The Manufacturing Risk Maturity Profile: Findings from the MAPI Cohort
Today, a combination of dynamic and powerful forces including cyber risk, digitalization, regulatory complexity, natural catastrophes and globalization confront manufacturers more than at any other point in history. To respond to this ever-evolving array of risks, executives need robust tools and fresh insights to support their understanding of these and other risks, as well as to accurately assess the sophistication, effectiveness and maturity of their own risk management programs.
Manufacturing leaders turn to the Manufacturers Alliance for Productivity and Innovation (MAPI) for insights and peer connections to make informed business decisions. Given the significant challenges described above, MAPI welcomed a collaboration with Aon, one of the world's leading risk management firms helping manufacturers reduce risk and volatility.
Leveraging the award-winning Aon Risk Maturity Index, MAPI members assessed their effectiveness across several key areas, including: risk governance frameworks, communication and alignment on risk management objectives. This report is the culmination of research performed on the aggregate insights from MAPI members who participated in the Aon Risk Maturity Index. We hope you find this report of value and wish you success in your risk management endeavors.
MAPI is delighted to team with Aon to provide unique insights that will help executives make smarter decisions. Please don't hesitate to reach out to MAPI or Aon if we can support you in any way.
Director, Internal Audit & Risk Management Councils
National Practice Leader
Aon Industrial, Materials, & Automotive Practice
Developed by Aon and The Wharton School of the University of Pennsylvania, the Aon Risk Maturity Index was introduced in 2011 as a tool to assist senior finance, risk and legal professionals in identifying and addressing critical areas of concern in their risk management programs. The Aon Risk Maturity Index is designed to help organizations understand the value of risk management. It also supports business initiatives to enhance operating performance and/or reduce volatility by empowering executives with insights and guidance on best-practice tools and techniques to help improve their risk governance and overall approach to risk management. This report addresses these broader research findings that link risk maturity to financial performance metrics.
For the MAPI collaboration project, Aon analysts examined the responses from 56 MAPI members who participated in the Risk Maturity Index. Throughout this report, this aggregate data is referred to as the "MAPI cohort". Aon analysts have examined the MAPI cohort in conjunction with Aon's proprietary Risk Maturity Index database to develop this body of research.
Aon researchers honed their analysis on a few key areas of greatest interest.
- Comparison of Risk Maturity Ratings: MAPI Cohort versus Manufacturing Sector, At-Large
Research findings reveal that the MAPI cohort average "Defined" level of risk maturity on Aon's Risk Maturity Index Rating scale is comparative to the overall manufacturing industry average.
- Risk Maturity Rating, by Function
Within the MAPI cohort, there was representation from two main functions—Internal Audit and Risk/Insurance. In this section, we explore the key differences and areas of greatest agreement between these two functions.
- MAPI Cohort Ratings: Top and Bottom Characteristics Revealed
The MAPI cohort exhibits strong risk management practices related to the integration of human capital processes, as well as transparency of risk communication practices. That stated, however, MAPI cohorts ultimately scored lower in areas related to the involvement of key stakeholders in risk management strategy-setting, as well as in the use of quantification methods to understand risk and demonstrate added value through risk management.
- What Sets More Mature Organizations Apart
Using risk maturity scores, Aon analysts examined differences between more mature organizations and less mature organizations. The most notable differences were specific to human capital as a driver of risk culture and performance, in addition to the integration of risk management into strategic decision-making and efforts to achieve consistency from the executive suite to lower levels within the organization.
Insights into Risk Maturity: General Findings on Correlation Between Risk Maturity and Financial Performance
As illustrated in the 2017 Aon Risk Maturity Index Insight Reporti, published in November, Aon analysts leveraged data from more than 300 publicly traded companies around the world to research and identify the relationship between higher risk maturity and financial performance. Consistent with the findings of prior editions of the Risk Maturity Index Insight Reports, this research confirms a positive correlation between risk maturity and stock price performance during 2015 and 2016.
Aon's analysts also noted that 2016 was a year of increased equity market volatility, across all risk maturity scores. In this environment, the correlation between risk maturity and market volatility has strengthened, with materially higher volatility generally experienced by organizations with less sophisticated practices for managing risk in their organizations.
Aon Risk Maturity Index Rating Structure
The structure of the Aon Risk Maturity Index is aligned with best-practice standards and built around the four key pillars of Governance & Infrastructure, Process, Integration, and Culture & Communication. Within this framework, 10 overarching characteristics of risk maturity can be broken down into 40 components, and finally, the 125 questions contained in the Risk Maturity Index.
The Ten Characteristics of Advanced Risk Maturity
The Aon Risk Maturity Index examines specific practices and structures related to ten characteristics of Risk Maturity. These ten characteristics are further broken down into 40 specific components that are scored on a 1 (Initial) to 5 (Advanced) scale similar to the overall Index.
- Board-level understanding of and commitment to risk management as a critical factor for decision making and for driving value
- A senior-level executive who drives and facilitates key risk management processes and development
- Transparency of risk communication
- A risk culture that encourages full engagement and accountability at all levels of the organization
- Identification of existing and emerging risks using internal and external data and information
- Participation of key stakeholders in risk management strategy development and policy setting
- Formal collection and incorporation of operational and financial risk information into decision making
- Integration of risk management insights into human capital processes to drive sustainable business performance
- Use of sophisticated quantification methods to understand risk and demonstrate added value through risk management
- A move from focusing on risk avoidance and mitigation to leveraging risk and risk management options that extract value
Insights into Risk Maturity: The Aon / MAPI Collaboration
As part of the 2017 MAPI / Aon Risk Maturity Index collaboration project, 56 members participated in the Risk Maturity Index survey. Below are findings from those results. Within the MAPI cohort, there was strong representation from two main functions—Internal Audit and Risk/Insurance.
Overall, the MAPI cohort averaged a Risk Maturity Rating of "3" (Defined). This is in line with the overall manufacturing industry average, also at a "3" (Defined) level of risk maturity. The Risk Maturity Index' global database contains 208 manufacturing-specific participants from organizations of all sizes. However, both the MAPI cohort and the manufacturing sector average scored above the global risk maturity average of a "2.5" (Basic to Defined).
Risk Maturity Rating: Top and Bottom Risk Characteristics
Beyond the risk maturity scores, Aon looked at differences in the rating characteristics of the MAPI cohort. These characteristics contribute to the overall risk maturity score. Below is a summary of the highest and lowest characteristics for the overall MAPI cohort. Note: The scoring for each characteristic is a percentage based on a 100% possible score.
- The MAPI cohort appears to have especially strong practices related to integration of human capital processes, particularly as they apply to understanding and managing retirement risks. The cohort also tends to have more mature practices around transparency of risk communication. Specifically, culture regarding negative outcomes helped pull up this area as a top characteristic.
- The MAPI cohort scored lower in areas related to the involvement of key stakeholders in risk management strategy-setting. In addition, the cohort appears to be less mature around utilizing quantification methods to understand risk and demonstrate added value through risk management. Specifically, re-evaluations of risk appetite and tolerance contributed to lower scores in this area.
Comparison of Ratings Across Risk Maturity Characteristics
Risk Maturity Rating, by Function
Within the MAPI cohort, there was representation from two main functions—Internal Audit and Risk/Insurance.
Looking more deeply at the differences between these two functions, we find that the average risk maturity of the Internal Audit group is slightly lower at a 2.5 (Basic to Defined), while the Risk and Insurance function holds steady at the 3 (Defined) level. The underlying details suggest a real difference in perception, possibly attributed to the level of visibility into certain risk management practices.
In particular, the biggest divergence in opinion between Internal Audit and Risk/Insurance occurred in areas related to Casualty/Liability Risk Management Strategy, as well as Insurance Portfolio Optimization. Even though these areas are likely to be the responsibility of Risk/Insurance, there may be opportunity for further communication and information sharing across functions to increase transparency around some of these practices and strategies.
The greatest areas of consensus in opinion between the two functions involved Risk Management and Budgeting Process Alignment, as well as Risk Correlation. Both of these areas scored lower than the manufacturing industry and global average. This finding suggests an opportunity for further cross-collaboration to improve understanding and quantification regarding how different risks are related to each other, how each risk can impact multiple business units or functional areas and how to integrate this and other risk information into budget processes.
What Sets More Mature Organizations Apart?
When we break out the data for more mature organizations (those scoring 3.5+ overall) versus less mature organizations (those scoring 2.5- overall) among the MAPI cohort, we uncover some notable differences.
Human Capital as a Driver of Risk Culture and Performance
Human capital continues to be a challenge and key topic of internal discussion among many of our clients. Trends continue to impose cost pressures and influence management, with many organizations running lean and employees "wearing many hats." This can contribute to a reactive mentality, with proactive communication around risks taking a backseat to daily job requirements. However, within the MAPI cohort, it appears more mature organizations have prioritized this communication, which in turn has promoted a more proactive risk culture.
The company's culture is one in which the sharing of negative predictions is correlated with level of risk maturity. Thus:
Another aspect of this can be found in Aon Hewitt's research on how People Fuel Growthii, connecting Human Capital back to performance. Many leaders in the study specifically cited using failure as a learning opportunity, commonly using the phrase: "Never let a good crisis go to waste." In fact, economic down periods were actually viewed as additional opportunities to remove inefficiencies.
This sort of discipline is part of a broader model to describe how organizations can use people as the key lever for driving growth strategies. This is already recognized by more mature organizations within the MAPI cohort, notably: 71% of less mature organizations responded that executive-level understanding of the role of employee engagement as a driver of business performance is limited or inconsistent, while 94% of more mature organizations indicated that it's not only consistent, but also supported by analysis.
In terms of translating that mindset into practice, 83% of less mature organizations within the MAPI cohort rarely or inconsistently incorporate improvement of employee engagement levels into management performance evaluations, while 89% of more mature organizations formally and consistently do so.
To improve employee engagement levels in practice, the greatest opportunitiesiii are specific to:
In addition to enabling work and providing advancement, what we see from this collection of top priorities is that high-performing companies create and deliver on a compelling Employee Value Proposition (EVP).
This emphasis on human capital enables organizations to attract high-caliber talent that is able to effectively navigate through uncertainty.
Success will require leaders with the ability to courageously steer their organizations through the ambiguity, fear, and uncertainty that exists in the current environment. Accordingly, leadership development programs play a key role. Specific to the MAPI cohort, 75% of less mature organizations responded that leadership development programs are limited or inconsistently used, while 94% of more mature organizations said they were available and consistently used.
This finding helps to illustrate the importance of advancement and support in a strong culture of engagement. More broadly, the effectiveness of leadership will likely continue to increase in importance as employees across organizations look more intently to their senior executives to point the way and make decisions for the future, especially during times of intense change.
Emerging Risk Understanding and Strategy
In addition to an emphasis on people and talent, integrating risk management into strategy is another key facet of maturity used to drive growth and achieve objectives. Aon's 2017 Global Risk Management Surveyiv asked participants to project top risks facing their organization in the next three years. For 2020, participants expect economic slowdown/recovery to be the number one concern.
The other top emerging risks include: increasing competition, failure to innovate/meet customer needs, commodity price risk, and major project failure. While the top five risks don't differ greatly between 2017 and 2020, the strategic nature and potential impact of these risks suggests that organizations must constantly and consistently monitor and evaluate them, and adjust corresponding plans to meet these threats.
At the board level, Aon's research strongly intimates that most of the MAPI cohort is discussing and aligning on key existing risks, with an understanding of the management activities around those risks. Where there is a divergence between less mature and more mature organizations is in the area of emerging risks. In particular, 50% of less mature organizations responded that their board has not discussed, or has an inconsistent understanding and agreement, on the organization's emerging risk profile. In comparison, 94% of more mature organizations have achieved this consistency and alignment.
Previous research from the Aon Risk Maturity Index analysis found that the assignment of board roles and responsibilities is a major determinant of board risk oversight practices. When the assignment of risk responsibilities is delegated to the board as a whole rather than solely to committee—and when directors' risk management roles and responsibilities are included in their performance evaluations—the board tends to have a more consistent understanding of the organization's top risks and emerging risk profile.
Overall, 55% of the MAPI cohort responded that the board's risk management roles and responsibilities are for the board as whole. This indicates an area of opportunity, even for some of the more risk mature organizations in the cohort.
Furthermore, only 32% incorporate the execution of risk management roles and responsibilities into board members' evaluations. Together, these findings connect back to the research around the importance of board risk oversight practices given a board's mandate and ability to drive top-down organizational initiatives. Risk Maturity Index research supports active board interest in risk management, as well as the assignment of specific risk responsibilities and oversight of risk management to drive and ingrain proper practices into the organization's culture.
The growth and evolution of the Aon Risk Maturity Index has produced an industry-leading, global database on risk management practices. Results have yielded valuable findings around the correlation of advanced risk management practices and financial performance, as well as practical insights to assist in the development of a mature risk management framework in support of sustainable results and organizational resiliency.
The MAPI cohort findings contained in this report provided new and interesting insights specific to risk maturity. In particular, the MAPI cohort averaged an overall risk maturity level in line with the manufacturing industry at a 3.0, but above the global average currently at a 2.5. The role of function demonstrated that both differences in perception around certain risk management practices and areas of high consensus suggested opportunities for further cross-collaboration and communication to improve information-sharing. Similarly, we gleaned potential opportunities by looking at the highest and lowest characteristic scores and delving into what sets more mature organizations apart from less mature organizations. For the MAPI cohort, we focused on examining human capital as a driver of risk culture and performance, as well as integration of risk management into strategy, and the board's role in relation to risk maturity.
Aon will continue its research with The Wharton School of the University of Pennsylvania to identify key risk management practices and processes that contribute to improved financial performance, as well as a deeper understanding of industry-specific best practices with respect to risk management. To date, more than 1750 participants from five continents, representing 28 distinct industry sectors have participated in the Risk Maturity Index. The tool is available in 10 different languages.
We encourage you to contact an Aon or MAPI representative with questions or comments. To participate in the Aon Risk Maturity Index, please visit aon.com/rmi.
The manufacturing sector exhibited the most growth in Aon Risk Maturity Index participation in 2017 and led all industries with 208 global participants. Nearly 60 MAPI members participated in the Risk Maturity Index as part of the Aon—MAPI collaboration project. Functional roles of participants ranged from risk managers, general counsel/legal, and financial to internal audit and insurance management.
To avoid duplication, MAPI responses were removed from the Manufacturing sector benchmarks and research. The findings found herein are proprietary to Aon and the Manufacturers Alliance for Productivity and Innovation (MAPI). Participant data is confidential and findings are only shared in the aggregate.
i 2017 Aon Risk Maturity Index Insight Report, published November 2017
ii People Fuel Growth, Aon Hewitt, 2016
iii 2017 Trends in Global Employee Engagement
iv 2017 Aon Global Risk Management Survey, April 2017