Do you struggle to demonstrate your value as a risk professional?

Many of the metrics used to measure efficacy are input-focused. Training completion data, recording things (payments, gifts), ensuring boxes are ticked (clauses, questionnaires, etc.). The output is much harder to measure and often counter-intuitive. Let’s unpack.

When they’re quiet, I worry

Our six-year-old is like a talk radio host; he never draws breath. Yesterday afternoon, my wife and I realised there’d been an unprecedented 20 minutes of silence. We walked, with increasing speed, to his room. Was he okay? Why the silence? He’d broken something he shouldn’t and was busy trying to fix it silently. The absence of data was data.

Our newly adopted dog, in contrast, is silent almost always. When she let out a menacing growl yesterday evening, we all paid attention. Had she finally awakened her prey drive and spotted my wife’s nemeses – the rat pack who decimated our compost?

In risk terms, if people aren’t coming forward, that’s cause for concern. Just as when quiet people speak up, we must listen. That’s very tricky to articulate to senior managers without context. Speak-up data presented in a void is like sales data devoid of demographic or economic context.

To set speak up data in context, we need to ask questions. For example, comfort speaking up, admitting mistakes, trust in the investigative framework, and so on.

When we compare speak-up averages set against “trust” data, we can develop strategies to reach and support those uncomfortable, unable, or unwilling to speak up.

Risk as enabler

Most ERM frameworks (that I have seen, at least) are underwhelming. “Risk” at the strategic level is as convincing as your average New Year’s resolution list – a bold statement of intent with less useable substance than a school dinner.

This is such a shame. Risk is an enabling force. Taking risks is part of every success story—the right risks. There are three areas in which I see risk used strategically (consistently). Unsurprisingly, they all have a commercial aim.

1. DFIs – Development Finance Institutions (and some impact and private equity investors) see the value in strategic risk. When investing, they WANT to know the risks and how to fix them. The terminology differs, but the goal is identical. Identifying and addressing risks in their investments makes sense. Less headaches, better returns (good governance has a premium, increasingly), and easier to exit.
2. Market-sizing – Organisations considering new markets, segments, or sectors will (sometimes) weigh the opportunity against the risk exposure. If 80% of a given segment is dominated by corrupt state-owned enterprises, focusing on the 20% who succeed despite(not because of) the cronyism often makes commercial sense (they’re good at what they do).
3. Innovation – If your people shy away from taking risks or conceal those they do take, that hampers innovation. Increasingly, dynamic organisations (or those needing that impetus) are using human risk assessments to understand not just exposure but missed opportunity.

Let me know if you’re struggling to get leaders to see the upsides of risk management. I have some ideas.

Pain-savers

I worked with a colleague who had a test at the end of the six-month probation period for employees, “Are they more pain-saver or pain-giver?”

It stuck. Many risk folks are conditioned to see what’s wrong with an approach, system, or concept. We may feel that is our job. The sentinel shining lights on the unlit path, identifying potholes and dangerous corners. Avoiding these pitfalls may seem evident to us (“slow down, steer”), but we risk being cast as pain-givers until we see our job as co-pilots, not headlights.

Pain-saving is quite simple (in concept if not application). Provide timely inputs about direction, speed, and what’s next. Do this in a language the driver(s) speaks, clearly and with sufficient time to adjust. Again, there are plenty of examples to share if they help.