Businesses should "attune their antennas" to risk situations that may need close monitoring so GFC mistakes are not repeated, says Australia's Auditor-General.

Ian McPhee told a Risk Management Institution of Australasia (RMIA) ACT chapter conference that businesses needed to implement sound risk management to avoid failing to monitor the changing environment. Firms that avoided significant fallout from the GFC had more adaptive, rather than static, risk management processes and systems that could rapidly change to reflect changing circumstances.

Those firms considered firm-wide risk exposures; shared information across their entities; and engaged in effective dialogue across the management team, he said. "In other words, they exhibit strong governance systems with information being passed upwards to the board."

McPhee said businesses needed to keep all dimensions in view when assessing and managing risk. "Whatever the task, businesses should understand the context, goals and strategies of success; know how to effectively resource the mission; determine scorekeeping arrangements; and overlay this with a sound approach to risk management, including an understanding of risk tolerance."

The ultimate goal for all organisations was to build risk management into organisational culture so they could be better performing, more resilient businesses. "If there is a central message here, it is about the importance of integrating risk management into all elements of organisational planning and execution. It is not about eliminating risk. The objective is very much about understanding risks, managing them and informing key stakeholders about them and the associated mitigation strategies."

McPhee listed six ways for business to "attune their antennas" to risk situations that may need close monitoring. He said organisations should know their responsibilities and the role of management; understand and adhere to legislative and policy frameworks; have the right "horse power" for the task; actively monitor risks; and modify or kill projects that were not performing. McPhee used the RMIA ACT conference to praise his predecessor auditor-general Pat Barrett for putting risk management on the public sector management agenda. He said Barrett strongly promoted the benefits of risk management to public servants who were used to working in a more "rules-based" world. Barrett integrated a better understanding of risk management with reforms designed to "let managers manage" and "make managers manage", McPhee said.

This article first appeared in The Risk Report, Issue 337, Thursday 14 October 2010