Internet tool will diagnose risk management controls.

Byline: Kit Bingham

An independent risk management consultancy has developed a web-based tool for analysing the effectiveness of companies' risk management and internal controls procedures.Richard Anderson, founder and managing director of the Corporate Risk Group, says: "By asking 30 to 40 questions, we can get a good picture of how a risk culture operates in an organisation."

The online questionnaire, known as Dimensional Control diagnostic, asks how companies seek to manage risk in five principal areas. For example, it looks at whether a company tries to prevent risk, or has plans for minimising the impact of that risk if it materialises. It also looks at which individuals or groups are responsible for managing specific risks.

When the same questions are asked in different parts of a business, such as head office and business unit level, it reveals whether controls are effectively embedded in an organisation or applied only locally.

"If you find you have a different risk culture in different areas of the business, you have a problem. We can help the audit committee and the internal auditors understand how their controls work across the company," says Anderson.

In addition to diagnosing the effectiveness of companies' controls, Anderson's group will also provide consultancy on designing risk management systems and exploiting them to deliver value.

He argues that companies need to feed their internal controls and risk management processes into their strategic thinking, rather than viewing internal controls as a compliance box to be ticked.

"Risk management is there to help develop sustainable value. It's lost that edge at the moment. The whole risk and assurance debate needs to be ratcheted up and fed into strategy and not compliance, which is where it sits in many organisations," he says.

Anderson fears that the Turnbull guidance on internal control, which is part of the UK's combined code on corporate governance, has caused companies to take an overly simplified approach to risk management.

He says: "Turnbull was not a bad piece of work but its applicability has been harmed by saying that all you need to do is get to grips with your top 10 to 12 risks. I think it's a lot more than that."

Anderson founded Corporate Risk Group in 2001 after leaving PricewaterhouseCoopers, where he was leader of strategic risk services.

He numbers BP, Diageo, Cadbury Schweppes, Unilever and Kingfisher among his clients. Corporate Risk Group has a strategic alliance with Enterprise LSE, the consulting arm of the London School of Economics.kbingham@efinancialnews.com