It was one of those sunny days in early spring where kids were playing at the playground. Having a chat with another father, we rapidly talked about work. After exchanging on our experience on home office with young kids around, our discussion went inadvertently on risk management.

This acquaintance – let’s call him Dan – works in a small-medium sized company active in logistics. To achieve quality standard, they have introduced enterprise risk management a couple of years ago. There were initially a lot of expectations. For instance risk management would help the management team to better anticipate possible problems/crisis. Unfortunately it became quickly a complicated process that got turned into a paper exercise after they had a ‘specialist’ helping them to set it up. Then came the ‘unexpected’ pandemic – which was not identified as a risk scenario in their register – and it finished to discredit the whole thing.

I’m a true believer in risk management.  It should not only help making better decisions. It can also make strategic planning more effective. Besides, it can provide assurance to the owners/shareholders that risk is being managed in a systematic way. The problem is that once you go out of the ‘risk management expert circle’ (where we are all convinced that risk management is great), people are way less enthusiastic and convinced that risk management can actually create any value. Instead it is considered as some kind of a Rubik’s cube game (also called risk matrix) and/or a paper exercise to fulfil some compliance requirements. In that sense, Dan’s words did not really surprise me.

Nevertheless, in the following days (or rather evenings) I wondered how I could help Dan. I went back to my books and tried to find out how to put up a pragmatic approach for him.

The risk management techniques

I realized, that too often we focus our discussions and effort on putting up some risk management techniques. Should we use a matrix, or Monte Carlo simulations, or bow ties or, or, or …   and describe it all in a risk management process. Although this is an important feature, the techniques alone will not bring you further if you do not know how to use them and what to do with the information coming out of it. It is like building a house with having a plan only for the kitchen, and no idea on how the rest will look like. For which type of inhabitants has it to be designed for – a big family, or a young hipster couple?

The tone at the top

Therefore one key discussion to have with the decision-makers is how will they use the risk management information. We could call it the top management tone. This is essential as it will also influence how much resources will be invested in that endeavor. In the case of Dan, the following questions should have been discussed with his management team:

Are we having a risk management process in place to fill some compliance gap? Or are we going to use it as a management tool to help us to develop and adapt our strategy in that fast pace changing global world where logistics is playing a more and more important role?

Developing talents

To have this discussion, of course you could hire some consultants to help and support you in the development of a risk management program. The risk is that once the consultants are gone – like in the case of Dan – non-risk management experts are left with a ‘strange baby’ on their arms. It is important to invest in talent. It is therefore key to develop people at all levels so that the risk management is truly lived. That can be part of the mandate given to the consultants, or that can be a decision to train specifically one (or more) employee so that he/she becomes a part-time risk management practitioner.

Depending on the size of the company, you can also hire dedicated specialist(s). The challenge when hiring a risk management expert, is to find someone who knows about risk management and about the core business of the company (e.g. logistics). If it is not feasible, then sufficient time should be invested for the newly hired risk management guru to be taught about the core business of the company. This is to make sure that the risk management process will be proportionate to the level of risks faced, and adequate for the type of business.

The taste of risk management

Understanding the company and the strategy that a risk management process will have to support is key to make it effective. Let’s take the example of Kodak in the early 2000’s. Kodak was all about creating memories by making ‘Kodak moments’, i.e. making analog photography.

Although it had invented digital photography decades earlier, and despite knowing the disruptive potential of this new technology, it kept focusing on remaining number one in the photography market. How can we sell more? How can we consolidate our leading position? What are the risks affecting our performance? The company culture was all about being as performant as possible. Risk management was used to support the decisions focusing on efficiency and market share. It is one of the reasons why it failed to embrace digital camera technology and went bankrupt in 2012.

That example shows us that without the right working culture, the best designed process will never achieve to have all employees building an awareness of risk. It is likes spending hours on baking a beautiful cake, whose taste will be disgusting. This is probably the most tricky part, as it relates to the people, their behavior and attitude towards risk, and somehow to the company’s values. It is therefore important to consider those aspects when putting in place a new process: what will it taste like? What is the current working culture, and what is the desired one?

We all love tools!

One final aspect to consider is what kind of tool is most suitable to support the management of risk. It can go from a basic Excel list, up to a latest generation software handling all governance, risk and compliance matters. You can find several rankings on internet on which software is best for your business.

The fact that modern technology is creating so many opportunities to link people and business, and better understand business thanks to data science, probably explains why it makes the topic so interesting for all of us. You sit in your home office (or in a meeting room like it was the case before the pandemic) and get impressed by the capabilities of this new tool that nice people (i.e. sellers) comes to present you. And before you know, risk management is all about acquiring a new tool that will be able to automate many processes and make our whole business more efficient.

One thing is clear, tools can contribute to make your management of risk more efficient and more effective. But tools alone, without the elements described above will not achieve much, and still cost a lot of money.

Final words

Last but not least, and coming back to Dan’s point about the unexpected pandemic, it is key for the risk managers to reflect on the last years and recognize that we did not help to better prepare our businesses for that crisis. The risk management expert community should ask itself why and how to get better for the next crisis.

The Five T of risk management:

• The Tone at the top
• The Talent working on/with risk management
• The Technique(s) used to manage risk
• The Tool that will support the risk management process
• The Taste of managing risks

We would love to hear your thoughts about this post and the following to come. It would be of great importance to us to learn what you would love to read more about, if you like our blog and would come back, and what you’d like us to write more about. Please take a moment to rate our post and discuss with us in the comments section below – or send us a private message.

If you liked what you have read, please share this post and refer us to a friend.