IAG’s risk management model, where the CRO reports directly to the CEO and the board’s risk subcommittee, is a “best practice example” of how companies should handle risks, according to Deloitte Global’s latest report.

The Australian insurer’s model reflects the views of the 54% of respondents surveyed by Deloitte who want their CROs to spend significantly more time playing the role of strategist and having a say in setting the company’s strategic direction.

“In order for organisations to build closer alignment between value creation and risk, organisations agreed the role of the CRO should be elevated to increase synergy between boards, C-suite executives and CROs,” Deloitte says.

“The IAG model…  was called out as a best practice example of a business and risk management interaction that is scalable to any size organisation.”

IAG MD and CEO Peter Harmer, who was one of the CEOs interviewed, says in the report that “business is all about risk and reward, so strategy and risk are two sides of the same coin. Strategy discussions in the firm very quickly turn into conversations about risk.”

Deloitte surveyed more than 300 stakeholders from the C-level or board level, excluding CROs, globally for the report.

Almost nine out of 10 companies recognise that risk management should focus on value creation but less than one in five are taking sufficient action to address this.

About 82% believe they are taking the right amount of risks and 82% are either extremely confident or confident their risk management activities are optimising outcomes across the company.

“Given nearly nine in 10 survey respondents across all sectors think value creation should be a key focus of risk management, it is of concern that only one in five are actually implementing the necessary improvements,” Deloitte Risk Advisory Australia Managing Partner Dave Kennedy said.

“Historically, risk management has been a reactive or tick-the-box exercise.

“But as companies begin to link the risk conversations to business strategy and superior performance, senior executives are becoming aware that customer loyalty, increasing operational resilience, improving cost effectiveness, and identifying and exploiting new business opportunities are inextricably linked to how they manage risk.”