1) How to 'sell the risk management' vision and generate senior executive engagement and support. Too often the business value of risk management is difficult to articulate and the end goal is ill-defined resulting in challenges in getting the senior executive team to back up their supportive words with the right actions. An additional challenge is enabling the senior executive team to make sure that they are engaging with their direct reports on risk and ensuring that the risk management activities were not seen as an exercise in 'beating people up'. For many firms risk champions have a key role to play as change agents who operationalise the vision within the business and maintaining engagement both vertically and horizontally.

2) How to create a simple and consistent process and approach to the building blocks of a risk management framework, such as risk registers, risk assessments and risk reporting. The frequent use of spreadsheets at this initial stage often lead to the risk team being diverted from their mission of enhancing the firm's approach to risk management, to a mission involving chasing people to complete spreadsheets, consolidating a large number of spreadsheets (which had often been adjusted by the business) and manually generating risk reporting.

With the initial risk management approach established the next stage on the journey was to build on it to incorporate more elements such as controls, KRIs, and Risk Events. Additionally, part of this 'build-out' included focusing on improving the governance related to the risk management approach and embedding clear accountability and ownership for items within the framework, such as risks, controls, indicators etc. One of the key governance challenge's revolves around ensuring that there are clear lines and boundaries between the 1st, 2nd and 3rd lines of defence.

Another major challenge in this second stage revolves around enabling the risk management process as a business as usual process with the critical trade-off between 'throwing people at the problem vs investing in an appropriate enterprise-wide technology solution that can act as a central repository for all things risk-related.

In the 'final' stage of the risk journey the focus increasingly moves to taking the risk management approach to the next level of maturity to affect real and sustainable business change, in order to align the risk management activities to the business strategy and risk appetite and deliver real and sustainable business benefits.

1) The risk management framework should be actively monitored and managed to ensure that it aligns the organisation vision and strategy, and takes into account the firms customers risk appetite.

2) Delivering real and sustainable business benefits. These benefits should be both tangible and intangible; for example enabling the release of regulatory capital and reduction is the cost and volume of operational losses are real and tangible benefits that can provide a positive ROI from the risk management activities and generate on-going support and engagement.

3) Enabling the organisation to adopt a performance-based pricing model and/or enabling the organisation to enter market sectors that are regarded as 'high risk'. However, because of internal risk capabilities, the firm can be priced competitively whilst maintaining a better average margin than competitors.