A key challenge to risk transformation is developing an enterprise-wide risk culture to increase risk awareness and accountability. However, most organisations are struggling with how to assess culture, and how to change it, let alone establishing the needed change teams, action owners, and milestone for risk cultural change.
Culture is a pattern of shared experiences, expected behaviours, beliefs, assumptions, attitudes as well as written and unwritten ways of doing things. Culture is both emergent and learned, and created from both internal and external factors. Cultural change is most successful when it incorporates:
- Role modelling and “accompaniment”
- Developing talent and skills
- Creating “social capital”, and
- Implementing formal mechanisms, such as well-defined roles and KPIs.
Social capital comprises three dimensions:
- structural – developing network ties where people trust each other and commit to shared activities
- cognitive – establishing a shared taxonomy and evolving informal codes of practice
- relational – identifying as a group with associated trust and obligations
In order to transform the risk value shop “problem solving” activity, analytical skills that span the organisation will need to be quickly developed in the already changing workforce. These skills include mining structured and unstructured data and unstructured data, identifying data risks, working with databases, applying statistical methods and advanced analytics, leveraging analytics in risk assessments, and presenting complex data analysis visually.
Pooling of risk data is crucial to collecting statistically significant data for predictive models, and willing collaboration is needed to drive this sharing of data across all business lines. The creation of a “single view of risk” through collaboration, will also enable risks and controls to be treated holistically, increasing effectiveness and efficiency.
Talent with an innovative “test and learn” mind set and creating a culture of innovation is also necessary to transform the risk value shop “problem solving” activity. Innovations may include tapping into gamification – harnessing game-playing principles such as competition to motivate development of “out of the box” risk treatment options, or harnessing the power of crowdsourcing by holding operational analysis / risk analysis hackathons.
The risk value shop “choice” activity includes determining and articulating the risk philosophy and risk appetite, setting risk objectives, and making decisions between alternatives. The required cultural change includes explicitly tasking business and technology process owners with both organisational objectives and risk management responsibilities and giving them a support infrastructure such as a Community of Practice (CoP) or Centre of Excellence (CoE). These constructs require talent with critical thinking skills as well as hands on experience in technology, business and risk, in order to act as a thought partner and guide strategic decisions.
A Centre of Excellence transfers best practice and learning derived from “bottom up” benchmarking, and has four key elements
- Authorisation – assisting to align resources with strategic objectives
- Standards – establishing standard tools, templates and methodologies
- Education – providing training and education to all concerned with risk management, and
- Readiness – establishing whether an organisational unit is ready to use the required methodologies
A role of the transformed central risk function (as CoE) in the “choice” activity, is to cascade down (and explain) the risk appetite statement, risk approval delegations, and risk appetite measurement metrics. These metrics are risk, financial and operational indicators linking risk appetite and business performance at each level of the organisation. A consistent and global application of risk management disciplines provides the benefits of greater insight into key risk drivers and indicators, increases in operational efficiency, service improvements and higher customer satisfaction, decreased risk exposures; and improved strategic decision making.
One cognitive change that needs to occur to transform the risk culture around the “choice” activity, is operational staff seeing risk decisions as their own business decision and not the responsibility of a central risk function. Another cognitive change is having a forward looking strategic approach (“what risk return trade-offs to we need to make in the coming year”) rather than a backward looking approach (“how did we do over the last year”).
[/et_pb_text][/et_pb_column][/et_pb_row][/et_pb_section]