Traditional risk management that does not account for integrated reporting fails to detect critical risks.

In organisational risk assessment, financial risk assessment (and financial risk management) comes first, followed by occupational injury risk prevention and physical security risk assessment and risk management, especially for properties and facilities that are more vulnerable to crime or terrorist attacks.

Considering only these three risk areas, three specialised groups of experts deal with the respective risks, assess them, and prepare and implement appropriate measures to prevent or mitigate financial, personnel, or physical accidents. Of these three groups, only the financial risks are integrated into business plans, models, and reports. Simultaneously, the other two are only present in financial plans on the profit and loss side and are sometimes mentioned but not integrated into balance sheet reports.

Although there may be exceptions to the general situation briefly outlined above, most organisations address risks at the measurement and prevention levels. The costs of measuring and preventing various risks are included in the income statement (P&L), not in the balance sheet. Risks are measured as costs, not as fair values or liabilities.

Risk detection

Investopedia lists under liabilities where the measurement of risks is/should be found:

Current liabilities may include:

• Current portion of long-term debt
• Bank debt
• Interest payable
• Rent, taxes, utilities
• Liabilities from wages
• Advance payments from customers
• Dividends payable and other

Non-current liabilities may include:

• Long-term debt: Interest and interest on bonds issued.
• Pension fund liabilities: the money a company must pay into its employees’ retirement accounts.
• Deferred tax liabilities: Taxes that have been accrued but will not be paid until another year; in addition to timing, this figure adjusts for differences between financial reporting requirements and how taxes are measured, such as when depreciation is calculated.
  

And that’s it! You’ll only find liabilities related to financial capital and financial liabilities related to the workforce’s financial part, without even a hint of risks related to other capitals, social, intellectual, productive, and natural.

Before we take a step toward the apparent conclusion that companies should find a way to value liabilities, let’s update a list of possible risks and liabilities.

We already know that any rational investor, if not intuitively, evaluates all liabilities, not just financial ones, when buying stock or entering into any other transaction with an organisation. We all evaluate organisations holistically and consider all possible risks at all levels. I can’t mention all of them as there are too many. In the next section, you will find links to various resources on possible risks compiled in 10 minutes.

International Conference on Risk Assessment (in Health). Toxicology and Risk Assessment Conference. Trust and Reputation Risks. Defence &HSL conference. Cybersecurity. Workforce Legal Risks. Intellectual Property at Risk. Machine Safety Risk Assessments. Safety Leadership Conference. Etc. Etc.

Liabilities in integrated reporting

My intent was not to provide an exhaustive list but to point out many more potential risks, making liabilities tangible. While some are industry-specific, many affect every organisation, even if their manifestation varies by each organisation’s business model.

My point is that risks at all levels should be assessed as costs and liabilities, expressed in both words and figures in the previously designed balance sheet report through the integrated reporting process.

In dealing with such an integrated reporting system and an integrated balance sheet report, we face two types of challenges:

1. To identify specific threats/risks/liabilities for each key business model mechanism that provides value in addition to each of the six capitals.
2. To consider that each mechanism does not act in isolation but depends on all other business model mechanisms.

Business model and risks

The first task is easier to accomplish. One should start by delving into each business model process and identifying the critical KPIs (materiality-based) that contribute most to that process’s success and thus to the business model as a whole.

There is no extrinsic rule on selecting the most important critical points, as there is no general rule for this, just as there is no general business model. Each business model is unique, just as each person is unique, even though most of us have two legs, lungs, and brains. There is no outside help to define a model by which each of us evolves as human beings. The practice and theory of integrated reporting only point to the most common places to find KPIs, but each capital exercises its values uniquely. The six predefined capitals are only there to help us define the overall value of the capital. But again, there is no extrinsic rule for the number of capitals present. One could easily find more capitals by finding smaller capital units within the six capitals defined by IR procedures.

So for starters, we know that not only financial but also produced, intellectual, human, social, and natural capitals should be defined by business model mechanisms so that each mechanism tackles at least one of the six capitals, and that in the end, each capital is defined or contained in at least one business model mechanism.

The holism of risks

Let me emphasise here that I firmly believe that one should not take such a mechanistic view of business modelling as explained above. The organisation is much more than a sum of individual processes that can be described digitally. But for the sake of risk assessment and risk management, one should at least pretend to have a mechanical handle on the individual processes. The crucial point occurs in the transformation of risk management, which is treated as a cost, into a liability, which is treated as a value on balance sheets. This transformation simultaneously shifts the digital/mechanistic view of the organisation into an analogue, integrated view of organisations as holistic organisms.

The transformation from cost to value, from the income statement to the balance sheet, from digital to analogue, occurs through mechanisms addressed by the second task: to understand and describe (as much as possible) the interdependence of all critical issues.

Let me give an example: The physical safety of a nuclear power plant depends on:

• The human skills of the safety personnel.
• The quality of the products that are integrated into the safety systems.
• The value added (profit) created by a plant is attributed to the safety systems.
• Relationships with the local community, which is the second line of defense for the nuclear power plant’s safety.
• Appreciation of natural resources, such as water that cools the reactor of the nuclear power plant.
• The number of experts that the educational system provides to the nuclear power plant.
• Safety and other management procedures.
• And so on.

Each of the mentioned values/risks/capital depends on all the other mentioned and unmentioned capitals. The number of interdependencies is so great that it (the number) produces rationally unanticipated outcomes, emergencies. Distress is a necessary outcome of any complex system, such as a human or an organisation, due to many interdependencies. An example of such distress at the organisational level is the balance sheet report.

It should now be clear that the main challenge in integrated reporting is to identify the risks associated with adding value to each capital and report on the risks in a way that considers the complexity of the relationships that ultimately lead to the balance sheet reports.

This also necessitates the organisation not separating the identification and assessment of the various risks. While the specialists must manage the risks, the identification and assessments should be understood holistically. I want to be assessed by a holistic doctor, treated by a highly specialised surgeon, and then assessed again by a holistic doctor at the end.

Nuclear reactor management should employ highly specialised safety personnel who don’t have much time to think, as they must act quickly and reliably. But the task of assessing the complexity of the risks to nuclear reactor safety and evaluating the results should be undertaken by experts in holistic, integrated thinking who understand the emergencies that occur by default in complex systems.

I hope it is clear that such a holistic risk management applies to all businesses and not only to nuclear power plants.