Building a Risk Management System That Works

This deck provides a step-by-step process for creating, monitoring, and maintaining a risk management system that actually works.

#risk #riskmanagement #leadership #management #riskmanagementsystem #chiefriskofficer

risk, risk management, leadership, management, risk management system, Chief Risk Officer

Transcript

1. Building a Risk Management System That Works Vincent H. O’Neil www.vincenthoneil.com 1
2. This May Sound Familiar  “Risk Management? That’s not my job. Don’t we have a department for that?”  “Risk Management’s just a bunch of pain-in-the- neck rules that don’t do anything.”  “Oh yeah, we do annual training for that . . . You get through it as fast as you can and then get back to work.” 2
3. Risk Management is Everyone’s Job  In the last few years, millions of people lost their jobs because of risky practices in a small number of industries  Within those industries, thousands of people lost their jobs even though they followed the rules and knew nothing about the unacceptable risk being taken in other parts of their firms Risk management is your job because it can cost you your job 3
4. Everyone is a Risk Manager  Even with all the people and systems dedicated to monitoring risk, dangerous practices are often discovered by people not assigned to a risk job who were just keeping their eyes open  In 2010, a car bomb parked in Times Square was safely removed because a t-shirt vendor operating nearby reported the vehicle as suspicious. Not a police officer. A t-shirt vendor. Everyone is a Risk Manager 4
5. Risk Management is Not a Department Risk management is  a system,  an awareness,  and an attitude 5
6. Risk Management is a System Here are some of its components:  Processes for monitoring, analyzing, and reporting risk  Policies and regulations  People designated as Risk Managers  People designated as Managers of any kind  Every employee  Every department 6
7. Risk Management is an Awareness That awareness is created through:  Training  Continuous reinforcement  The understanding that risk threatens everyone  Historical examples of how risky practices have been detected—and what happened when they weren’t 7
8. Risk Management is an Attitude That attitude is generated by:  The recognition that risk anywhere in an organization is risk everywhere  Training in how to identify risky practices, coupled with the means to report them  Discussion of examples proving that individuals can put a stop to the risk that threatens their very employment 8
9. Building the Effective System Here are four elements of an effective risk management system based on the premise that everyone is a risk manager: 1. 2. 3. 4. Emphasis from Senior Management Training at All Levels Effective Monitoring Corrective Action 9
10. Emphasis from Senior Management  Senior management must take the lead in creating a risk management climate which encourages every employee to study, understand, and monitor risk  This can not be a one-time, or even a once-a- year, thing: Creating a risk management climate is an ongoing effort 10
11. Emphasis from Senior Management The CEO as Chief Risk Officer:  Although the organization will still have a Chief Risk Officer, senior management must be seen promoting risk awareness  This will not only motivate subordinates to do the same, but it will also serve to reinforce the seriousness of this effort  One possible route is to treat this like an internal advertising campaign, with posters and videos showing various employees, from senior management on down, stating, “I am the Chief Risk Officer.” 11
12. Emphasis from Senior Management Frequent, meaningful reminders:  Senior management plays a key role in creating a sustainable level of risk awareness, and should take the opportunity to provide some of the instruction themselves  From breakfast speeches to classroom-style training and off-site seminars, there are numerous ways for leaders to reinforce the institution’s dedication to risk management 12
13. Emphasis from Senior Management Enforce the rules:  All the talk in the world will not create risk awareness if violations are not corrected  Remedial training and verbal reprimands can reinforce a risk management system, but they must be backed up, when appropriate, with more serious punishment including termination 13
14. Training at All Levels  Building an all-around risk management system is not an easy task  Overcoming complacency and ignorance is often a function of motivation, and so the training must convince the participants that risk management is important—both to the institution and to them as individuals 14
15. Training at All Levels Offer a free, recognized, and transportable Risk Management certification course:  This is an excellent way to motivate employees at all levels to learn the fundamentals of risk management  It can be an internal program, an external certification, or a combination of the two  Employees who complete the course and receive this certification will know what they’re talking about—and what to look for 15
16. Training at All Levels Sustainment training:  The training effort must be more than an annual or quarterly requirement  Middle and junior management can take the lead here  Using a series of brief, “snapshot” lessons, these midrange managers can reinforce the message that the danger is real—citing examples taken right from the news which show how people not assigned to “risk” jobs made (or could have made) a difference 16
17. Training at All Levels Constant reminders:  Flash videos, wall posters, and junior management talking points can serve as a frequent reminder of the importance which the institution places on risk awareness  To gain the proper impact, these reminders could be focused on the consequences of failed risk management, citing the number of jobs lost and legal penalties incurred 17
18. Effective Monitoring  Most large organizations already have a risk management structure in place, but merely appointing a risk hierarchy and installing monitoring software isn’t enough—even if this system is fully understood and obeyed  One of the key benefits of establishing a risk management climate in which every employee acts as a risk manager is the multifold increase in monitoring represented by all those extra sets of trained eyes 18
19. Effective Monitoring Conduct Testing to actively determine if systems and personnel are performing to standard:  Internal audits of departments and teams should be conducted on a regular basis, sometimes with no notice  Where applicable, test cases should be introduced into a system or workflow and monitored to determine if the resulting actions are in accordance with standards  Negative test cases (which would be expected to be thrown out or flagged in some fashion) should also be used to assess the effectiveness of systems and policies within an organization 19
20. Effective Monitoring Testing (cont’d):  The individuals or entities conducting these tests should be made aware that fraud and waste are frequently discovered in this fashion; high-level management involvement is therefore necessary  Understand the Data: Risk analysis is only as good as the data, so learn how it was collected and processed—don’t just accept it 20
21. Effective Monitoring Ask, “What if this happens?”:  In the field of management, one of the key questions is: “What don’t we know?” This refers to potential events and outcomes that haven’t been considered before  While it’s impossible to imagine every threat to a system or a business, one way to identify unknown hazards is to ask, “What if this happens?” 21
22. Effective Monitoring Ask, “What if this happens?”: (cont’d)  Train managers to examine the potential ramifications of their decisions, and then to extend that analysis beyond the obvious  Don’t trust computer models and simulations to cover everything  Don’t rely too much on historical data; just because something never happened before doesn’t mean it can’t  Create high-level teams to ask the outlandish questions, and invite outside experts and your own clients to ask, “What if this happens?” 22
23. Effective Monitoring  The consequence of not asking “What if this happens?” is vulnerability to threats that could have been identified and neutralized  The collapse of the sub-prime mortgage industry in America had international ramifications, and many businesses were later surprised to learn of their exposure to the world of credit default swaps even though they’d never been directly involved with any of these products 23
24. Corrective Action  All the rules, managers, and software in the world will not create an effective risk management system if that system has no teeth  One sure-fire way to ruin a risk management system is to tolerate repeated violations 24
25. Corrective Action  Punishing violations is seldom easy, particularly when the offending party is perceived as a star or rainmaker, but allowing these transgressions to continue brings the entire system into question  Corrective action can range from re-training to termination, but it must take place—and the reality of its presence must be understood by employees at all levels 25
26. Conclusion  Risk Management is your job because it can cost you your job  Risk Management is not a department; it’s a system, an awareness, and an attitude  This is an ongoing effort that includes senior management emphasis, training at all levels, effective monitoring, and corrective action Everyone is a Risk Manager 26
27. About the Author Vincent H. O’Neil is a risk consultant, an author, and a public speaker. A graduate of West Point and The Fletcher School, he has managed risk in one way or another throughout his working life. He can be contacted through his writing website, www.vincenthoneil.com 27