Are we all better than average at risk management?

Who's fooling who?

CFO magazine recently published a fascinating article that is another example where executives all think their organizations are above average. The article observes that experts estimate that internal fraud costs companies 3% to 5%
of revenue each year. But executives are prone to underestimating the amount of fraud that exists within their company.

They want to believe that their internal controls are better, their employees are more honest, and their ability to stop fraud is more effective than that of executives at other companies.

In my meetings with executives are a wide cross-section of industry, in discussions about risk management, financial control and assurance, it is still surprisingly common to hear the opinion that management see no need to improve their risk management or financial control approach because 'the risk here is very low', 'we trust our people', 'we don't see the benefit'. I suspect that it just these firms that get the nastiest surprises along the line. Fraud prevention should not be the prime reason for improved financial governance, but it is a consideration. Having confidence in the business working the way it should should be a priority for the executive team, the audit committee and all stakeholders and investors.

Much more reassuring is the comment from the executive responsible for financial control at a top 10 global leader when he tld me "we spend a lot of money with the Big 4 and benchmarking firms who all tell us we are in the top 10% worldwide in terms of our financial control effectiveness. Why don't I feel good about that? I know a lot of things still go wrong, and those are just the 'known unknowns'!".

This got me thinking about the 'Rumsfeldian' comments and perhaps it's the 'unknown unknowns' that cause the biggest issues. Either way, we should not get caught in the trap of ASSUMING our company is much better than average . . .

Read the full article at CFO magazine at http://www3.cfo.com/article/2012/4/fraud_internal-fraud-detection