This is the third article in my series on creating a healthy risk management culture by nurturing 12 Enterprise Risk Management (ERM) cultural traits in your people. The 12 cultural traits (shown in green font in Figure 1) support specific phases of the ERM Implementation and Organizational Learning cycle. (For details on the cycle, see the Advisory issues of April 2011, October 2011, December 2011, March 2012).
In this article, I describe how to promote a culture that is Inquiring and Vigilant.
For most of us, the word inquiry doesn’t inspire a warm and fuzzy feeling. Instead, it can conjure up a scary image of being under a judicial glare where all our weaknesses, missteps, and omissions are exposed for all to see. It can also bring to mind a pesky young child who incessantly replies “But why?” to every answer you give.
question your status quo to get inspired to innovate and take advantage of upside risk.
extract meaning from it, i.e., determine what is relevant and important to act on now.
I find that anonymous voting approaches help people to accomplish the first task, i.e, to get their view of the information on the table. However, people are often reluctant to divulge the reason behind their vote and to engage in a discussion about which perspectives are the most relevant. As a result, too often the opinion of the majority or of the strongest personality prevails, even when that view is woefully incomplete or inaccurate.
For example, I often witness situations where the most senior executive in the room (often the CEO) “explains” why his or her view is ‘right’ and either ignores or discounts the opinions expressed by others.
Such autocratic behavior completely shuts down discussion about either the potential implications of the risk or how best to manage it. Whether it's intended or not, they are sending an immediate and strong message to the other people in the room that their views are not needed or valued by their leader.
The insidious longer-term effects are twofold. First people will be reluctant to contribute to future discussions of ERM because they don’t think they will be heard. As a result, the best possible information will not be available for risk decisions.
Secondly, it delegitimizes the risk management process. And if people don’t buy-in it will be difficult, if not impossible, to sustain the ERM program.
A healthy culture of inquiry enables your organization to surface and test assumptions about gaps and blind spots in the understanding of your risk exposures and the effectiveness of your risk management efforts. For three practical tips on how to deal with assumptions, see the June 2008 Bonus Resource article on The Achilles’ Heel of Risk Management.
A culture of inquiry is also foundational for organizational learning and innovation. For example, I find that when I drill down into operational risks with my clients, they frequently begin to question: “Why are we doing this activity?” or “Why do it this way?” or “Is there a way we can turn this to our advantage?” Questions are a powerful starting point for identifying opportunities to improve processes and ultimately performance.
To have a truly inquiring discussion all participants in the risk management process must articulate their views about the risk (including its implications for achieving the organization’s objectives, the options for managing it, etc.) and invite others to confront those views.
While these actions may sound simple, they require real courage on the part of the individuals both to speak up and to invite input on their views. Thus, healthy inquiry won’t happen if leaders fail to foster an atmosphere of trust and respect.
describing how they have evolved their understanding based on the input received. This is essential to ensure that managers know that their views have been honestly considered.
To build trust, senior leaders need to repeat this process consistently in the discussion of risks and ERM decisions. As trust grows, managers will be more willing to also embrace the culture of inquiry because people will feel safe to freely express their own point of view and invite input from others.
This month’s Bonus Resource article describes an online tool designed to help you learn and apply the skills needed to achieve a culture of inquiry.
An essential trait of an effective risk management culture is vigilance, i.e., to be on the lookout for changes in existing risks, for new and emerging risks, and for weakening in your capabilities and capacity to handle risks effectively.
Are you prone to these impediments to vigilance?
We don’t see risk coming because we fail to monitor risk levels or track trends in our business environment. Thefactors that drive risk in your external and internal business environment are constantly changing. If like many organizations you conduct an enterprise risk identification and assessment process once per year, you are likely missing significant changes in your risk exposures that occur throughout the year.
Ceding management attention to other issues. For example, a manager becomes distracted by other priorities and pressing issues of the day, and neglects her ERM duties.
Complacency. When the risk level is low or static for a prolonged duration, we can get lulled into a false sense of comfort that it won’t occur and subsequently let our guard down.
We don’t provide ERM training to people who are ‘new’ to either the organization or to their risk management roles. People move into different roles as part of the normal churn within all organizations. This can lead to situations where people who are new in their roles are not fully aware of their risk management responsibilities and/or not equipped to carry them out.
Make it a discipline to monitor risk and track trends in both risk levels and in the underlying drivers of risks. It’s resource intensive to measure risks, so be strategic about which risks you monitor and how often. It’s good practice to pay close attention to those risks and risk response capabilities to which the achievement of your objectives are particularly sensitive. Consider matching the frequency of monitoring to the expected velocity of the risk, i.e., monitor risks that can materialize quickly more frequently than those risks that will unfold slowly.
Periodically test your risk response capabilities. Table top exercises can reveal gaps in preparedness. Mock crisis response drills and full-scale exercises can expose complacency in terms of readiness to respond.
I’ll address the remaining 6 ERM culture traits in future Advisory articles.
To achieve a proper understanding of enterprise risks, executives must lead by example to establish the trust and respect that support a culture of inquiry. The way to nurture a culture of vigilance is to systematically monitor your risks and periodically test your risk response capabilities.
Download a printable version of the entire March 2013 issue of the Risk Management Made Simple Advisory.