRM’s
Let me illustrate. Take the Cross-sector Safety & Security
sell-out Cyber Risk Summit in June (CSSC) system, which the private sector created together
showcased cyber risk experts from a range with law enforcement agencies for the London 2012
of sectors. Sush Amar caught up with Olympics. CSSC has the ability to communicate with 8.5
one, Don Randall MBE – chief information million people, across 36 different business sectors, in
security officer at the Bank of England... just 20 minutes. And we can use it for any preventative
purpose. When the tragic helicopter crash happened last
Given the well-documented and year in Vauxhall, we were able to let everyone in the area
frequent ‘denial of service’ failures of know and reassure them that we were on the case.
banks, what are your views on UK banks’ Now, proportionality in that case was clear. It isn’t
approach to investing in their digital always so clear when it comes to cyber breach and attack,
and technological infrastructure? where we need to identify both methodology and purpose.
I don’t think the issue here is investment. More often, it’s a Perhaps what we need are sub-sets of communications.
consequence of organisations working too much in silos, We now have very strong public/private communications at
rather than in partnerships. It’s clearly not possible to set a regional level, and we’ll be rolling out CSSC
meaningful benchmarks and evaluate your organisation’s
resilience across the piste if you operate in isolation.
This silo issue that exists in some organisations is
compounded by the way the methodologies of cyber
attacks keep changing. For example, 20 years ago, the
UK law enforcement focus was on counter-terrorism. We
put in a lot of resources and achieved buildings that were
bomb resistant. And so the methodology of terrorist
attacks changed, too. Now, instead of buildings being
bombed, terrorists have changed their tactics, and we
have terrible events like Boston and Kenya.
It’s the same with cyber attacks – what lens do you
use to determine where and what the next attack
will be? In this fast-moving risk landscape, financial
institutions should work far more in partnership to
identify the new methodologies and the actual risks.
Better partnership-working between organisations and
– importantly – sharing details of attempted, as well
as actual, attacks would help build up organisational
knowledge among all participants.

What’s your view on the way in which

organisations communicate – or fail to
communicate – after a breach?
Organisational victims of cyber breaches have come in for
a lot of criticism recently, but I think it’s often unjustified.
There’s a degree of misunderstanding; the issue of
communications is far more subtle than many people

| Autumn 2014 | www.rmprofessional.com | 19

RMPAut14 pp19-20 On the Grapevine.indd 19 09/09/2014 12:59

 iNTERVIEW
ON THE GRAPEVINE
pan-nationally too. It’s knitting up the smaller, many more
localised groups that presents the challenge. I’m optimistic
though; I think we will eventually crack this communication
challenge; we’re certainly moving in the right direction.
There appears to be a major flaw
in the culture and governance of
cyber security – a combination of
complacency and ‘it won’t happen to us’.
How do you think this can be changed?
I think there’s a general lack of awareness across the
piste. Raising awareness among all the people in an
organisation, at different ages, with different learning
preferences – the educational challenge is huge. But I’m
not a believer in taking a draconian approach; I think
organisations should realise there is a strong ethical
obligation to prioritise this. At the Bank of England,
we run internal phishing exercises to benchmark staff
responses and monitor improvement over time. You need
this kind of evidence to analyse change – without the
evidence, you can’t keep up with the technology of
cyber crime.
Given the interconnectivity of global
systems, what is the impact of inconsistent
policing on global cyber security?
My take on this is analogous to the days when poor
extradition agreements made Spain a haven for criminals.
Weaknesses in international cooperation and legislation
create openings for cyber criminals. It is the potential for
these gaps that let them in. Poor international operability
slows down response and detection everywhere. So
my view is that, instead of prioritising comparative
legislation, we must prioritise cooperation to shut down
the gaps that open up in its absence.
Do you think the commercial ‘stigma’ of
owning up to a cyber breach acts as an
inhibitor to organisations sharing their
experience and learning from each other?
Not anymore. In the early days of cyber, if one particular
organisation was susceptible to breach it was more likely
to be a reflection of poor security and risk management
practice. Now that everyone is vulnerable, the stigma is
gone. This is also an important ethical issue; you cannot
give attackers the power by not reporting a hack, theft
or breach – the more information one company can
provide, the less vulnerable we all are. For example, when
Barclays and Santander promptly reported the KVM
device thefts, the police were able to catch the criminals
and stop them targeting others. These two banks were
– rightly – lauded for their openness, and that’s the way I
think all organisations should be going.
20 | www.rmprofessional.com | Autumn 2014 |
RMPAut14 pp19-20 On the Grapevine.indd 20
More generally, do you feel UK businesses
ensure risk management is represented at
a sufficiently high level in organisations?
Risk has always been an issue at the ‘top of the house’
– it’s always been a board-level matter – but where it is
actually ‘managed’ varies, depending on how risk is seen
and prioritised. About 15 years ago, for example, risk
management around terrorism had board-level focus in the
UK; it got a lot of airtime and a high priority. That reduced
as risk management steps were put in place and the threat
mitigated. It’s an issue that organisations in countries like
Nigeria and Ukraine are currently having to get to grips
with. But now, the UK’s priority is cyber. In future – in
global business terms – we’ll always be contending with
the triumvirate of corruption, terrorism and cyber security.
I don’t think they’ll ever be ‘solved’ – the time they get and
the level at which they’re dealt with in an organisation will
change, depending how ‘active’ the risk is perceived to be.
Given your experience, what advice
would you give risk managers?
Learn how to translate the sometimes-mysterious concept
of risk management into something non-practitioners can
understand. Talk about impact and opportunities; show
the role it plays in operational success.
You cannot give attackers the
power by not reporting a hack, theft
or breach – the more information
one company can provide, the less
vulnerable we all are
And don’t overplay your hand. Be realistic and don’t
exaggerate. Work in partnership with your organisation
to develop risk culture, appetite and tolerance – these
should be created in tandem, not imposed.
What do you think is the emerging
technological development that no-one
currently sees coming?
When it comes to these kinds of things, I would always
say: ‘Go outside your own head and ask someone who
imagines the future’ – someone like a Steven Spielberg.
Look outside the limits of your own imagination and get
the views of people who think like this. We can all get
stuck in our own psychological boxes; the more diversity
of thoughts and ideas we can actively seek, the wider our
horizons become.
n Don’s views are based on his own experience, and
are not necessarily those of the Bank of England.
09/09/2014 12:59
 IRM – Qualified for today’s risks

ENTER THE NeXt

GeNeratioN
OF RISK MANAGERS…
R
isk management, the world’s newest
profession, is increasingly sought by
organisations across the globe. In 2002,
according to a Deloitte survey, 65 per
cent of financial institutions had a chief risk
officer (CRO); by 2012, this had risen to 89 per
cent. The need for risk management expertise
is not just confined to financial services. From
construction in Brazil to hospitals in the Middle
East and engineering in the North Sea, the
hunt is on for qualified risk management
professionals.
The challenges facing today’s risk
professionals are among the fastest evolving
of any industry. From cyber to construction,
energy to the environment, financial services
to infrastructure – the interdependencies of
a global economy require a deep, up-to-date
knowledge of enterprise risk management.
As leaders in the field of risk management
qualifications and training, IRM regularly
reviews its courses and programmes to ensure
they continue to meet the needs of the global
business community. IRM’s revised International
Diploma will be launched on 15 September
2014.

| Autumn 2014 | www.rmprofessional.com | 21

RMPAut14 pp21-28 Diploma supplement.indd 21 09/09/2014 13:00

 The International Diploma in
Risk Management: Overview
Risk management is a major business function.
From managing ever-evolving cyber risk to
fraud prevention, complex supply chains,
and operational risk, today’s organisations
increasingly value professional risk management
qualifications, such as the International Diploma
in Risk Management.
The programme has six modules. Modules one and two
form the International Certificate in Risk Management.
The remaining four modules make up the rest of the
International Diploma in Risk Management. Successful
completion of the Diploma entitles you to use
designatory letters after your name.

This postgraduate-level qualification has been

developed by internationally recognised academics
and industry practitioners. The International Diploma
will provide you with both the theoretical knowledge
and practical skills to manage risk, and maximise
opportunities in your organisation.

Risk management is a
significant issue for all
businesses – taking many
forms, from cyber risk and
fraud to operational risk

> > > > >

Principles of Practice Risk Risk Risk Crises,
Risk and Risk of Risk Assessment Treatment Governance Resilience
Management Management and Culture and
Future Risks

International Certificate International Diploma

22 | www.rmprofessional.com | Autumn 2014 |

RMPAut14 pp21-28 Diploma supplement.indd 22 09/09/2014 13:00

 IRM – Qualified for today’s risks

Employers
appreciate the
value of professional
qualifications

The International Certificate

A practical, introductory qualification, it can be taken as l  n appreciation of current risk management thinking,
A
a stand-alone qualification, or form the first part of the standards and regulations across the world
International Diploma. It gives you:
l T he basis for advancement to the
l  comprehensive introduction to the principles and
A International Diploma in Risk Management
practice of risk and risk management
Further information on course content for the
l  n understanding of the multidisciplinary nature of risk
A International Certificate can be found at
management within any organisation www.theirm.org/qualifications.

The International Diploma

Builds on the foundation of the International Certificate. l  critical understanding of the influence of
A
It provides a deep understanding of the impact of organisational culture, attitudes and appetite
organisational culture, attitudes and appetite for risk, for risk
as well as the way risk is perceived and treated within
an organisation. l  critical appreciation of the relationships between
A
risk management, governance, internal control,
The course will help you develop: and compliance

l T he competencies to design and implement risk l T he ability to make informed risk management decisions
management strategies for both current and emerging risks

l Proficiency in choosing and using the tools and l T he opportunity to analyse and appraise real-life case
techniques required to assess and treat risks studies from different sectors and countries

Enrolment is open between 1 October and 15 December 2014, and 1 February and 15
May 2015. The examination sessions take place in June or November, respectively.

For more information and the full syllabus, please go to www.theirm.org/qualifications

| Autumn 2014 | www.rmprofessional.com | 23

RMPAut14 pp21-28 Diploma supplement.indd 23 09/09/2014 13:00

 Qualification provides clear benefits to both students
and employers. Adam Skene, currently studying for
the International Diploma in Risk Management and his
manager, Alison Lyall, exchange experiences

The employer’s view

Alison Lyall has nearly 30 years’ experience in banking, regulation, consultancy and business
management, and is now a director of security risk specialist, Harnser Group. In that time,
she’s seen some major changes in the risk management landscape.
‘Risk specialists used to work in “silos” labelled market, credit or operational risk, with the
compliance function turning risk into a tick-box exercise.’ she says. ‘Nowadays, an increasing
Alison Lyall, Director,
number of employers recognise how crucial a broader perspective is, with risk managers
Harnser Risk Group capable of taking a helicopter view across the landscape and working with the business in
managing the risk/reward balance. This enterprise approach is the right way forward.’
When Alison first met Adam, she wanted to see if Harnser could bring young people into
the company at the start of their risk management careers, train and develop them.
‘There’s a finite pool of experienced risk managers. More businesses need to put systems
in place to “grow their own”, as they do with other functions. Adam had already started
doing the IRM Diploma, and I was really impressed with his enthusiasm and his commitment.’
Alison says Harnser has benefited from the changes in Adam since he’s been studying for
the qualification.
‘The Diploma has had a significant impact. His confidence has increased, both in terms of
his knowledge and his contribution to the business. We value his enthusiasm and initiative.
His studies teach him theory, which he then puts into practice at work. So I would say the
Diploma has provided Adam with a very solid foundation. The only downside for us is that
he’s now aware of all the career opportunities available to him!’

The student’s view

Adam Skene’s risk management career started just five years ago, but it already demonstrates
how the requirements of today’s risk managers are changing.
After graduating from the University of Aberdeen with an MA (Hons) in politics and
international relations, he started working in supply-chain logistics, in the local offshore
oil and gas industry. Keen to expand his risk management knowledge, Adam took
Adam Skene, Risk Adviser,
IRM’s Management of Risk and Uncertainty course in 2009, and realised he wanted to
Harnser Risk Group specialise in risk.
Local opportunities were limited, but IRM membership gave him access to a much wider
risk management community. ‘I brought my CV up to date, and sent it to the head of IRM’s
regional group in the north east of Scotland, asking them to send it to all their members.’ he
explained. ‘Before long, I was approached by the director of Harnser Group and offered a role
in Norwich. It’s given me the opportunity to work on some amazing projects.’
Adam was keen to develop a much deeper understanding of risk management theories
and practice. For the past two years, he has been studying IRM’s International Diploma in
Risk Management.
‘Harnser are specialists in security risk management, and keen to support me in becoming
qualified. As well as funding the Diploma, they have also given me half a day a week to study
during working hours. It’s a win-win for both of us – I’ve used concepts, processes and ideas
from the Diploma to add value to our client deliverables.’

24 | www.rmprofessional.com | Autumn 2014 |

RMPAut14 pp21-28 Diploma supplement.indd 24 10/09/2014 13:22


The time when we are treated like a
profession is when we act like a profession
Risk managers are under
growing pressure to prove
their competencies with
regulators and rating agencies,
write Amlin’s Alex Hindson and
Aviva’s Jose Morago
Alex Hindson
RMPAut14 pp21-28 Diploma supplement.indd 25
IRM – Qualified for today’s risks
T
he expertise and professionalism of staff in the financial services sector
came under question in the economic crisis of the late noughties.
Post-mortems showed not just wilful disregard of the rules by
employees, but plenty of examples of incompetence.
Since that crisis, legislators and supervisors have started to look a lot
harder at the people, as well as the process. The EU Directive Solvency II,
for example, requires that personnel have the skills, knowledge and
expertise to fulfil their responsibilities. Those holding key functions – such
as in the risk management or actuarial teams – must meet ‘fit and proper’
criteria. After the Paul Flowers debacle at the UK’s Co-operative Bank in
2013, regulators’ antennae are also increasingly attuned to these attributes
in the banking sector. The Banking Standards Review Council is charged
with ensuring banks and building societies commit to a programme of
continuous improvement in culture, competence and outcomes.
While actuaries have the benefit of well-known professional
qualifications – requiring evidence of continual development – risk
Jose Morago
management tends to be less formalised. Among those trying to change
that is the Institute of Risk Management (IRM).
The need for new skills
IRM has also broadened its focus to encompass wider support for the
profession of risk management, including certification of risk professionals.
The skills set for risk managers is clearly changing. Part of IRM’s work to
support them is the development of a professional standards framework,
due to be published at the end of 2014.
Financial institutions are being challenged externally, and not just
by regulators. Ratings agencies, too, are beginning to ask for proof of
competence as part of their focus on an organisation’s risk culture. At least
one European insurance regulator – while not formally endorsing IRM’s
Diploma – has suggested it would be suitable for proving a risk manager’s
credentials in an ‘appointed person’ regime.
The drive to professionalism
These changes provide an opportunity for people working in risk
management to ‘professionalise’ themselves. The time when we are
treated like a profession is when we act like a profession.
Whether there should be a specialist qualification for risk managers
working in different areas of financial services is an interesting question.
Risk management is a broad topic. People working in the sector may do
better to avoid specialisation, and learn universal principles and practice
that can be applied directly in any setting.
This is an edited version of an article that first appeared in Insurance
Enterprise Risk Management, June 2014 (www.insurancerm/com)
| Autumn 2014 | www.rmprofessional.com | 25
09/09/2014 13:00
 Industry snapshots
Banking and finance
Tighter regulation was in the pipeline for many countries even before 2008, but post-crash
EU and US regulation has radically reformed risk-governance frameworks. In other financial
hubs – such as Singapore – there is a movement to regulatory equivalence, particularly in
the insurance industry. Yet, according to a recent survey by EY (previously Ernst & Young),
many chief risk officers continue to battle to embed risk appetite successfully into business
decisions. Silo thinking on risk by many boards means risk professionals who are able to
explain clearly the principles, practice and impact of enterprise-wide risk management, will
have the competitive edge.

Energy
From Iraq to Russia, the energy industry has proved particularly vulnerable to geopolitical
unrest this year. In Europe, reconciling the tensions between environmental, output and
security risks continues to be an intrinsic part of the risk role.
Across the world, the energy industry faces ongoing volatility in commodity pricing, making
long-term investment more problematic. As much of the world emerges from austerity – and
high-growth economies resume their development – it is inevitable that energy demand will
accelerate. Experienced risk professionals in this field are among the most highly sought-after
in the world.

Law
The trend continues towards global expansion of law firms to meet the growing needs of
international clients. International mergers and growth are creating increasingly large and
complex organisations, establishing new structural and management risks. From cultural
diversity, consistency of service and different regulatory regimes, to information security and
data privacy requirements, new opportunities and threats are developing from recent entrants
to the sector and evolving business models.
Firms are becoming more sophisticated in their risk management practices, particularly
when managing conflicts of law and practice across jurisdictions. The role of general counsel is
evermore critical, and effective enterprise-wide risk management more challenging.

Construction
The 2013 study by Global Construction Perspectives and Oxford Economics forecasts global
construction growth of more than 70 per cent, reaching US$15tn by 2025. While this growth
will be disproportionately concentrated in China, the US and India, the end of austerity in
Europe is already leading to increased demand for housing, particularly in the UK.
Europe’s ageing infrastructure urgently needs updating, while governments are recognising
the vital role that transport infrastructure plays in economic growth. Large infrastructure
projects – including high-speed rail in the UK and continental Europe, major construction
projects in the Middle East, and new building from foreign direct investment (FDI) in many
African industries – indicate that the need for skilled risk professionals in this sector is on the
verge of a global boom.

26 | www.rmprofessional.com | Autumn 2014 |

RMPAut14 pp21-28 Diploma supplement.indd 26 09/09/2014 13:00

 IRM – Qualified for today’s risks

Regional snapshots
Africa
The ongoing geopolitical tensions in Nigeria, Kenya, Somalia and South Sudan are inevitably
affecting predictions for economic growth. There is corresponding demand for risk professionals
with expertise and experience in political risk, supply chain and business continuity.
However, the headlines obscure the fact that African businesses tend to avoid the leveraging
that brought many western institutions to the brink of collapse six years ago. FDI, particularly
from China, is meeting a strong culture of due diligence from domestic businesses ready to
expand. Large infrastructure projects in Kenya and Nigeria have recently been given the green
light. Mining, engineering and oil and gas are all set to expand across the continent, while
tourism in those countries with stable governance – such as South Africa – continues to be a
booming industry. While the domestic risk management profession in many African countries
is still in its infancy, the sheer diversity of regional industry is creating growing interest in risk
management as a profession.

Asia
Many countries in Asia are experiencing high levels of political risk. While Thailand is now
under military rule, India has its first majority government in 20 years, giving the ruling BJP the
freedom to make fundamental economic and social changes. While GDP growth in the region
has slowed in recent years, SMEs continue to grow. The liberalisation of Malaysia’s financial
services has brought in FDI, as foreign insurance companies make plans to enter these markets.
Telecoms, technology, financial services and manufacturing are thriving. The groundswell
of demand for improvements in the infrastructure and conditions of many factories has
added to the pressure on manufacturers to clean up their supply chains. Risk management is
moving up company agendas across the region, with demand outstripping the available pool
of risk professionals.

Europe
As Europe emerges from the 2008 financial crash, employment rates in most countries are
starting to climb, and consumers are buying again. The rise in online financial and retail
transactions has made cyber security a permanent priority, and governments and businesses are
joining forces to combat cyber crime.
The aftermath of the financial downturn has resulted in a slimmed-down financial services
sector in the UK, and an EU-wide focus on systemic risk. While EU regulations to strengthen
banks’ balance sheets have led to a slowdown in investment in SMEs, technology, services and
the professions are all resuming growth. However, sanctions against Russia are likely to slow
down economic recovery in the EU, as the impact on the cost and security of energy supply
becomes apparent during winter 2014/15.

Middle East
IRM’s conference in Dubai this year demonstrated the enormous appetite for risk management
in the region. From huge projects such as Dubai’s proposed Sheikh Zayed Road mall to Saudi
Arabia’s ambition to produce a third of its electricity from renewables by 2032, risk professionals
are in high demand. The rate of start-ups is also growing, offering greater opportunities for
those in the relatively early stages of their risk management careers. Qatar’s critical industries
are still oil and gas, but the 2022 World Cup has spurred further infrastructure development
and construction.
The chemicals, automotive, defence and maritime sectors are also experiencing an uplift, as
western economies emerge from austerity. States in the region are moving away from an
over-reliance on oil and gas, and increasingly diversifying to ensure continued economic growth.

| Autumn 2014 | www.rmprofessional.com | 27

RMPAut14 pp21-28 Diploma supplement.indd 27 09/09/2014 13:00

 MAG1708 IRM A4 Press Ad_FINAL.pdf 1 21/08/2014 15:41

Institute of Risk Management

MIND
THE
C

M
GAP
GET THERE FASTER.
Y

CM

MY

CY
GET RISK QUALIFIED WITH IRM.
CMY

Enrolment for the International

Diploma in Risk Management is
open from 1 October 2014
For more information:
studentqueries@theirm.org
+44 (0) 207 709 9808
www.theirm.org

RMPAut14 pp21-28 Diploma supplement.indd 28 09/09/2014 13:00

 analysis
SPACE TOURISM

As Virgin Galactic prepares to take

fare-paying passengers into space,
RichardBakerFarnborough / ALAMY

Mark Turner CIRM asks how the risks associated

with space tourism are being managed

I
magine – it is early 2015, and you and five fellow
passengers brace yourselves as the aircraft in which
you sit suddenly drops away from the mother
ship. As the sound of WhiteKnightTwo’s (WK2’s)
Pratt & Whitney jet engines fade, you feel the nose
of SpaceShipTwo (SS2) pitch upwards, and then the
gut-lurching fall is suddenly replaced by a massive
4G of pressure pushing you deep into your seat. The
vehicle shakes, and the sound of the rocket engine fills
the aircraft with a near-deafening roar. This is it. In 90
seconds’ time you will reach peak altitude and feel the
weightlessness of a sub-orbital space flight – officially
making you an astronaut.

| Autumn 2014 | www.rmprofessional.com | 29

RMPAut14 pp29-32 Virgin Galactic.indd 29 09/09/2014 13:00

 The technology to make this space-tourist flight
possible has reduced in price to such a point that it is
now viable for industry to compete in a domain hitherto
only available to superpower nations. With the UK
government forecasting that the global space market
will be worth £400bn by 2030, the rewards for business
are clear. But what are the risks associated with this, and
other, new space-tourist ventures – and how are they
being managed?
Rockets and space planes
Rocket technology developed rapidly in Germany during
World War II, with the creation of the first ballistic
missile – the V2. After the war, Russia and America both
made great strides in rocket development, culminating in
the 1969 Moon landing. Since then, many nations have
used rockets to put people into space.
However, these pioneering days of rocket travel
came at a significant cost to life: almost five per cent of
people attempting to travel into space have lost their
lives. Disasters on launch have been commonplace,
particularly in the early years. In addition, the stresses
30 | www.rmprofessional.com | Autumn 2014 |
RMPAut14 pp29-32 Virgin Galactic.indd 30
of take-off on the rocket have resulted in some terrible
accidents during re-entry, as witnessed in the Space
Shuttle Columbia disaster.
However, despite the risks, rocket technology has
remained the mainstay of space-delivery vehicles.
Then, in 2004, a private aircraft manufacturer, Scaled
Composites, successfully launched SpaceShipOne (SS1)
into sub-orbit, twice within a couple of weeks, to win the
US$10m Ansari X Prize as the world’s first commercially
built, reusable spacecraft.
Rather than using a rocket, the Scaled Composite
approach employed a much simpler, space-plane
technique. A ‘mother ship’ – WK1 – took off like a
conventional aircraft, but attached to its undercarriage
was the small SS1, which was taken to 50,000ft and
dropped. The craft then angled upwards, and ignited
the hybrid solid-fuel and gas engine, launching itself to
63 miles above the Earth to achieve sub-orbital flight.
In order to return to Earth, SS1 feathered its wings into
a ‘shuttlecock’ configuration, which slowed the craft
enough to allow it to drop into the thicker atmosphere.
Once the air had thickened sufficiently, it reconfigured its
09/09/2014 13:00

This new space race has
the potential to have a dramatic
effect on the way people take
holidays in the 21st century
Spaceport UK
In July, the British government announced that
it intended to start developing a UK spaceport,
with the intention of sending space planes into
sub-orbital flights. One potential vehicle for
use at this spaceport is being developed by UK
company Reaction Engines. Named ‘Skylon’,
this unpiloted space plane is designed to use
the British-invented Synergetic Air-Breathing
Rocket Engine (Sabre). This allows Skylon to
take off like a conventional aircraft, then rocket
itself into a sub-orbital trajectory. However,
unlike the Virgin Galactic up-and-down tourist
flights, Skylon would fly inter-continental routes,
VIRGIN GALACTIC
making it possible to travel from the UK to
Australia in two hours.
wings, and – like a glider – returned to the runway in the
Mojave Desert.
Seeing the intrinsic safety advantages of the
space-plane approach, Virgin Atlantic owner Sir
Richard Branson teamed up with the owner of Scaled
Composites, Burt Rutan, and Abu Dhabi’s Aabar
Investments PJS, to form Virgin Galactic.
In addition to the aircraft, Virgin Galactic promises to
deliver a unique experience, including astronaut training
at its purpose-built facility – designed by Sir Norman
Foster – at Space Port America, again in the Mojave
Desert. To date, the group has invested approximately
US$400m. While this may sound a lot, Branson points
out that it is equivalent to the cost of buying a new 747
aircraft from Boeing.
Setbacks and detractors
Virgin Galactic optimistically announced that the first
fee-paying passengers would be flying by 2010, but the
venture hit a major setback in 2007. During a ground
test of the equipment for the hybrid rocket engine, an
explosion killed three Scaled Composites technicians, and
RMPAut14 pp29-32 Virgin Galactic.indd 31
ANALYSIS
SPACE TOURISM
injured three more. Since then, a number of concerns
have been raised about the viability of the endeavour.
Supersonic, high-altitude test flights of SS2, in 2013
and 2014, resulted in reports – in newspapers and online
– about the original engine’s ability to achieve the desired
peak altitude of 62 miles. In May 2014, Virgin Galactic
announced that it was changing the fuel type in SS2 in
order to achieve the minimum guaranteed altitude of 50
miles. However, even this late change in technology has
done little to assuage the critics.
In addition, there have been reports that cracks have
been discovered in the wings of WK2. While these
have been dismissed as ‘adhesive imperfections’ by
Virgin Galactic, it is yet another demonstration of the
risks associated with this cutting-edge, carbon-fibre
technology, and the close scrutiny of Virgin Galactic by
the world’s media.
Risk appetite and regulatory control
The Virgin Galactic space plane is deemed to be an
aircraft for much of its trip, so its flights within US
airspace are regulated by the Federal Aviation Authority
(FAA). Appreciating the experimental nature of the
space-plane approach, the FAA has taken a ‘hands-
off’ attitude to regulating the development of the
technology, allowing for a learning period. By law, the
FAA cannot impose safety regulations on space-tourism
flights until October 2015 – with certain exceptions to
protect other airspace users – and all fliers are deemed
to be ‘participants’ rather than ‘passengers’, who fully
understand the risks involved.
However, the balance between the risk of space
flight and regulatory control is currently being hotly
debated in Washington, at NASA, and in the wider
aerospace community. In Rand Simberg’s contentious
book Safe Is Not An Option, published in 2013, the
author – an aerospace engineer – argues that NASA’s
obsession with ‘bringing everyone back alive’ has
stifled space exploration for the past 40 years. The
aforementioned five per cent loss of life is considered
to be significantly less than might be expected for
such a boundary-pushing endeavour. He argues, while
nobody wants to see astronauts killed, as with all forms
of transportation, it almost has to be expected. The big
difference with space travel is the very public way in
which disaster is likely to occur, as well as the political
fallout that inevitably follows.
The reputational risk faced by Virgin Galactic is
somewhat different from that experienced by NASA, and
this has been recognised by the company from the outset.
It has virtually to guarantee that all its passengers will stay
alive; even one fatality at this early stage of development
could destroy the future of the business. In addition,
| Autumn 2014 | www.rmprofessional.com | 31
10/09/2014 13:17

Sir Richard Branson and Burt Rutan after
Virgin Galactic breaks the speed of sound
Virgin Galactic virtually has to
guarantee its passengers will stay
alive; one fatality could destroy
the future of the business
with passengers paying upwards of US$250,000 for the
privilege of flying, this failure is really not an option.
The space-plane approach adopted by Virgin Galactic
is considered many times safer than other technologies
for launching into space. By taking the spacecraft high
into the atmosphere before igniting the engine, not
only is it less risky for the passengers and ground crews,
but significantly less fuel is required to achieve a sub-
orbital flight. The size and complexity – as well as cost
– of the craft has been markedly reduced through the
extensive use of carbon fibre in the design of WK2 and
SS2. The hybrid rocket engine uses hydroxyl-terminated
polybutadiene (HTPB) as a fuel grain, and nitrous oxide
as an oxidiser.
This design enables the rocket to be throttled,
significantly reducing the risk associated with
conventional liquid-fuel rockets, or solid boosters,
which – once ignited – cannot be extinguished.
The ‘shuttlecock’ wing configuration also materially
contributes to the overall safety of the design, by doing
away with parachutes or heat shields. All these attributes
help to ‘de-risk’ every stage of the flight.
32 | www.rmprofessional.com | Autumn 2014 |
RMPAut14 pp29-32 Virgin Galactic.indd 32
analysis
SPACE TOURISM
Mark Greenberg / Virgin galactic
Apart from the technical developments, the pilots
have been able to gain hands-on experience with the
aircraft as it manoeuvres and transitions from plane to
spaceship. Such experience would not be possible with
a conventionally launched spacecraft, thus giving Virgin
Galactic confidence in the human element of the flight.
Once testing is complete, Branson and his children
will be among the first passengers. It is certain, therefore,
that the risks will have been minimised as far as possible.
The sky’s the limit
Beyond the sub-orbital flights planned by Virgin Galactic,
several entrepreneurs are looking to the next step in
space tourism. Fancy spending a few evenings with the
Earth revolving outside your bedroom window? Look
no further than Russian company Orbital Technologies,
which is planning the world’s first orbiting hotel, to
be placed into the heavens as early as 2016. Not high
enough for you? Then Bigelow Aerospace may be your
supplier of choice. With experience gained from placing
inflatable extensions onto the International Space
Station, the US company wants to site giant inflatable
habitats on the moon, for commercial and industrial
purposes. These businesses – plus many more – are
rapidly developing the technology to open up space
tourism for those who can afford it.
This new space race has the potential for a dramatic
effect on the way people take holidays in the 21st
century. The risks associated with such adventures are
currently high; however – just as with the dawn of
commercial air travel in the 20th century – financial
investment and time will bring those risks to the point
where hopping onto a space plane will be as common
as taking a plane from London to New York.
09/09/2014 13:01

Handle with care
recently published NHS data signal a warning for the medical devices industry
about inflated expectations of patients, explains Peter Rudd-Clarke
O
f the many complex risks
faced by the medical
devices industry, recent
NHS data show that
one problem may be impossible to
eradicate: the expectation of patients
that their new prosthesis will be as
good as their original limb.
People who undergo elective
hip- and knee-replacement
surgery are asked to complete a
questionnaire before and after their
operation. These patient reported
outcome measures (Proms) assess
improvement in health as perceived
by the patient. Their subjective view
is collated – together with objective
data recorded by their doctors – to
assess the functionality of medical
devices after surgery.
The latest Proms – published on
14 August – reveal that there can
be remarkable differences between
a patient’s view of the performance
of a medical device and their
objective performance.
Taking knee replacements as
an example, 45.6 per cent of
questionnaire respondents – when
comparing the state of their health
before and after surgery – reported
that they had not experienced any
increase in their general health.
However, when the health of
patients before and after surgery
was compared against objective and
established scoring criteria – the
Oxford Knee Score – the condition
wavebreakmedia / shutterstock
of 93.1 per cent of patients was
found to have improved.
Lessons
What does this tell manufacturers
of prosthetic devices? Compared
to other products, there is a
RMPAut14 pp33 Legal.indd 33
human aspect to consider when
it comes to medical products. This
is particularly important to bear in
mind if a manufacturer is sued by
a patient who considers that the
medical device implanted in their
body is defective.
The Proms data suggest that
emotion will play a part if a dispute
arises over the performance of a
medical product, and that some
patients may expect too much
from orthopaedic devices that can
– at best – only attempt to restore
functionality in a patient who
may have other complex medical
conditions. Allegations of failure may
be based on pain, which is difficult
to measure, or the discomfort of
further medical intervention to
replace a device that the patient
simply feels has not worked – further
underlining the fact that the cause
of a patient’s disappointment may
not be the device itself, but the
patient’s co-morbidities.
A patient’s reaction may also be
affected by media reports criticising
particular medical devices. If publicity
raises expectations of a device or
legal analysis
claims
procedure beyond reasonable levels
– or a patient is led to expect the
worst – then they are more likely
A patient’s to form a negative view of their
condition. Claimant law firms are
reaction well placed to capitalise on such
may be reports, thus fanning the flames of
affected the ‘Daily Mail effect’.
by media Response
reports What should manufacturers, and
their insurers, do to cater for this
human factor and media interest?
Claims brought by patients
against manufacturers should be
treated carefully. To determine
the merit of a claim, insurers and
lawyers should put claimants to
proof. Objective criteria can measure
whether a medical device has failed.
For example, the Oxford Knee
Score assesses whether a prosthesis
Peter
has improved a patient’s ability to
Rudd-Clarke
is a senior perform day-to-day tasks – such
associate at as using public transport or going
City law firm shopping. Expert medical opinion
RPC. Contact can review statements over the
peter.rudd-
clarke@rpc.
alleged defectiveness of a device,
co.uk which may be based purely – or in
part – on a patient’s subjective or
‘gut’ feeling.
If a manufacturer faces more
than a handful of isolated claims,
and is forced to deal with litigation
involving multiple claimants – as
well as critical media coverage
– well-timed statements using
objective data to demonstrate the
effectiveness of a medical device
may go a long way to reassure
worried patients. Last month’s Proms
data show that disputes, involving
a mix of complex medical devices
and patient expectation, must be
handled with care.
| Autumn 2014 | www.rmprofessional.com | 33
09/09/2014 13:01
 The case
for
leadership
David Hancock calls for a greater focus from risk
professionals on the softer behavioural aspects of risk
We’re better at predicting events
at the edge of the galaxy or inside the
nucleus of an atom than whether it’ll
rain on auntie’s garden party three
Sundays from now – because the
problem turns out to be different. We
can’t even predict the next drip from a
dripping tap when it gets irregular. It’s
the best possible time to be alive, when
almost everything you thought you
knew is wrong
From Arcadia,
by Tom Stoppard
T
he general perception that through the application
of the risk management process we can somehow
control the future is, in my opinion, one of the
greatest misconceptions in our understanding of
risk. However, we have made at least two advances in the
right direction. Firstly, we can have a better understanding
around the likelihood of unpleasant surprises and – more
importantly – we are learning how to pre-empt their
occurrence early and, subsequently, be better able to
manage the consequences should they occur. However,
I feel that the time is right for risk management to move
34 | www.rmprofessional.com | Autumn 2014 |
RMPAut14 pp34-37 The case for risk leadership.indd 34
away from a statistical and numerical bias to focus
on the ‘softer’ behavioural aspects of risk. This,
of course, will come as no surprise to a few risk
management professionals, many of whom are
aware that the early stages of risk’s development
has tended to be dominated by the worlds of
mathematics and engineering.
Frank Knight distinguished between three
different types of probability, which he termed
‘a priori probability’, ‘statistical probability’ and
‘estimates’. The standard example of the first
type is the odds of rolling any number on a dice.
Where the probability of occurrence is known
specifically – that is, if there are n mutually exclusive
and exhaustive events, and if they are equally likely,
then the probability of a given event occurring is 1/n; for
a six-sided dice, n = 6 and the probability of throwing any
single number becomes 1/6. There is no debate or opinion
around this outcome and we accept it unconditionally.
The second type – statistical probability – identifies
probability with relative frequency over a long series of
events, or the proportion of an event in a large population.
In this case, we need to have observed enough relevant
Tribalium / shutterstock
data to enable us to make predictions.
However, there is a third type, when there is no valid
basis of any kind for classifying instances; here, then, only
estimates can be made. In this final case, the use of any
kind of statistical analysis would be meaningless. This
becomes increasingly relevant where we are dealing with
09/09/2014 13:02
 focus
SOFT SKILLS

The time is right for

risk management to move
away from a statistical and
numerical bias to focus
on the ‘softer’ behavioural
aspects of risk
| Autumn 2014 | www.rmprofessional.com | 35

RMPAut14 pp34-37 The case for risk leadership.indd 35 09/09/2014 13:02

 Feynman. Meanwhile, risk management appears largely to
have remained stuck to those early principles of the 1950s
What we really need to that predominantly rely on process, models, policy and
develop are great risk leaders legislation. In my view, it is time for us to move on.

who understand that risk is more
of an art than a science
so-called ‘Black Swan’ events that, by their very nature, lack
the availability of a high level of statistically-relevant data.
Most risk management practised today focuses
predominantly on the first two types of probability: either
that the outcomes are known definitively, or that there
is an underlying number or ‘truth’ that can be found
simply by further data analysis and interpolation. This type
of uncertainty is termed ‘epistemic’. It is due to a lack
of knowledge about the behaviour of the system. The
epistemic uncertainty can – in principle – be eliminated
with sufficient study and, therefore, expert judgements
may be useful in its reduction.
However, the third type of risk – that of ‘aleatoric’
uncertainty – arises because of natural, unpredictable
variation in the performance of the system under study.
The knowledge of experts cannot here be expected to
reduce this type of uncertainty, although their knowledge
may be useful in quantifying the uncertainty. This is the
part that present risk practices tend to ignore or overlook
with their concepts of Risk = Likelihood x Consequence
equations. These types of problems have already been
encountered in the worlds of science, mathematics, and
economics, creating a shift towards a more behavioural
understanding – the so-called ‘new sciences’ – led by
eminent scholars in the field, such as Einstein, Lorenz and
Boston Matrix
re
tu
Tame, messes and wicked problems
One of the first areas to be investigated is whether our
current simple classification and use of risk is a correct
assumption. The general view, at present, appears to
treat the system under review as linear, deterministic and
predictable, in which a complex system or problem can be
reduced into simple forms for the purpose of analysis. It
is then believed that the analysis of those individual parts
will give an accurate insight into the working of the whole
system, supporting the strongly-held feeling that science
will explain everything.
However, this type of problem – which can be termed
‘tame’ – appears to be only part of the story when it
comes to defining our risks. Tame problems are those that
have straightforward, simple linear causal relationships and
can be solved by analytical methods – sometimes called
the cascade, or waterfall, method. Here, lessons can be
learned from past events and behaviours and applied to
future problems, so that best practices and procedures can
be identified.
In contrast ‘messes’ have high levels of system
complexity and are clusters of interrelated or
interdependent problems. Here, the elements of the
system are normally simple, with the complexity lying in
the nature of the interaction of its elements. The principal
characteristic of these is that they cannot be solved in
isolation, but rather need to be considered holistically.
Using strategies for dealing with messes is fine, as long as
most of us share an overriding social theory or social ethic;
if we don’t, we face ‘wickedness’.
‘Wicked’ problems are termed as ‘divergent’ – as
opposed to ‘convergent’ – problems. Wicked problems
are characterised by high levels of behavioural complexity.
Here, uncertainty as a dominant factor is replaced by

Resolution
Fu
t

ambiguity – there is no optimum answer, just a series

en

is social/
m

High Wicked
ss

Wicked of ‘satisfactory’ solutions. What confuses real decision-

t

political/
se

en

mess
as

ethical/ moral/
e

ss
tiv

making is that behavioural and dynamic complexities

se

behavioural
ita

Ambiguity
as
al

e
iv
qu

co-exist and interact in what we call ‘wicked messes’.

at

Behavioural
on

tit
an
e

Dynamic complexity requires high-level conceptual and

nc

complexity
qu
lia

on
re

systems-thinking skills; behavioural complexity requires

g

e
sin

nc

Solution is
lia
ea

Low Tame Mess

high levels of relationship and facilitative skills. The fact that
re

scientific
cr
In

g
sin

problems cannot be solved in isolation from one another

ea
cr
In

makes it even more difficult to deal with people’s differing

st
Pa

Low High assumptions and values; people who think differently must
Dynamic systems complexity learn about and create a common reality, one which none
Uncertainty of them initially understands adequately.
Figure 1: Boston Matrix, showing the four problem types – adapted The main thrust to the resolution of these types of
from Roth and Senge problems is stakeholder participation and ‘satisficing’.

36 | www.rmprofessional.com | Autumn 2014 |

RMPAut14 pp34-37 The case for risk leadership.indd 36 09/09/2014 13:02


Many risk planning and forecasting exercises are still being
undertaken on the basis of tame problems assuming the
variables on which they are based are few, fully understood
and able to be controlled. However, uncertainties in
economics, politics and society have become so great as to
render counterproductive – if not futile – this kind of risk
management, which many organisations still practice.
Chaos and risk
At best, I believe problems under scrutiny should be
considered as deterministic, chaotic systems rather than
tame problems. Here, I am not using the term ‘chaos’
as defined in the English language, which tends to be
associated with absolute randomness and anarchy (Oxford
English Dictionary describes chaos as ‘complete disorder
and confusion’) but based on the chaos theory developed
in the 1960s. This theory showed that for systems with a
degree of feedback incorporated into them, tiny differences
in input could produce overwhelming differences in output
(the so-called ‘butterfly effect’, Gleick 1987).
Here, chaos is defined as ‘aperiodic’ (irregular) banded
dynamics (a finite range) of a deterministic system
(definite rules) that is sensitive to initial conditions. This
appears to describe real-life events much better than the
linear deterministic and predictable view, in which both
randomness and order can exist simultaneously within
those systems. The characteristics of this type of problem
are that it is not held in equilibrium, either among its parts
or within its environment, and the system operates ‘at the
edge of chaos’, where small changes in input can cause the
system to either settle into a pattern or, just as easily, veer
into total discord.
For those who are sceptical, consider the failing project
that receives new leadership – it can just as easily move into
abject failure as settle into successful delivery and, at the
outset, we cannot predict with any certainty which one will
prevail. At worst, they are wicked messes.
Conclusion
How should the risk professional exist in this world of
future uncertainly? Not by returning to a reliance on
quantitative assessments, statistics and determinism, where
none exists. We need to embrace its complexities and
understand the type of problem we face. To address risk in
the future tense, I believe we need to develop the concept
of ‘risk leadership’, which consists of:
n Guiding rather than prescribing
n Adapting rather than formalising
n Learning to live with complexity rather than simplifying
n Inclusion rather than exclusion
n Leading rather than managing
The implications of the new concept of risk leadership are
described in the table (right).
RMPAut14 pp34-37 The case for risk leadership.indd 37
focus
SOFT SKILLS
Risk management Risk leadership
1.Works to a defined scope, budget, quality Recognises the possibility of different
and programme. outcomes and tries to ensure risk activities
focus on making an acceptable outcome more
likely.
2.Uses the instrumental lifecycle image of Uses concepts and images that focus on social
risk management as a linear sequence interaction among people, understanding
of tasks to be performed on an objective the flux of events and human interaction,
entity, using knowledge and procedures. and the framing of events within an array of
social agenda, practices, stakeholder relations,
politics and power.
3. Manages process to ensure complicated Develops team behaviours and confidence
projects of people and technology run through scenario planning and team
smoothly. building to identify and respond to risks and
opportunities.
4. Establishes detailed steps, processes and Understands the ‘many acceptable futures’
timetables. proposition and manages risk to produce the
changes needed to achieve the acceptable
outcomes.
5. Applies concepts and methodologies that Applies concepts and frameworks that focus
focus on risk management for creation on risk management as value creation,
or improvement of a product, system while aware that ‘value’ and ‘benefit’ will
or facility, and so on, monitored and have multiple meanings linked to different
controlled against specification (quality), purposes.
cost and time.
6. Attempts to control risk by monitoring Adapts the risk process to overcome political,
results, identifying deviations from the bureaucratic and resource barriers to
plan and developing mitigation actions to developing change in behaviours, through
return to plan. trust and managing expectations.
7. Works on the assumption that the risk Is based on the development of new risk
model is the actual ‘terrain’ (that is, the models and theories that recognise the
actual reality ‘out there’ in the world). complexity of risk and its management and
that the model is one part of a complex
‘terrain’.
8. Implementer of the risk process. Training Is a reflective listener: learning and
and development produces practitioners development facilitates the development of
who can follow detailed procedures and reflective practitioners who can learn, operate
techniques. and adapt effectively in complex environments
9. Seeks predictability and order. Has learnt to live with chaos, complexity,
ambiguity and uncertainty, and leads, through
example, to a successful conclusion.
What does this all mean?
This means we must apply a new approach for risk
management when dealing with problems that are
not tame.
Also, that we should seek to enhance our
Dr David understanding of the behavioural aspects of the profession
Hancock MBA and move away from a blind application of process and
CEng FCIPD generic standards towards an informed implementation of
FAPM is head loose guidance.
of risk and But what we really need to develop are great risk
benefits at leaders who understand that risk is more of an art than a
Transport for science, and that this, truly, is the best time to be alive and
London (TfL) working in risk – at a time that, perhaps, almost everything
we thought we knew may just turn out to be wrong.
| Autumn 2014 | www.rmprofessional.com | 37
09/09/2014 13:02
 book
review

Opening up
Risk-based performance
the silos use of the three indicators make it clear that the only
management: integrating strategy way to achieve a targeted, strategic ‘sustainable (and
and risk management defendable) position – which enables the organisation
(Palgrave Macmillan) to achieve its objectives while operating within defined
By Andrew Smart and James Creelman risk appetite boundaries’ – is through integrating strategy
and risk management.
By looking at how to The authors include an ‘appetite and exposure
integrate strategy and alignment matrix’. This amalgamation of strategy and
risk management, risk management provides a simple way of showing
Smart and Creelman non-risk professionals how, together, risk management
have made a and strategy can deliver tangible value. They provide
significant contribution examples of firms using the matrix to save money,
towards helping where they are underexposed, by reducing risk controls,
risk and strategy or pursuing profitable opportunities due to their
professionals improve superior risk-management capabilities. These are strong
their organisations’ arguments for the as-yet-unconverted to bring together
performance by risk management and strategy.
strategically reducing
risk. The book is quite Integration
academic, with detailed Despite the strength of the authors’ case, I suspect it
analysis of risk and will be several more years before more firms take the
strategic concepts plunge and truly integrate the two disciplines. Many
and frameworks. organisations say they integrate strategy and risk
More robust editing – and integrated case studies management; some even make a big deal of this in
incorporating all of their recommendations – would their external communications. However, in practice,
have helped to make it an easier read but, that said, the these functions are usually managed by two separate
authors present some powerful tools that help move the teams, with distinct reporting lines to the executive
risk profession forward. management team and the board. Often, the closest
Where the book really comes into its own is in strategy and risk teams actually get to working together
discussing key risk, performance, and control indicators. is when the strategy team provides content to the
Particularly insightful is the analysis of the interplay risk section of the annual report, or when the risk
between the three indicators, and how they combine management team provides limited content to senior
to drive strategy execution and risk management to management strategy sessions.
achieve a set strategy. Examples of integrating the True integration is overdue for many. For those
forward-looking companies aiming to integrate risk
management and strategy, this book is a useful guide to
These are strong arguments for the bringing that date forward.
as-yet-unconverted to bring together risk Erik Johnson MIRM ACII is assistant vice-
management and strategy president, business development, at Allied
World Assurance Company (Europe).

38 | www.rmprofessional.com | Autumn 2014 |

RMPAut14 pp38 Books.indd 38 09/09/2014 13:03


GLOCAL HERO
IRM BOARD DIRECTOR NICOLA CRAWFORD FIRM REFLECTS ON ‘GLOCALISATION’
AND THE CHALLENGES IT PRESENTS TO RISK PROFESSIONALS
A
s the summer draws to an end, I am reviewing
the menu in a Turkish resort, considering what
constitutes a ‘full English’ breakfast, costing £1.
The Turks have adapted their services to
cater for UK tourists, even pricing food in sterling rather
than lira. Bacon is not included, replaced instead by a
version of chicken ham – reflecting the availability of certain
meats driven by cultural differences. This is an example of
local services adapted to meet global needs. But does this
happen in the other direction? And how are risks and their
management affected by the concept of ‘glocalisation’?
Blending ‘local’ and ‘global’, the terms ‘glocal’ and
‘glocalisation’ have been adapted by the business world
to refer to ‘global localisation’. The term was modelled on
the Japanese word ‘dochakuka’, which meant adapting
farming techniques to one’s own local condition.
Glocalisation of risk is, therefore, concerned with
understanding and managing risks arising from local
conditions that could have a global impact, and/or risks
that are global in nature but have a specific local impact at
an industry- or business-specific level.
Global localisation
The 21st century has spun a worldwide web of
interdependencies. People from practically all societies are
confronted with aspects of other cultures through tourism,
the media and consumer goods. This has led to significant
benefits – including growth in incomes, education,
innovation, and technology. But it has also created unease.
What were once considered independent and unrelated
risks are now interconnected, more complex and systemic.
The types of risk include: economic and financial; global
pandemic; infrastructure; supply chain; food security; and
geo-political. They can affect local functioning of firms
operating worldwide, but can also be the source of local
risks with a global impact. How can we manage them?
We have to acknowledge that we live in a world
characterised by multiplicity, uncertainty, ambiguity and
ambivalence. Accordingly, we have to learn to manage the
differing risk appetites that these factors bring.
Glocalisation may offer enterprises exciting opportunities
in emerging markets – but it can also introduce complex
challenges. These include:
A shifting risk profile – The increased scale of
globalised operations is matched by the level of risk,
RMPAut14 pp39 Directors cut.indd 39
irm focus
DIRECTOR’S CUT
ranging from fluctuations in interest and exchange rates to
IRM board supply chain piracy. As these risks become more strategic,
director Nicola they often involve greater levels of uncertainty that can
Crawford hit capital investments. Firms, therefore, need a more
FIRM is comprehensive risk framework and the ability to analyse
managing scenarios and model specific risks and costing options.
director of Regulatory obstacles – Fast-changing regulations and
i-Risk Europe, local policies can have a dramatic effect on the profitability
and chair of of cross-border investments, heightening uncertainty in
IRM’s regional rapid-growth markets. By adopting a global platform and
group in capability for managing the risk portfolio, greater visibility
Turkey can be gained into the procedures for overcoming regional
barriers – and for developing suitable contingency plans.
Cultural differences – Managing workforces when
operations are separated by distance, time zones, cultural
and religious differences can be a challenge. The central
organisation must be able to refine its risk management
capability and create an infrastructure that both maintains
the diversity of international teams, and allows local delivery.
Resource constraints – Increased competition for
talent often results in skills shortages in key areas. This
creates demand for effective training and development of
local resources in key risk management areas.
IRM is well placed to support both global enterprises
and local companies to reach the capability required to
manage risks arising from globalisation and glocalisation.
However, like any other enterprise expanding globally,
there is a challenge in mastering the trade-off
between localisation to match local requirements and
standardisation to realise economies of scale.
The customisation of IRM qualifications and services to a
region is called localisation, but glocalisation is the standard
to which the IRM should aspire. To this end, IRM’s regional
group structure allows cultural, linguistic, political, religious
and ethnic affiliations to be simultaneously researched and
integrated into one solution. In this manner, the intended
region and market is given a stake in the process, and not
just in the end result.
What were previously considered
independent and unrelated risks are now
interconnected, more complex and systemic
| Autumn 2014 | www.rmprofessional.com | 39
09/09/2014 13:04
 virtual but vital A model
MAksiM kABAkou / shutterstoCk

IRM’s new free webinar service covered subjects including

solution for
is a real find for time-poor risk
professionals keen to keep
crisis reputation management,
the critical stages involved in
insurance
up to speed. Launched in effective decision-making, and While Solvency II is still
June, these 45-minute online business risk and resilience. – officially – scheduled
presentations feature some of Catch up with previous for implementation in
our most popular trainers and sessions and find out what’s January 2016, the use
topics. coming up at www.theirm.org/ and validation of internal
so many products, Webinars so far have training/webinars/ risk models remains a
so little knowledge potentially confusing issue.
Despite the launch of more IRM’s practitioners’ forum
than 70 new cyber insurance is currently undertaking
products in the last two years, research to identify proven
80 per cent of UK businesses good practice, with results
are still without it.
The evolution of cyber due to be presented at a
threats has created gaps forthcoming forum.
in existing products and For more information
uncertainty around policy see www.theirm.org/
wording. IRM’s one-day
knowledge-and-resources/
Cyber Risk and Insurance
conference in London on 27 thought-leadership/creating-
October focuses on practical value-through-internal-
guidance from industry models/
leaders and experts to
analyse your needs, explore

risk Leaders 2014 – tackling

your options and resolve the
uncertainty. Find out more
at www.theirm.org/events/
cyber-risk-and-insurance-the-
risk-managers%E2%80%99-
forum/
economic resilience
As Italy falls back into
recession and other countries
waver on the edge, the OECD
has published a report into
how effective risk governance
can boost economic resilience
to shocks.
The report – Boosting
resilience through innovative
risk governance – references
IRM’s risk appetite
principles, and explores risk
management and global
corporate governance in
several jurisdictions. Find it at
today’s business threats
As European farmers, American
drugs companies and foreign
investors in Russia are currently
finding out, the unpredictability
of this year’s business risks
provides a compelling argument
for tackling them at board
level. IRM’s Risk Leaders 2014
conference brings together
chief risk officers, heads of risk
and those responsible for risk
at board level to share their
experiences, discuss strategy and
results of this month’s Scottish Transport non-executive director
referendum, the Atomic Mary Reilly will evaluate the
Weapons Establishment will common challenges facing risk
explain how it prioritises risk at leaders across industry.
board level. And, as the EU calls for
In addition, Department for tougher enforcement of
antitrust rules, Lord Currie,
chair of the Competition and
Markets Authority, will open
the conference by analysing
the risks of falling foul of
competition law.
The day concludes with
ANDY BuChANAN / ALAMY

IRM’s online resource centre or develop solutions. an entertaining and universal

via the OECD library at
www.oecd-ilibrary.org/
governance/boosting-
resilience-through-innovative-
risk-management
_9789264209114-en
The conference takes place risk perspective from BBC and
at the Inmarsat conference Channel 4’s NASA and the NHS
centre in London on 11 expert, Kevin Fong.
November. With the future For more information, visit:
of Trident decided by the www.theirm.org/events

40 | www.rmprofessional.com | Autumn 2014 |

RMPAut14 pp40-43 RG & SIG News.indd 40 09/09/2014 13:04

 irm focus
news

Training Focus:

The haves
and the
have-yachts
Christos Georghiou / shutterstock

IRM trainer Liz Taylor

admits she may well
have watched too many
James Bond movies. In
her popular – but
intensive – two-day

Unravelling a tangled web Practical Risk Appetite

From hacking attacks
affecting major online
retailers to the impact of
sanctions, it is clear that
the days of self-contained
businesses are over. Today’s
organisations rely on a
complex and interconnected
web. They operate in a world
increasingly characterised
by volatility, uncertainty, complexity in 21st century
complexity and ambiguity. organisations guide will
A wide range of experts be launched at a one-day
have been involved this conference on 9 October
year in researching and and will be available to IRM
compiling one of the most members via our website
comprehensive guides to shortly afterwards. Full
date for managing these details at: www.theirm.
risks. IRM’s Extended org/events/extended-
enterprise: managing enterprise-2014/
Facing new
competition
course, students are
given an aspirational exercise that involves
playing the board of the super yacht builder
Moonray Ltd.
It builds glamorous, high-end vessels, the
kind that attract more than their fair share of
risks. Its designers and specialist engineers are
among the world’s best, and customers in the
Middle East and Asia Pacific are flocking to buy.
On the downside, it is carrying a lot of debt,
relies heavily on CAD, and both timing and
communication are critical.
Working in groups, students take different
roles on the board. Together, they make
decisions on risk appetite and tolerance,
determine business drivers and the complexities
of numerous stakeholder requirements. They

risks
With the move to tighten
competition law enforcement
across Europe, IRM is working
with the UK Competition
and Markets Authority to
raise awareness of the risks
of contravention. We will be
A night to remember publishing our joint guidance
From Australia to China, Turkey to Ghana, in the coming months. In the
the entries for IRM’s Global Risk Awards keep meantime, any IRM members
coming in. The 2015 Awards, held in London who would like to help by
on 19 February, look likely to be the biggest
reviewing and commenting on
yet. Full details of categories and how to enter
are available on the website: www.theirm.org/ this guidance please contact
events/global-risk-awards-2015/ Carolyn Williams at Carolyn.
Williams@theirm.org
then develop a strategic risk register, undertake
key risk-mapping, risk scenarios and root
cause analyses. As with any exercise involving
role play, students tend to end up inhabiting
their role on the Moonray board with total
commitment.
Practical Risk Appetite is a challenging
course. Both the volume and level of content
are high, yet student feedback is consistently
of the ‘Eureka’ kind – even if the yachts must
remain forever imaginary.
n The next Practical Risk Appetite course takes
place in London on 7 October. Contact:
training@theirm.org for more details. For
information on all IRM short courses visit
www.theirm.org/training/all-courses/

| Autumn 2014 | www.rmprofessional.com | 41

RMPAut14 pp40-43 RG & SIG News.indd 41 09/09/2014 13:04


cyber impact
The majority of cyber security
research featured by the
Centre for the Protection of the
National Infrastructure (CPNI)
focuses on prevention. Recently,
however, it has been looking at
the broader risks involved, and
the types of business impact on
victim companies.
A report commissioned from
Oxford Economics provides
useful findings on the business
impact of cyber breaches. This
is particularly useful for risk
professionals looking to build a
model that can quantify cyber
risk in a more meaningful way.
It can be found at www.cpni.
gov.uk/advice/cyber/Cyber-
risk-and-business-impact/
irm focus news
annual Lecture 2014 in Berlin. Many IRM members contact its secretary,
will have read his fascinating David Adamson, at
Gut instincts – books on risk perception and david.adamson@bsigroup.com
fundamental or communication, and followed
his debates with Kahneman
flawed? and Twersky about whether our
We are delighted to announce gut instincts are fundamentally
that Professor Gerd Gigerenzer reliable aids to decision-making
will deliver IRM’s annual lecture or hopelessly prone to biases
on 2 December. Gigerenzer, and flaws. For more details, visit
who is an Honorary Fellow www.theirm.org/events/annual-
of IRM, is director of the Max lecture/
Planck Institute for Human
Development and of the contribute to raising
Harding Centre for Risk Literacy a moving experience
British standards All change at IRM HQ. We have
The RM1 UK Committee run moved to new offices, with
by BSI (the British Standards an improved and integrated
Institution) is currently reviewing training suite. From 12
its membership to ensure it fully September our new address
represents those working in risk is: IRM, 2nd Floor, Sackville
in both businesses and the public House, 142–149 Fenchurch
sector. IRM members who would Street, London EC3M 6BV. Our
like to nominate themselves for telephone numbers and email
the committee are invited to details stay the same.

regionaL groUPs/sPeciaL inTeresT groUPs

The doctor can see you now
The UK North East regional group is running
a series of ‘risk clinics’. These three-hour
roundtable events are open to everyone
interested in sharing experiences and
knowledge around risk management.
The next roundtable, ‘Getting value from
AGehriG / shutterstoCk

QQ7 / shutterstoCk

risk management’, takes place in Sheffield

Regional groups
swiss action
The Swiss regional group’s next meeting will
host a presentation on the findings of the
IRM’s Extended Enterprise report, a discussion
on the challenges of modelling operational
risk, and career path research on what it takes
to be a chief risk officer. The meeting takes
place on 22 September in Zurich.
The following meeting on 17 November
JoN Le-BoN / shutterstoCk
on 6 October. It will look at the difficulties
risk professionals encounter in embedding
risk across their organisations, with insights
from both an internal auditor and a previous
auditor who jumped ship to join the risk
management team. See the group’s webpage
for more information at www.theirm.org/
events/regional-groups/north-east-england/
Special interest groups
insurance insight
The ERM in insurance special interest group’s
next meeting on 30 October will be looking
at ERM maturity levels, their pros and cons,
and the training needed to achieve targeted
levels. On 20 November, the group will be
discussing the sometimes-vexed question
of the relationship between the risk and
compliance functions.
The ERM in insurance annual survey,

– again in Zurich – will explore safety risk seeking member priorities for the next year,
management in air traffic management and is open until the end of September. Give
‘the absurdity of root-cause analysis of risk your views at www.surveymonkey.com/s/
events’. See the website for more details at ERMinInsurance2014 Find out more about
www.theirm.org/events/regional-groups/ the group’s work at www.theirm.org/events/
switzerland/ special-interest-groups/erm-in-insurance/

42 | www.rmprofessional.com | Autumn 2014 |

RMPAut14 pp40-43 RG & SIG News.indd 42 09/09/2014 13:04

 The
The Institute
Institute of
of Risk
Risk Management
Management –
– Events
Events
The Institute of Risk Management – Events

Extended

2O14
2O14
Extended Extended

2O14
Enterprise

2O14
Enterprise Enterprise
Managing
Managing risk
volatility,
risk in
in the
the world
uncertainty,
world of
of ‘vuca’
‘vuca’
complexity and
Managing risk in the world of ‘vuca’ volatility,
Managinguncertainty, complexity
risk in the world and ambiguity
of ‘vuca’ ambiguity
volatility, uncertainty, complexity and ambiguity volatility, uncertainty, complexity and ambiguity
ALL
ALL WILLWILL BE BE REVEALED...
REVEALED...
IRM’s Global Risk Awards provide
provide the
the perfect
ALL
IRM’s WILL
Global BE
Risk AwardsREVEALED... perfect
showcase for excellence in risk management across
In association with
In association with
showcase for excellence in risk management across 11 day
day conference
conference
IRM’s
the Global
the world.
world. Riskan
With
With anAwards provide
intriguing
intriguing the perfect
masquerade
masquerade theme,
theme,
1 day
showcase conference
In association with
9
9 October
October 2014
2014
2015’s Awards look set to be the biggest yet.across
2015’s for
Awards excellence
look set in
to risk
be management
the biggest yet. 1 day conference
the9world.
October 2014
With an intriguing masquerade theme,
Submissions
Submissions
2015’s Awards look close
close seton
on 15
15the
to be September
September
biggest yet. 9
CassOctober
Cass Business School 2014
Business School
Executive
Executive Education
Education
so get
so Cass ready
get ready to tell
tell us why it should be
to School
Business
us why it should be you.
you. 200
CassAldersgate
200 Street
Business School
Aldersgate Street
Submissions close on 15 September
Executive Education London, EC1A 4HD
For award categories, and ExecutiveEC1A
London, Education
4HD
so 200
For get ready
award to tell
categories,
Aldersgate Street and further
us why further information
it should be you. on
information on 200 Aldersgate Street
how
how to
London,submit
EC1A an
to submit an entry visit:
4HDentry visit:
For award categories, and further information on
theirm.org/events/global-riskawards-2015
Book
London, now
Book EC1A
now4HD at
at
theirm.org/events/global-riskawards-2015 www.theirm.org/events/
howBook
email
email atnow
toussubmit
us at
anatentry visit:
events@theirm.org
events@theirm.org www.theirm.org/events/
Book now at
extended-enterprise-2014
call us on +
us on + 44
44 (0)20
(0)20 7709
7709 9808
theirm.org/events/global-riskawards-2015
callwww.theirm.org/events/ 9808 extended-enterprise-2014
email us at events@theirm.org www.theirm.org/events/
extended-enterprise-2014
call us on + 44 (0)20 7709 9808 extended-enterprise-2014

BOOK
BOOK BY
BY 26
26 SEPTEMBER
SEPTEMBER TO
TO SAVE
SAVE 15%
15%
BOOK BY 26 SEPTEMBER TO SAVE 15%

Risk Leaders Cyber Risk

Cyber
RiskRisk
Leaders
2014
Practical
Practical Strategies
Strategies for
for Cyber
& Insurance Risk
& Insurance
Sky’s
Risk

2014
at Board Level
Risk at Board Level
Practical Strategies for
&
The Insurance
The Risk
Risk Managers’
Managers’ Forum
Forum
Sky’s the
the limit
Risk at Board Level
limit
The Risk Managers’ Forum The Risk Managers’ Forum
Sky’s the limit
Tuesday
Tuesday 11
11 November
November 2014
2014 1-day
1-day conference
conference 27
27 November
November 2014
2014
1-day conference Inmarsat
Inmarsat Conference
Conference Centre,
27 November 2014
Centre, Cyber
1-dayRisk and
and Insurance
Insurance focuses on
on practical
Tuesday
99 11 November 2014 Cyber conference
Risk 27 November
focuses practical 2014
99 City
City Road,
Road, London,
London, EC3N EC3N 3AX
3AX guidance
guidance for insuring your organisation’s cyber
for insuring your organisation’s cyber
Cyber Risk and Insurance focuses
Inmarsat on practical
Conference Centre, for:
The
The 1 day
1Road, conference
day London,
conference for:
Cyber
risk. It Risk and
includes Insurance
a focuses
problem-solving on practical
roundtable
risk. It includes a problem-solving roundtable
guidance for insuring your99 organisation’s
City cyberEC3N 3AX
Chief Risk Officers, Heads of Risk and guidance
forum
forum andandfor insuring
aa panel
panel your organisation’s
discussion
discussion to
to enable cyber
enable you
you to
to fully
fully
Chief
risk. It includes a problem-solvingRisk Officers,
roundtable Heads of Risk and
The
anyone
anyone 1 day conference
responsible
responsible for
for risk
risk at
at for:
board
board level
level risk. It includes
participate and a problem-solving
get the answers toroundtable
your questions.
participate and get the answers to your questions.
forum and a panel discussion to enable you to fully
Chief Risk Officers,
With thanks to our sponsors: Heads of Risk and forum and a panel discussion to enable you to fully
participate and get the With
answers
thanks to to your questions.
our sponsors:
etc.venues, Dexter
anyone responsible for risk at board level participate
etc.venues,and get House,
Dexter 22 Royal
the answers
House, to Mint
Royal your House,
Mint questions.
House,
Industry partner
Industry partner London, EC3N
London, EC3N 4QN 4QN
etc.venues, Dexter House, 2 Royal Mint House,
With thanks to our sponsors:
etc.venues, Dexter House, 2 Royal Mint House,
London, EC3N 4QN For further info, please
London,
For EC3N
further please contact:
info,4QN contact:
Industry partner

Book today: www.theirm.org/events

www.theirm.org/events
jason.williams@theirm.org
jason.williams@theirm.org
For further Book today:contact:
info, please
For further info, please contact:
jason.williams@theirm.org
Book today: www.theirm.org/events jason.williams@theirm.org
The Institute of Risk Management, 2nd
6 Floor,
Lloyd’s Sackville
Avenue,
The Institute of Risk Management, 6 Lloyd’s Avenue, London, EC3N 3AX House,
London, 142-149
EC3N Fenchurch
3AX +44
+44 Street,
(0)20London
(0)20 7709
7709 9808 EC3M 6BVwww.theirm.org
9808 www.theirm.org
, EC3N 3AX +44 (0)20 7709 9808 www.theirm.org
The Institute of Risk Management, 6 Lloyd’s Avenue, London, EC3N 3AX +44 (0)20 7709 9808 www.theirm.org

RMPAut14 pp40-43 RG & SIG News.indd 43 10/09/2014 13:33


IRM FOCUS
CAREERS
in the name GAME
David Imison is delivery director of risk consulting at Schillings
How did you enter the world of risk
management?
I graduated from university with degrees in Classics
and law, without knowing exactly what I wanted to
do, career-wise. When an opportunity arose to join
a fast-growing company on its graduate scheme, I
went for it, knowing that this was an opportunity
to work on the commercial side of an interesting
business. Our clients at the time were operating in
high-risk industries, and our job was to help them
manage risks in their supply chain. Since then, I have
worked in a global risk consultancy – for one of the
‘Big Four’ advisory firms – and now head up the
risk consulting team at Schillings.
What does best-practice risk
management look like?
Earning the right to be in the big
conversations. Clients come to us because they
want our counsel. They aren’t thinking in terms
of what is legal, what is risk management –
or even, necessarily, what is best
practice. They are simply looking
for the best advice on how to
achieve their objectives.
Describe your
typical day
My day often starts at 8am,
with a breakfast seminar
that colleagues and I run
for clients and prospects.
This is followed by
a team meeting to
discuss the priorities
and the issues of the
day – after which
it’s straight into calls
with HNW [high net
worth] clients and
their PR advisers. Come
lunchtime, I will spend 10
minutes reading up on
my beloved Arsenal,
before preparing for
44 | www.rmprofessional.com | Autumn 2014 |
RMPAut14 pp44-45 Careers.indd 44
I
my mid-afternoon client meetings. By 3pm, I’ll be
facilitating a crisis-management exercise for one of
our corporate clients, before heading back to the
office to conduct interviews as we go about finding
the best talent for our growing team. As we move
towards the daily print deadline, one of our lawyers
will come to me with a breaking news story that
has the potential to affect one of our clients. The
research team will then be scrambled to gather
intelligence on the matter in question – and a take- C
away ordered in. M
Y
What are the best and worst aspects
of your role? CM
The unpredictability – which applies to both the best MY
and worst parts of the role. Sometimes, keeping all CY
the plates spinning is a challenge, but – at the same
time – I am energised by the sheer excitement and CMY
profile of the things that I am working on. K
What has been your greatest
achievement?
Professionally, it would have to be building the
foundations of a successful risk management
consultancy business here at Schillings. In terms of
activities, I’m proud to have trekked 250km through
the Gobi desert. Personally, my greatest achievement
was buying my flat in London – it felt like finishing
an uphill marathon!
What advice would you give to an
aspiring, or up-and-coming, risk
professional?
We work in an economy largely based on
knowledge. Ask questions, study hard, be inquisitive,
and try not to stand still.
What’s the best piece of advice
anyone in the profession has
given you?
‘Eat the horse whole.’ No, this isn’t a metaphor; it
actually refers to the national dish of Kazakhstan.
I spent quite a long time working there in 2012, and
my boss at the time provided me with this valuable
lesson in cultural assimilation.
09/09/2014 13:05
 Institute of Risk Management

MIND
THE
C

M
GAP
GET THERE FASTER.
Y

CM

MY

CY
GET RISK QUALIFIED WITH IRM.
CMY

Enrolment for the International

Diploma in Risk Management is
open from 1 October 2014
For more information:
studentqueries@theirm.org
+44 (0) 207 709 9808
www.theirm.org

RMPAut14 pp44-45 Careers.indd 45 09/09/2014 13:05

 irm focus
MEMBER PROFILE

Monika Narula
A self-confessed tea inventor with a shelf of awards and a passion for books

Why risk management? stepping stone. Sharpen up your soft skills and never,
Because it’s a role where you get to talk directly to every ever, stop being a student. Business acumen is a must
level of stakeholder – from staff to senior management, as you move forward in your career, and this helps you
vendors to customers and board members to regulators. anticipate risks ahead of the competition.
There’s no better way to both learn about every aspect The risk profession involves finding gaps and telling
of business and get a take on where the world’s going business owners about them. And that’s not easy! So
next. Risk professionals don’t – or shouldn’t – sit in learn the art of communicating not-so-good news
ivory towers. The volume of interactions we have without hampering relationship with stakeholders.
every day is a sure-fire path to growing both The art of writing – especially emails – is often
professionally and personally. overlooked, but I’ve found it’s a must.
Plus, in this situation, you have And – perhaps most importantly
the opportunity to innovate – join a professional forum that
continuously, which is exciting. can keep you updated on different
And – on a practical career domains in risk management,
note – when the rest of the world help you connect to experienced
is shedding staff and economists professionals, and keep bringing
pore over unemployment figures, opportunities to you. A word of
risk management professionals caution though: don’t expect
stay in demand, as we’ve seen to be spoon-fed; you need to
with the recent global recession. keep yourself open and flexible
to absorb new ideas and exploit
What are your passions opportunities fully.
outside work?
I love to explore new places Who or what inspires you?
and read about people who I’m deeply inspired by real-life stories
have made it in life. Knowing of people who have dared to take
about different cultures across a different path in life, made it to
the world, meeting people with the top and changed the world in
different backgrounds, thrills me. some way.
These things can totally challenge Sir Richard Branson is someone
and change the perspective I admire for his guts on taking
you’ve been carrying all your life. risks in business and doing things
Keynote and Letters by JRD no-one had previously imagined. He
Tata are my all-time favourite started so much from scratch. There
reads. He urges people to ‘live life a little dangerously’! are a lot of lessons there.
I’m also fascinated by Greek mythology. It’s not just He’s written a number of inspiring books, using his
interesting in its own right, but I think it also quite subtly tells real-life experiences, that are all worth reading. Above
you about the realities of life and how to deal with them. all, he is in continuous touch with society as a whole for
New places and good books are important to me, but philanthropic reasons, which seems responsible.
I can’t beat catching up with my parents and brothers and Monika
sisters, as I live in a different city from them. Narula is an Tell us something surprising about
operational yourself
What’s the most important advice you risk manager I am a tea inventor. I’ve experimented and created more
would give young risk managers starting with RBS, than 50 flavours of tea. What could be a better stress-
out on their careers? India buster for a busy risk professional than an aromatic
First, view every small opportunity and assignment as a cuppa?

46 | www.rmprofessional.com | Autumn 2014 |

RMPaut14 pp46 Member profile.indd 46 09/09/2014 13:05

 DIRECTORY
RISK MANAGEMENT PROFESSIONALS
RISK CONSULTING, REPUTATION LAW & INFORMATION SECURITY
From reputation resilience to reputation defence, the steps you take to Schillings
protect your reputation are as crucial as those you take to build it. At a 41 Bedford Square
time when successful individuals and businesses face a huge variety of London
threats with the potential to affect their reputations negatively, Schillings WC1B 3HX
help clients assert a more powerful commentary in the face of attacks Tel: +44 (0)20 7034 9000
on their reputations, by anticipating and containing these threats
through a combination of risk consulting, law and information security. Email: David.Imison@schillings.co.uk
Web: www.schillings.co.uk

INSURANCE CLAIMS HANDLING & RISK MANAGEMENT SOFTWARE

At JC Applications Development Ltd, we believe that our commitment Phil Walden
to providing simple-to-use, yet feature-rich, applications for claims JC Applications Development
and risk management is what has enabled us to grow a successful Manor Barn
and satisfied client-base of more than 160 organisations. Although Hawkley Rd
our clients can occupy very different sectors of business – for instance, Hawkley
UK central and local government, US government, and commercial – Liss
sentiments converge when looking for a proven technology solution Hampshire GU33 6JS
provider. If you are looking to improve the way you handle claims or Tel: +44 (0)1730 712020
manage risk, then JCAD has the right mix of products and services to Email: phil@jcad.co.uk
guarantee a cost-effective and timely implementation. Web: www.jcad.co.uk

RISK MANAGEMENT TECHNOLOGY

Riskonnect, Inc. is the provider of a premier, enterprise-class technology Ross Ellner
platform for the risk management industry. As an independent Director, EMEA
innovator in risk management technology, Riskonnect develops and Riskonnect, Ltd.
markets a growing suite of technology solutions on a world-class 52 Kingsway Place,
cloud computing model, helping clients elevate their risk management Clerkenwell, EC1R 0LU
programs, safety solutions and programs for management of risks Tel: +44 (0) 7714 262351
across the enterprise. Through Riskonnect RMIS, Riskonnect ERM,
Riskonnect EHS and other Riskonnect applications, the company Email: ross.ellner@riskonnect.com
provides the risk management industry with the specific, configurable Web: www.riskonnect.com
solutions needed to reduce losses, control risk and affect shareholder
value.

Insurance Claims Handling and Risk Management Software

The InsuBiz solution is an established modular-based software for Elaine Barclay
captives and risk and insurance managers that enables you to take Client Services Manager - UK
greater control of your insurance, claims and risk management data. InsuBiz UK Limited
By providing you with an overview of your insurance programme, 22 Cawder Road
aligning this to a full incident and claims administration system, and Cumbernauld
tying it into your risk management models and scorecards, InsuBiz gives Glasgow G68 0BF
you a powerful management and workflow tool to navigate, manage Tel: +44 (0)7900 503751
and analyse the risks to your business. Email: eb@insu.biz
Web: www.insu.biz

TO ADVERTISE HERE, CALL MICHAEL NISKIN ON +44(0)1223 273 535 OR EMAIL michael.niskin@rmprofessional.com

| Autumn 2014 | www.rmprofessional.com | 47

RMPAut14 pp47-48 Directory.indd 47 09/09/2014 13:06

RMPAut14 pp47-48 Directory.indd 48 09/09/2014 13:06