Risk-managing Change

No consensus on how to risk-manage change

To what extent is change itself – both the process and the outcome – a risk that should be managed? And, if it should be proactively managed, then how and by whom?

There was widespread agreement among the CROs in our study that change risk is an issue, that it is rising in importance, and that it is a priority for most. There was less agreement on the best way to address this new challenge.

We had expected that the focus to be on how to keep up with the business. This was a concern, and many CROs are focused on helping the business grow and “change safely” by delivering the change strategy rather than just prioritising avoiding loss. Most felt their institutions have a clear view of how major individual transformation projects are progressing, and there is no great need to increase oversight here.

Instead, many CROs are focusing more on getting better at assessing and mitigating the risks that result from the effects and outcomes of these transformational projects – the “delivered risk” – rather than the risk of not delivering the project on time, to specification, or on budget – the “delivery risk”.

Content, concerned or active

No institution claimed to have a comprehensive worked-through approach to risk-managing change, but broadly, the CROs split into three groups.

Roughly a quarter are content with their existing approach to change-risk management. About half are concerned about their institutions’ change-risk management but are seeking to address these concerns by using and enhancing existing processes and practices. The remaining quarter represent those institutions that are most actively improving their change-risk management processes. These CROs are typically most concerned about delivered risk and are actively developing new processes and practices to manage it.

Learn how your peers are managing change risk

No one expressed any appetite to create a formal new discipline or risk silo with a new framework. They frequently argued that their portfolio of operational risk (also known as non-financial risk), is already fragmented enough. Nevertheless, all the CROs were curious to learn more about what their colleagues in other institutions are doing. The report, Transforming safely – the emerging practice of risk-managing change, should support CROs and other operational risk professionals in understanding the approaches of their peers.

By the end of this study, both ORX and McKinsey & Company were convinced that risk-managing change is an emerging trend. It creates a valuable opportunity for operational risk to become involved in an activity that influences the future operational risk profile, makes a real difference, and where risk’s contribution is valued by the business. It could even be that good change risk management will make the difference between those who transform safely and those who don’t.