During the annual Accountant Day, held on 25 November, Prof. Dr. Leen Paape RA RO CIA, Dean of the Nyenrode School of Accountancy and Controlling, presented the results of the National Risk Management Survey.

Paape spoke about the research and what’s currently happening in the field of risk management in the Netherlands, and explained the key issues involved in the management of risk. “Organizations set targets for themselves, and on the way to achieving those targets, many things can happen. Things can turn out better or worse than expected. Risk management means that, as an organization, you first think about what you may encounter on the way to reaching your goal,” he said.

He drew a comparison with individuals who have some capital. “These people may ask themselves whether to put their money into an ordinary bank account or an internet savings account, or whether to invest it in stocks and bonds. They may even consider stashing it in an old sock in the attic. With each option, they will weigh the pros and cons of making a return on the one hand and the risk of a loss on the other. The returns on stocks may be higher than on savings in the bank, but the risk of losing all or part of your money is greater.” Organizations also have to weigh the pros and cons of every choice they make; will they take certain calculated risks, or will they play it safe?

Gut feeling
Paape: “We know from various studies, such as those conducted by Nobel Prize winner Daniel Kahneman, that most people don’t make decisions rationally. They often base them on a variety of assumptions that subsequently turn out to be false. This is also the case with risk assessments. Like individuals, businesses are often guided by gut feeling when making choices.” In his view, it would make more sense to state the risks explicitly, and to think about them more logically. “By considering risks more logically, problems can be better anticipated, thus limiting any negative consequences. It may even lead to a chance of making the most of opportunities that others do not recognize.”

A relatively new phenomenon
Companies were managing risk long before the current crisis, Paape said, yet it is a relatively new phenomenon outside the insurance and banking sector and has only really come to the fore over the past 10 to 15 years. “In the banking and insurance sectors, people have been familiar with risk management for some time.  An insurer, for example, will set the level of the premium for a life insurance policy based on the amount to be paid out and the risk of the insured person dying within a certain period.”

Banks
According to Paape, the banks, which were at the centre of the current crisis, had a reputation of being very good at managing risk. “After all, that is their business. With hindsight, this assumption did not turn out to be entirely accurate.”

Where did it go wrong? According to Paape, the banks had gathered a great deal of data, and by using a variety of models and statistics, were able to assess what might go wrong when making certain choices. As a result, their loans became increasingly high-risk. They then packaged these loans into ‘parcels’, insured them and sold them on. As a result, the risk associated with each individual loan had actually been ‘unbolted' and moved. The problem was that every bank did more or less the same. “By shifting the risks in this way, nobody remembered that they existed. As a result, we collectively took a bath.”

The survey
Paape gave an overview of the National Risk Management Survey, and explained that 1000 companies and not-for-profit institutions with a turnover or a budget of more than €10 million participated. “The rate of response was very high, which demonstrates a great deal of interest in the phenomenon of risk management.”  Five years ago, when he was working for PricewaterhouseCoopers (PwC), Paape also conducted a survey of the types of  risk management measures taken by companies. That survey was conducted in collaboration with the University of Groningen and, in addition to Nyenrode and the Royal Dutch Institute of Certified Public Accountants (NIVRA), both parties also partnered in the current survey.

According to Paape, however, this is an entirely new survey in structure. “Any comparison with the previous survey would be useless. If we insist on comparing the recent results with those measured five years ago, we will come to the conclusion that we have not made much progress during the intervening period.

“We are in the middle of a crisis of unknown proportions. It is therefore reasonable to ask whether companies did not properly assess certain risks.  Was this because of the techniques used or because of the person using them?  Probably both.”

According to Paape, risk management tools are still used in a very haphazard way today.  “It is still a technique in its infancy. This is not so strange; after all, the first automobile was just a coach with an engine. It took decades before the motorized coach was transformed into something that looked like the cars we know today. The same will certainly apply for an abstract and complex concept such as risk management.  It will take years before organizations and people will understand it completely. Therefore, five years may well be too short a time horizon. For example, you can teach people what the gearbox, the steering wheel and the indicator is.  However, to drive a car in traffic, it is also desirable to have some training and experience. It is therefore necessary to put some work into the skills of the people who will be sitting behind the steering wheel.”

At the moment, risk management is often paid lip service, but is not acted on, Paape believes.  “Its importance is written into various corporate governance codes, but then everybody quietly returns to the order of the day and gives it little further thought.”

Unsatisfactory
Paape: “In the survey, we asked the organizations to rate their own risk management practices (on a scale of 1 to 10). On average, the organizations rated themselves at 6.5.  Based on what we consider important in the context of risk management, we also rated the participating organizations and gave them a score. We gave them an average of 4.5, which is considerably less.” There are big differences between the various sectors, with the biggest difference between a company’s own assessment and the score awarded by the researchers found in trading companies.  They awarded themselves the highest score, i.e. an average of 7.0, while the researchers marked them at 4.0. Paape blames this difference on a lack of knowledge and an overestimation of existing expertise. The banks assessed themselves most accurately, he said. “They gave themselves a score of 6.8, and we rated them at 6.1. The view that financial institutions are furthest advanced in risk management is therefore correct. They also have a reasonably good view of what they are doing. The energy sector also scores reasonably well. The health sector and the not-for-profit sector, on the other hand, score considerably lower.” 

The results of the survey were briefly discussed during the Accountant Day on 25 November, but will be explained in more detail during a seminar on 7 December. Paape: “During this seminar, we want to have a closer look at our scoring table. Does everybody agree with the way we score? We also want to help participants with rating themselves. This will certainly be of interest to organizations that did not participate in the survey. They will be able to provide their own estimate of how they think they are performing, and will then be assessed by us. We can then discuss whether there are gaps between the self-evaluation and our assessment, and what organizations can do to close the gap.”


Click here to download the full survey report (in English)

Click here to download the summary of the survey report (in Dutch)

Click here to download the full survey report (in Dutch)

Read about the Accountant Day on 25 November 2009)


Please mail your comments on this article to: Businesstopics@nyenrode.nl