A new report from the National Audit Office into the forecast cost to the Treasury of HS2 rail project reveals the government failed to understand the risk to the public purse from the outset in 2013. The Department of Transport set the original budget without sufficient contingency for a major infrastructure project, and consequently over-estimated its economic benefit. We all know who was the minister at the time, but more importantly does anyone really understand risk?
Risk has become an important topic on the boardroom agenda and expanded into a management discipline; but it is not a profession and your Chief Risk Officer (CRO) or Chair of the Risk Committee has probably come from another discipline: finance, insurance, internal audit, business assurance, compliance or Health & Safety. There is no professional body or code of practice – although the Institute of Risk Management offers both certificate and diploma in Enterprise Risk Management.
This might seem odd, but risk is only a forecasting exercise around future uncertainty. In the same way strategy indicates future direction, risk identifies future uncertainty. There can be no certainty about risk as it is an estimate of an unknown future. There are only two types of risk forecast: lucky and wrong. Despite this the discipline focuses on control procedures to manage or mitigate future costs, with risk registers and heat maps as support for a vision of a probable future. As the future cannot be controlled, the term risk management is in reality an oxymoron.
Boards manufacture certainty to secure a mandate to operate from investors. Their certainty aims to demonstrate competence, however as many investors have ‘skin in the game’ there is little appetite to question the basis for such certainty. A risk committee, department or office informs and advises the board but in so doing can all too easily be seen as point of expertise, and awarded undeserved deference for what is only one perspective on a future outcome. The risk advisory body should not be mistaken for Nostradamus, and boards need to retain their ownership of risk perception.
Regulators try to create rules to make risk forecasting more responsible yet boards struggle to issue meaningful statements about risk appetite, a concept that is as helpful as defining how hungry you will be next week. Appetite varies due a number of factors, both external and internal, so what purpose does a risk appetite statement serve? It is designed to help investors understand the mind-set of the corporate board, and its propensity to dare in search of gain. The word ‘Risk’ derives from the Italian verb ‘to dare’.
A government determined to push ahead with a major transport infrastructure project for political gain would want to encourage private sector investment and inevitably downplay the funding risk and highlight financial benefit. After eight years of talk it now appears that much of the thinking at the outset was over-optimistic, there being no incentive to scrutinize the cost projections and Treasury impact. The government has no excuse as it has been running PFI projects for over twenty years and even once created an Office of Government Commerce (OGC) to understand the risks involved. Risk is not a black-art but it needs to be better understood.
