Yesterday morning, I was interviewed on a podcast for a risk management publication. The host supplied some talking points in advance. I usually write a few bullet points under each and have that on the second window. I’m concerned about rambling; the precision of bullets helps, especially as I’ve done this podcast before, and they like to keep it to 20-30mins.
Reading back, maybe these bullets might help:
Question: How can a performative and box-ticking approach to compliance be changed? 🚦 Conduct assessments that actually assess risks (3D—external context, internal controls, behaviour & culture). We need to identify the 20% of activities or interactions creating 80% of the risks if we’re ever to meet people at their operational reality. 🚦 Be honest about where ethical intentions meet risk realities - I don’t see many risk frameworks that prepare people for risks. For example, does your anti-bribery and anti-corruption training include realistic scenarios where corrupt officials might use power differentials, status, and community pressure to try and extort “rent.” 🚦 Focus on the two or three areas where you can have a meaningful (positive) impact, not promising all things to all people and delivering nothing. ESG can incentivise this all-and-nothing approach, but if you pick the couple of Sustainable development goals that matter to you, might we achieve more than endless form-filling? 🚦 Consider the user experience - much compliance content is written for regulators, not stakeholders. We must reframe that, focus on the Call To Action, what is the why… nothing else matters.
Question: How can rules and regulations be simplified? 🚦 By understanding the intention. What is the behaviour you want to drive? 🚦 12-year-old test - only 17% of survey respondents say that policies can be easily understood by the average employee reading age. 🚦 Phone analogy - think about creating systems and tools like smartphone manufacturers do - imagine someone ‘picking up’ your policy or training and trying to use it without reading a manual.
How would you have answered those questions?
Fraud scores on the doors
I realised that I publish these scorecards (fraud, investment, compliance maturity, external risk, etc.) and have all this useful data, but I don’t often share it. It’s time to correct that, as I know many of you love to benchmark yourselves against peers.
The results from the Fraud Prevention Scorecard quiz (shared in last week’s edition) highlight a significant issue. Okay, big caveat first: we’re only talking about the results of ~10 organisations so far. BUT, there’s a concerning trend regarding the effectiveness of fraud training.
There is also an apparent lack of communication and implementation of anti-fraud policies across the board, as evidenced by the 100% low scores in this category. Initially, I was surprised. Then I remembered all the inductions and training I’d been through (as an employee, embedded consultant, in-house, etc.), and I can’t remember a single one that singularly mentioned fraud. Can you?