The 5 Steps to Getting Positive ROI from Risk Management
Using design thinking to help you make ERM simple
Using Principles of Design shapes the way people manage risk. The increasing complexity, uncertainty, volatility and ambiguity is evidence that Enterprise Risk Management (ERM) must be a core competence.
The five principles that are applicable to ERM are 1) Emphasis, 2) Alignment, 3) Proportion, 4) Repetition, and 5) Movement. In this essay, I’ll speak to how the application of these principles creates, not only value but provides a positive return on investment to businesses of every size.
Risk is at the centre of just about everything we do. We need to make risk management more intuitive rather than an auto-response pattern. Risk management was long ago acknowledged as a process that requires ‘systems thinking’. Now we add ‘design thinking’. In that context, multiple options for strategies, outcomes, assumptions, conditions, gaps, and consequences must be considered and adapted, all while the internal and external environments remain uncertain.
The traditional form of risk management is no longer valid or applicable to how value is created.
People are screaming out for help because events big or small keep happening that they did not see coming. The never-ending question is: ‘why not’??
In simple terms, the principles of design have been invaluable in turning a process from being tediously intrusive to one that is integrated into the value creating approach it has always intended to be. ERM was never intended to be centralized.
Here’s how you create value . . .
1. Emphasis: Focus on People, Behavior and Processes
When you read that ‘Culture’ is at the centre of risk management, it does not mean turning the workplace into a lounge area with a fridge stocked with beer, dart boards, air hockey or ping pong tables.
An organization with a risk-aware and risk-intelligent culture is one where people are empowered — they are accountable for their behaviours and decisions. People build up their capabilities to use the design process to achieve the intended outcomes, despite changing conditions.
It is the understanding of the culture that becomes the driving force for turning risk management into value creation. The objective of designing the risk culture is to inspire engagement and to create a qualifiable experience with risk management. The risk culture becomes the value proposition of ERM.
The traditional sense of work, and indeed of risk management are long gone. The philosophies espoused by the likes of Taylor, Maslow and Herzberg no longer apply.
The diverse workplaces of today see employees wanting the feeling of belonging and contributing. They no longer seek lifelong employment. The internal and external environments have been major contributors to this thinking and behaviour.
How people experience their internal risk culture shows through when they deal with customers, suppliers and various stakeholders. There is a confidence in how they present themselves and their company.
2. Alignment: Create a Risk Framework
Design thinking has come a long way, baby!! It is no longer only for products that will raise the ‘delight’ level in customer experience. Like technology, design thinking has matured.
Design thinking is raising the delight level of people inside organizations. It is especially valuable to those responsible for results and outcomes. For those accountable for managing the conditions that deliver results and the risks that may emerge.
One of the key features in the design of the risk framework is that it must be a tool that is used to deconstruct the complexity of the business and its risk. Even the simple business structures benefit from using a framework to manage uncertainty.
For example: I coach my clients through the use of an ‘Alignment Worksheet™’ — it is their map of the ‘conditions for success’. They determine what is necessary for people, processes, systems, and technologies to create the results. Beyond the internal, it helps to define the necessary awareness of and responsiveness to the external environment. It all comes down to modelling behaviors, skills, and processes — then aligning them to the outcomes they are expected to deliver. This is the basis of the core capabilities for business to succeed.
By using the Alignment Worksheet™ managers are able to identify the triggers and sources of risk as they emerge. The importance of this map and its use as a management tool is that it creates a fluid picture of the ‘capabilities’ that are leveraged to achieve the outcomes. This approach produces better results since risks are considered in the planning process and actively monitored during execution. It is a lot of effort, but it is worth it. (Exhibit 1)
The components of the Alignment Worksheet™ enable excellence in execution, achieve anticipated outcomes and manage the conditions that are sources of risk. While doing so, they think about risk more strategically and make it a part of their decision-making process.
3. Proportion: A Gap Assessment Will Inform Execution
Effectiveness gaps in an organization represent a vulnerability, therefore a source of risk. It’s important to assess the scale/proportion of the gaps to what your objectives are.
When the gaps are evident in the context of the objectives, we are staring down a path to problems. It is all about the size of the gaps relative to the magnitude of the problems and/or risks.
Solving problems is non-productive time, time consuming and expensive.
The purpose of design thinking in risk management is to have an immediate and measurable reduction in the overall number of problems.
Gaps take many forms . . . Consider some of these gaps and what they may cost you
~ A customer service delivery process that has numerous hand-offs
~ A manufacturing process that is hampered by outdated equipment
~ A human skills gap in the effective use of technology
~ A knowledge gap that is the source of repeated errors and missteps
~ A strategy gap that insufficiently takes the risk of competition into account
More often than not, conducting a gap assessment will reveal ‘patterns’ in behaviors, processes, and decisions that keep repeating. These recurring gaps continually yield similar outcomes — delayed projects, missed budget targets, poor decision outcomes, employee disengagement, marginal customer satisfaction and more. These all point to emerging risks.
In the words of Daniel Wagner, formerly SVP of Risk at GE; where he was part of a team investing billions of dollars into global energy projects, advising the CEO on strategic planning and portfolio management.
“Some risks that are thought to be unknown, are not unknown. With some foresight and critical thought, some risks that at first glance may seem unforeseen, can in fact be foreseen. Armed with the right set of tools, procedures, knowledge and insight, light can be shed on variables that lead to risk, allowing us to manage them.” ― Daniel Wagner
4. Repetition: Encourage Practice
The design approach to ERM is a process of integration rather than centralization. This is where I believe many organizations get it wrong.
Integration does not happen quickly or easily. It requires continued practice, iteration and adaptation.
Decisions, behaviors and processes won’t be perfect out of the gate — BUT they will encourage doing it again and doing it better next time.
It all starts with design thinking. The foundation of design thinking for risk management is based on the work of Simon Hebert and his groundbreaking book “The Sciences of the Artificial.” This reference will provide further clarity. In the context of risk, the most relevant explanation of design thinking is to take it in two distinct steps:
1. Distinguish critical thinking from the analytic process of breaking down the conditions for success
2. Design the process to build-up the defenses/mitigations of the risks identified
This approach has been measurably successful due to the increasing complexity of business because it provides risk managers with tools to transform existing conditions into preferred ones.
Like with design thinking, failure is baked into the process as is resilience, adaptability and improvement. Simon Hebert’s idea was that “design is always linked to an improved future.” Staying the course and improving with each new iteration is what makes the risk management practice better.
Managing risk is about doing what is necessary to create the conditions that will deliver the better outcome.
5. Movement: Evidence
Enterprise Risk Management has evolved on the backs of complexity, uncertainty, volatility and ambiguity. Having a risk management discipline will not eliminate those factors.
Evidence points to what an ERM practice will do. It will integrate a management toolkit that delivers an experience of awareness, accountability and a sense of more control over what has to be managed to minimize the potential for a future uncertain event.
The evidence of successful applications of design thinking for ERM are common in the fields of engineering, economics and social sciences. This has raised the question . . . Is ERM a science or an art?
In the real world, my experience has been that it is both. Many problems are born out of chaos, uncertainty, gaps ignored and patterns that are not interrupted.[1]
After more than fifteen years of being a ‘problem solver’ I developed a deep understanding of the unmet needs within the context and constraints of business environments.
The art aspect of risk is being able to negotiate for the conditions that are necessary for success.
The science of risk is understanding how to construct the defenses to mitigate for uncertainty and complexity.
As stated at the opening, designing an ERM discipline into the organizational culture is not for the faint of heart and it should not be centralized away from front line management.
A client who is Global Head of Risk at a natural resources company states: “The tools helped us achieve two critical objectives: challenge and reframe participants’ understanding of ‘‘risk” and “risk management” and set the foundations to build a more robust and integrated risk management framework and program for the business.”
Many organizations are pivoting away from the traditional methods of risk management. Outdated methods are focused on hazards, loss, health & safety and historical information. Risk management is not about being informed by past negative outcomes. Business is full of opportunities too, and there may be risk!
An executive at a major financial institution that uses the alignment tools states: “Using the Alignment Tools gave us a terrific opportunity to discuss business challenges and opportunities with people from different areas of our organization — and then have the direction to proceed with execution to correct issues and improve outcomes.”
When you come to a fork in the road and you must choose, consider which tools give you the best outcomes.
Footnote: [1] Power Laws and the Science of Complexity Management, Mark Buchanan, Strategy + Business
