The IIA fails again on risk management

I have reached out to people at the IIA with a plea to come on board with the latest thinking about risk management: that it is not about managing or mitigating risk, but about taking the right level of the right risks to achieve your objectives.

No reply, unfortunately. (Even though they replied to other initiatives regarding the Standards.)

Now we have a new report from the IIA that cements their feet in the concrete of failure. Yes, failure. Risk management practices are not seen by executives as contributing to how they make decisions and run the business. As a result, they don’t participate with enthusiasm or provide the resources risk practitioners need.

The new IIA report is OnRisk 2022: A Guide to Understanding, Aligning, and Optimizing Risk.

The marketing blurb says that the report will “will change the way organizations view and understand risk”. Wrong!

The report says:

• C-suite executives, and chief audit executives [are] the key players in risk management
  • Comment: this ignores any risk practitioners as well as the fact that operating management at multiple levels are the ones making decisions and taking risks every day.
• The OnRisk approach is grounded in an innovative methodology…