I found your post from a question you asked on LinkedIn. Unfortunately by the time I got to that one the question had been closed.

Great to see you raising such pertinent questions. I have been working for many years working on assessing the adequacy of risk management systems, and teaching others how to do so.

I’ve come to the conclusion that strategic and systemic risk are the key issues to be managed and that operational, reporting and compliance risk are more of a hygiene capability. Unfortunately to get a lot of that hygiene capability in place an ERM exercise is necessary, and many countries and industries are very early on that journey.

A number of regulators in Commonwealth countries are now beginning to drive accountability for material business risk into their listing requirements. I see this as a trend, and the SEC is currently being petitioned on this.

The conclusion I’ve reached on this is that you can’t sign off on material risk, unless you’ve got a good handle on strategic and systemic risk, which is precisely the reason that in the lead up to the GFC we had a lot of risk professionals scratching their heads saying “I didn’t see that coming”.

I’ve got an enormous body of work on this if you’re interested, including some recent presentations on video and audio feed. Just follow the link above.