Is the risk worth taking?

The Life: Over the last decade the chief risk officer has experienced a phenomenal ascent. Experts explain why and what they do.

Jan Bladen, from Dubai Financial Services Authority, during a conference at The Capital Club at DIFC. Jaime Puebla / The National

When it comes to high-ranking executives in the business world, one particular position did not even exist before 1993.

Many companies were slow to catch on at first, but in the past five years Stanton Chase says there has been a 400 per cent increase in demand for what is known as a chief risk officer. And the executive search company predicts there will be a further 44 per cent increase next year.

"While some executive positions are being seared by the heat of a financial meltdown, risk executives are experiencing healthy double-digit growth," Shane Philips, the Middle East and North Africa regional practice leader for financial services at Stanton Chase, Dubai, wrote in a white paper.

"The bottom line is that banks, insurance companies, investment groups, sovereign wealth funds and the like will all be forced to grow their risk teams in order to comply with the new market conditions."

GE Capital was the first company to appoint a chief risk officer back in the early 1990s, and the position at that time oversaw areas of risk such as credit, the overall market and liquidity.

But these days the role has broadened to manage any risk that could prevent a business from achieving its objectives. In the banking sector, that could be anything from rogue traders to technology malfunctions that might leave customers in the lurch.

Companies that want to implement a risk-management strategy must first work out what can go wrong. Then they need to define how often it could happen before determining how bad the impact could be.

Companies then chart the risks to work out how much money and time should be devoted to dealing with them. Of course, risks with high probability and high impact should take precedence.

The types of impacts a business might face can be divided into two areas: direct losses, where companies can measure the financial impact, as well as indirect losses, where the damage is not so easy to define.

For instance, if a company is based inside the Dubai International Financial Centre, and one of its employees commits a criminal act, it could suffer both directly and indirectly, says Jan Bladen, the chief operating officer at the Dubai Financial Services Authority (DFSA), who was speaking in a personal capacity about the issue at a recent forum hosted by Stanton Chase. "You're going to have a regulatory fine, so as a consequence you can financially measure the direct impact on your organisation," he says. "You know exactly how much it has cost you.

"If you carry out the same activity and the DFSA issues a press release and it impacts on your reputation, it is very difficult to financially calculate the impact on your organisation."

The process of assessing various business risks is laborious, and often expensive. But there is a big benefit to be gained in successfully managing risks. "The better the risk reports to the senior management and the board, the more dynamic their risk appetite becomes, the more risks they are willing to take," says Mr Bladen.

"The board continually adjusts its risk appetite in accordance with the organisation's ability to be able to take and manage risks. And at the end of the day you only generate shareholder return based on taking risks."

But a recent case involving UBS underscores an important lesson in risk management. A large part of the Swiss bank's latest annual report is devoted to its extensive risk management controls, yet one of its London employees, Kweku Adoboli, has been charged with fraud for allegedly to racking up US$2.3 billion (Dh8.44bn) worth of losses as a result of unauthorised trades.

"Whatever the controls you implement inside your organisation, however much effort you put into it, you are always going to have one or two risks that slip through," says Mr Bladen.