Who hasn’t heard the expression: red sky at night, shepherd’s delight; red sky in the morning, shepherd’s warning? Perhaps that was the first Risk Conversation. But today we have moved on from superstition and heuristics to a more fundamental need to understand and manage our existence into the future.
This is why anyone who has heard me speaking in public recently will have heard me talk about an approach to understanding risk culture that I am calling Risk Conversations. I have been really excited about it partly because I think the technology-enabled approach is really cool, but more because I think it is going to transform the way that firms understand what impact their culture is having on their ability to create a long-term sustainable future for themselves.
Anyway, I have now run this in several sizeable organisations. What have I learned? Five simple lessons. But they are five simple lessons that are backed up with FACTS, not guess work or intuition.
Before we get into the lessons, why is risk culture so important? Well I could say it is important because the regulators in Financial Services say it is important. I could say it is important because every review of a disaster you have ever looked at talks about the corporate culture. I could say it is important because COSO says it’s important. But the reality is that this is important, because your culture will be what your people fall back on when they are in a jam, when they are facing a problem. Process is fine, but process falls apart under stress. What we fall back on is the way that we do things, and our personal ethics. We fall back on our “fight or flight” approach to risk. So your risk culture is important because it will help your corporate brains (which all belong to the individuals that work in your eco-system) decide how to react to unfolding events.
Of course there is a long history of looking at corporate culture, so why are we now so focused on the corporate RISK culture? Every analysis of corporate culture that I have ever looked at looks at how people respond to the here and now. What did we do yesterday? What is going on today? None of them look at what we will do tomorrow. Your corporate culture looks at how you will work today. Your risk culture looks at how you will work in the face of multiple possible futures, and let’s face it, just like the film Sliding Doors, we all face multiple futures, its just that we only actually live one of them.
So while organisations pay substantial sums of money to understand and “fix” their cultures, few if any or them will address their “risk” culture, because the analysis looks at the here and now, not tomorrow and beyond. This is exactly the same problem that we see with accounting systems: everyone pays loads of money to have the best accounting system they can afford because that tells them where they are. But they pay peanuts to look at the future. But all the opportunities for expanding, growing, protecting your business today, now, lie in the future, and when will you face up to the rest of your future? It is time that organisations faced up to the need to understand better not only the multiple futures that they face, but also how they will face up to the stress that future uncertainty brings. And this is where your risk culture comes in to play.
It is worth just a little bit of theory here: the idea behind Risk Conversations is that the culture manifests itself in interactions between people. In other words, conversations about risk are the artefacts of the culture. By asking people regularly to say to whom they are talking about risk, what they are talking about, how often and how good the conversation is, and then triangulating that information, you can begin to measure the shape and effectiveness of the risk culture. And where you have both sides of a conversation agreeing about all of those facts, then you have a Risk Conversation worthy of the name. A healthy risk culture is one where risks are discussed regularly, openly and both sides of the conversation recognise the same discussion.
So here are the promised lessons…
Lesson Number 1: Risk has got to be lead from the top.
Yes: you would think that we had all learned that many, many years ago. But it is still not happening. In one organisation, where the CEO was espousing the importance of risk management, not a single member of the board or executive team could be bothered to report a single risk conversation with anyone else. What message does this send to the rest of the organisation? One and only one message: “I don’t care”. This one insight was more powerful than anything else in beginning a transformation of the organisation’s risk culture. Risk Conversations has pointed this out starkly in real life.
Lesson number 2: Risk is only being dealt with when BOTH sides of a conversation actively acknowledge the discussion.
Otherwise it is a monologue. So when one of the people in your team talks to you about a problem, listen. Then you can identify
whether it really is a problem or not. Until you acknowledge the conversation, it really is demotivating for the junior staff, and they will stop telling you. That is when the “dangerous silence” settles on the organisation, because quite frankly, it is more trouble than it is worth telling you about anything, because you will only dismiss the efforts with scant regard. Risk Conversations highlighted this phenomenon at a major infrastructure client.
Lesson number 3: complex issues need all of your firm’s brainpower.
… not just that in your own department. In virtually all of the clients where I have looked at this, the significant majority of conversations start and end in the same department. Complex futures mean that you face complex issues. Complex issues are not going to be solved by one department on its own. So a measure of a vibrant “risk” culture will be the proportion of risk conversations that start in one department and end up in another. After all, your risks respect no boundaries, so why should your conversations about risk? Risk Conversations shows precisely how many risk conversations transcend boundaries.
Lesson number 4: are you as ethical as you say you are?
We know that your organisation espouses themes of ethical behaviour: after all behaving ethically is almost certainly one of your core values. And yet… when we look at the things that your staff are talking about, how often do they mention words such as “ethics”, “fair”, “values”, “stakeholders”, “customer”? An ethical organisation is one in which it is more than acceptable, it is expected that you should talk about risks that have an ethical perspective. Risk Conversations is showing the underlying values, whether they are about “ethics”, “treating customers fairly”, or “compliance” in day-to-day reality at clients today.
Lesson number 5: do you have the balance of risk focus?
We all know that we want people focusing on the bigger picture as well as the minutiae. But we want some kind of balance. Strategic risks should be something that the senior management team is really focused on, and yet operational risks are something that the frontline should be managing on a day-to-day basis. That is not to say that senior management only focus on strategy at the expense of operational issues (that WOULD be a mistake!) but there has to be some sort of balance. After all that is what underpins the risk appetite model that I espouse: a proportionate regard for the propensity to take risk and the propensity to exercise control. By understanding which risks are being talked about at which level of the organisation, we can know precisely whether or not your entrepreneurial spirit is being squashed by a bunch of control-seeking individuals who wouldn’t recognise the future if it (or when it…) pokes them in the eye. Risk Conversations is pointing this out loud and clear right now.
The bottom line is that Risk Conversations works as an approach. It is showing with facts and figures rather than opinions and waffle exactly how organisations are facing up to the future. Cloud based (so NO integration issues), data rich (not opinion biased), and ready now (one less variable for the future!) you can implement Risk Conversations in your organisation and take control of your RISK culture today.