This is the longer version of an article I had published by Strategic Risk Magazine recently which can be found here: Strategic risk article
A few years ago I was asked by Strategic Risk Magazine to record a short video on what I would like to see change and improve in the Risk Management Profession. Having reviewed the video in the last few days I wanted to see if it was still relevant (Hint: yes it is! now more than ever!) Since I recorded the video, we have all gone through a Pandemic that has lasted 2 years and had a major impact on businesses, countries and societies globally. The video can be watched here:
During these last couple of years, aside from the crisis meetings focused on survival, we have seen organisations focus on restructures, new strategies and business models changing. Amongst other things, digital technology adoption and transformation initiatives have been accelerated. These are all areas where risk managers and risk departments should thrive, providing added value support for decision-making.
Unfortunately, this has not always been the case. Whilst I have seen Risk Mangers being brought to the top table for their insights and support during the pandemic I have also (and far too often) seen Risk Management (and therefore the risk managers) being cast aside or forgotten about for these important decision making meetings and initiatives. I therefore believe, now more than ever, that the suggestions in my video are even more relevant than before. So what are the key suggestions? Of course this is not an exhaustive list, however here are the three areas I discuss, all of which requires the risk manager to wander away from the comforts of their office desk.
Getting a seat at the top table
Risk Management / the Risk Manager needs a seat at the top table. If Risk Management isn’t featuring in decision making at the top levels, then what is the worth of having a risk management program? The Question is how do risk managers get invited?
As a first step, risk managers should be knocking on the door and asking for an invite. It is surprising how often this works. Assuming this doesn’t work then its important to catch their attention by demonstrating value.
During filming of “Risk Managers Getting Coffee” a question I often asked the guests was “What makes a great risk manager… what do you look for when recruiting for such a role?” The overwhelming answer was always around the soft skills. Communication, relationship building, adaptability, strategic mindset and a salesman-like ability to sell risk management. Whilst quantitative analysis skills, industry knowledge and company knowledge featured in the answers, they were always second to the important soft skills. These skills play a key role in being able to demonstrate the value of risk.
The risk manager needs to Identify influencers and allies who they may be able to approach to get an invitation in the first place. Failing an invitation, at the very least, it may give them a heads up as to when those important meetings are happening (This doesn’t need to be senior leadership meetings but it could be important innovation meetings, digital transformation meetings, project meetings etc). It also gives risk managers a starting point for relationship building in order to develop trust and an understanding of the value that risk management can bring them.
In order to demonstrate true value, the risk manager first needs to understand what is important to their senior executives and learn to speak their language. If the risk manager can understand what is close to their heart, such as a pet project or initiative, it’s a great starting point to offer help or support. And what does support look like?
There are numerous ways a risk manager can add value to senior executives. One way is simply meeting their team and discussing risks to the initiative/decision/project with the team and reporting this back to support decision making. Other approaches include optimising insurance programs, offering solutions to risks or running quantitative risk analysis. Quantitative risk analysis (QRA) can be tricky as it would require information and more time with their teams which may not be an option, however, where possible, then providing QRA data (in a digestible and visual format) will be something that decision makers will not be used to seeing and will usually leave a lasting impression, and with it, an invitation to the top table thereafter.
Its important to point out at this time that a senior exec is unlikely to be impressed if the risk manager only comes to them with roadblocks, negative risks or doom and gloom. Therefore it would be wise to consider opportunities and solutions to the risks or indeed what the deviations (both positive and negative) to the objectives may be when reporting back.
Gain Staff buy-in
Whilst proving value to top management and gaining their support is vital, equally as important is ensuring that the wider staff are on board. They are being asked to identify risk. They are asking to take time out of their jobs to support a risk management program that they often don’t understand, don’t see the value of, or don’t receive feedback from. It is therefore important to focus on communication. If people take their time to identify risk in their departments then the risk manager better make sure that they receive a proper thanks along with feedback on how their risks are supporting decision making or being escalated and used at the highest levels. This can be achieved by producing newsletters, creating (interesting and visual) annual risk reports, undertaking roadshows, creating videos, or getting away from the desk and meeting people on an individual basis daily.
Whether it be department managers or individual staff members, its important for the risk manager to understand what motivates them and again requires the risk manager to get out into the business and talk to people to understand their concerns about the risk management process as well as getting to know how busy they are (and at what times of the year they are most busy), the challenges in their job role, the challenges to their objectives, what motivates them (money, exposure to senior management, recognition etc). . This one-on-one time can be used sell risk management but also use another important risk manager skill, listening. These discussions alone already set the risk manager up with:
- identified risks (without the need for the staff members to go through a boring form or formal process and offering a great starting point for them)
- an understanding of the time-consuming or frustrating aspects of the ERM program that could be improved as well as how they like to receive information (detail vs visual for example)
- a good idea of how staff can be supported better to either avoid busy periods or receive additional support
- the opportunity to explain why risk management is important and how it might help them and their departments.
- a starting point for developing incentives and motivations for identifying risk and developing a positive risk culture
Risk Culture
Without the right risk culture in an organisation there is a good chance that even the best designed risk management program will fail. Risk Culture is the combination of values, attitudes and behaviours within an organisation in relation to risk management. This creates the foundations of an organisations approach to risk as it affects all risk decisions and ultimately the delivery of business objectives.
Building a positive risk culture takes time and effort. There is a large amount of work that needs to go into developing a positive risk culture which can take up several articles in itself however we will highlight a few of the key areas. We already discussed the importance of obtaining buy-in from the top as well as from all other staff in the organisation. In addition to this, developing a positive risk culture requires extensive training and hearts and minds sessions as well as constant communication to ensure an organisation-wide understanding of risk management and its benefits.
This requires the risk manager to be visible, approachable and an ally to the business. The following is a list of areas where the risk manager should be actively involved and will be the subject of a separate article that will go into further details.
Training
Risk Management Training forms a fundamental part of developing a positive risk culture. It is not only the technical aspects of the training but the hearts and minds.
Risk Workshops
The Risk Manager needs to act as a support to the organisation when it comes to identifying risks. Identifying risks consistently doesn’t happen overnight Facilitating risk workshops on behalf of departments can help them ease into the process.
Risk Champions
Risk champions can be a powerful tool in an organisation with few staff in a risk department. The risk champions, with the right training and understanding of the framework, along with the right personality and engagement, can act as culture builders in their own departments or functions.
This brings me back to the fact that the risk manager needs to be away from their desk more often than not and ask the right questions. They need to be seeing their risk champions, understanding what will motivate them.
Read more information about educating risk champions and building a successful champions network)
VIDEO CONTENT – Read about the Risk Culture Conversations and WATCH the videos here
Soft Skills of a Risk Manager and the Covid challenge
Essentially, what Risk Managers need to focus on, in order to take the risk profession forward, is their soft skills such as presentations skills, listening, speaking the language of staff, diplomacy and collaboration to name a few. Communication is ultimately key. Getting away from the desk and out into the business and communicating their aspirations and asking the right questions of staff to better develop a risk framework that fits in with their schedules and type of work and actually starts to add value to them.
But, this is not as easy when the organisation and its staff are dispersed. As we have seen this past couple of years, COVID has altered the way we work. Overcoming this obstacle is where another key skill comes into play: creativity.
If there are concerns about social distancing and not being able to meet one-to-one, or in groups in the office, then think differently. There are a number of alternatives that might work, such as holding outdoor meetings, investigating and using new technologies, hosting highly interactive and visual virtual meetings and workshops and/or adding risk as a regular agenda item in weekly team meetings and ensure that you attend as many as you can.
As we continue to navigate through the crisis, let us lean on our soft skills to better leverage the technical skills we, or other team members may have, to improve risk management now and into the future.
A Guide to Risk Management 