Real success for risk management can only come from creating value. Yet risk management practices have largely failed the value add test.
Defining value
What drives value in your business? To find out, you need to learn how equity analysts 
make buy/sell recommendations. Value drivers may not be tangible and they may not be on the balance sheet, but they’re very real.
For example, in the mining and metals industry, proven mineral reserves drive value. In the airline industry, one equity analyst concluded that the quality of customer experience drove value. For a railroad long-term contracts with coal shippers are critical.
Risk management practices that fail to recognize value as the starting point can’t add value.
Linking risks to value
Risk management must provide insight into how value is created or destroyed. For a metals and mining company, reserves are clearly created by exploring for and developing mineral resources.
But for an airline, it may not be as obvious. How does customer interaction with reservation systems, passenger agents, and cabin crew impact value? For a metals company, how does certifying a conflict-free mineral smelter impact brand value?
Answers to these questions drive value.
Black swans and value
While risk managers should scan the horizon for black swans, it should be just part of an overall risk management strategy, and not the primary focus. It is essential to consider those rare once in a lifetime risk events, but it is insufficient and will not sustain a risk management program.
Aligning GRC activities on value drivers
The value focus provides a framework for integrating all governance, risk, and compliance (GRC) activities. Do your compliance strategies map to value drivers? Are your internal auditors building their audit universe based on value drivers? Are your policies focused on value?
One South African company, Exxaro, provides a great example of building a sustainability program with a risk management initiative focused on value drivers and disclosing their progress in an integrated report. (Read the full report to learn more about Exxaro’s new enterprise risk management framework.)
Linking your risk management and other GRC activities to value is a risk worth taking.