Reducing information overload
Where to start? – We can all read the risk prognosis from consultants, auditors, cyber experts, insurance specialists and many other knowledgeable groups. All are probably correct with their evaluations. So if all are correct, and many are proposing different risks and consequences, then, as a risk manager, I need to create insight into what this means. But before creating a report for the board members and c-suit players two key elements are necessary:
- A level playing field across all risk categories and input sources.
- Removal of any cognitive bias I can have as a risk manager.
One key assumption here is that the objective of the insight is to help the organisation to achieve its strategic goals. Figure 1 shows an image of information gathering being used to provide insight into the achievement of these goals. This encompasses not only risk but also opportunities. As risk managers, we need to provide relevant information, both good and bad, to our stakeholders. This means knowing where we are, what benchmark are used, where we are going, what is timely and significant and all in three bullet points. However, the two points above are affecting possible insight.
Built into any organisation is bias. One example of this possible bias originates already in the hiring process of risk managers for companies. Many financial institutions are looking for risk managers who have a background in audit, experience of the financial world and, when possible, in back or middle office. All this even though experts in back office protocols, who are already advising on potential risks and opportunities, exist. A bias will ensue if im not carefully managing the process used. For any company the risk universe is made up of top line categories. Each company will have all components of this universe spread throughout the organisation. Risk blind spots of such an approach arise due to focusing too heavily on one risk area. Typically, that in which we do business.
Where risk management is embedded and mature, experts in each area can provide information and data that is used to create insight by the risk manager.
However, If the risk manager is also focused too heavily on one area of business then there is a risk of underestimation, or even of crossing off some risks as not relevant as we have seen from the COVID-19 pandemic. Scenarios were company centric and not taken to the extreme. Most risk simulations need a worst-case scenario to give reliable results and, as COVID-19 shows, this was not realised.
Consequences of risk blindness are a reduced number of opportunities which have a realistic chance of success and a lower likelihood of achieving the strategic goals. Leakage, due to reactionary management actions, will play a greater role than leading the organisation forwards.
Functional heads need to be animated to improve the risk mapping through facilitated workshops and coaching sessions. Its not additional work nor complicated. Its advising risk owners where to effectively focus efforts. And the aggregation of risk and opportunity actions need to be weighed to compensate for any bias we might have included.
So with the sector and function specific risk and opportunity information being captured ( Initiator and impact in the above graphic) by these specialists the risk manager can focus on two key steps.
Step 1 – Know where your going.
Functional managers do a great job in capturing the essential, risks and opportunities, of where your company is. There are however, elements where the risk management skill set plays an important role. The road to the future will not be straight. Company resilience and business continuity planning will provide resistance to some risks. When looking externally there will be market and social amplifiers and accelerators to risks and opportunities. How these impact the future, company direction and emerging risks and opportunities will be the insight given by the risk manager.
Step 2:- Extended Strategy mapping
Strategy mapping was designed to be used for shareholder value. Today we need a stakeholder mapping giving a longer-term view. The extended strategy mapping highlights different aspects of the risk universe that can influence customer and external risks and opportunities. Again, each functional head can incorporate this into their information sources and thereby enrich the risk/opportunity mapping.
Insight
As each risk owner deepens the information and insight in their own area the risk manager can identify clusters of relevant information and advise the board members and stakeholders accordingly. As its forward focused we will be advising on risk and opportunities that we might have missed through trending. The key reason being as companies become more agile and dynamic effective trending becomes more out of tune with where we need to be. The company, as a whole, becomes more proactive.
A culture transformation will take place focusing on future risks and opportunities rather than being lost in problem solving in the short term.
Practically speaking what can a dashboard like this look like?
As many of the global data sources are country focused we can ensure we are providing real time support to the particular company or factory in question. We can identify any systemic issues and be timely in our action plans.
Through the supply chain focus we can identify any bottlenecks or risks in our customer/supplier community and mange accordingly. Some indicators are fast moving such as productivity and stability. The dashboard provides practical information for decision making which is combined with human elements, financial drivers and