Risk Commentary

New website = RiskCommentary.ca
The process of risk identification itself. We can do so with confidence, because all of the procedural and conceptual elements we need are finally in place.

Recap
High Quality Risk Assessment: Preferred method: round-table of experts
Prepared session: agenda, context paper and facilitation aids
Risk formulation rules - see blog post.
Points in facilitation
Review: conceptual and procedural foundatio
Notice that in our preparatory work, we have:

• proper concept and definition of risk ID and assessment (Ep. 004)
• procedural grounding in proper planning (Ep. 005, 006)
• procedural refinement in the creation of a Context Paper for the risk ID session (Ep. 007, 008)
• avoided pitfalls entrained by some of the conventional risk ID advice (Ep. 009).

The question arises once more: is all of this too much work?
Summary statement of your expected result:
As required in our definition of High Quality Risk Assessment (Ep. 4), we have to identify risk:

• that is consistently conceived among participants as uncertainty connected with goals
• in direct association to intended actions (goals/objectives) that are researched and substantiated
• in relation to defined corporate values which govern behaviour of staff and employees
• comprehensively, considering all possible relevant sources of risk
• as efficiently as possible, being mindful of the constraints in using people’s time
• rigorously, so as not to gather information based on vague and disparate ideas of risk
• within a context using defined assumptions that are documented and so contribute to due diligence
• in such way as to effectively aggregate qualitative and semi-quantitative information

So, there we have a summary description of all the prerequisites and elements of an effective risk identification exercise. In the next episode, we can continue our work in the the round table session by assessing the risks, once they are identified and formulated.

KEY QUOTE
The deliverable for a risk ID and assessment session: "A comprehensive list of risks, arranged in several categories of analysis, with criticality rankings and mitigation measures, arrived at by consensus, to inform an improved business plan." (Robertson p.36)

LINKS
Do you need a risk matrix (risk register) or other templates for risk assessment? Enterprise Risk Management Tools and Templates 
Blog post - How to Write Risk Statements

E. Robertson Solving the Enterprise Risk Management Puzzle: Secrets to Successful Implementation (2016)

New website = riskcommentary.ca
Looking carefully at conventional advice, we discover why risk ID can be ineffectual.

Confusion entrained by the supposed risk ID methods set out in conventional literature.

· interviews and surveys, questionnaires
· audits, physical inspection
· brainstorming
· networking with peers, industry groups
· judgemental - speculative, conjectural, intuitive

· history, failure analysis
· examination of personal experience or past agency experience
· incident, accident and injury investigation
· scenario analysis
· decision trees
· SWOT analysis
· flow charting, system design review
· work breakdown structure

Conclusions
Procedures in this list can certainly inspire the search for risk, but are problematic for various reasons.
By contrast High Quality Risk Assessment is specified to identify uncertainty in relation to goals.

• High Quality Risk Assessment definition (Ep. 004)
• procedural grounding in proper planning (Ep. 005, 006)
• preparation of the Context Paper for the risk ID session (Ep. 007,008).

KEY QUOTE
“Such a multiplicity of [risk ID] methods might entrain confusion about the object of the exercise.” (Robertson, p.42)

LINKS
 Do you need a risk matrix (risk register) or other templates for risk assessment? Enterprise Risk Management Tools and Templates 
E. Robertson Solving the Enterprise Risk Management Puzzle: Secrets to Successful Implementation (2016)

New website = RiskCommentary.ca
Context for risk assessment could mean projects, contracts, administrative workflows, technical processes, etc.

Summary of the series to date. 
High Quality Risk Assessment. 
Establish the Context. 
Context Paper - The purpose is twofold: 
- to create a highly useful aid to facilitation; and 
- to create a testament to due diligence. 
Trap of trying to identify risk in business settings where goals are poorly formulated. 
What if we don't have hierarchical “goals” and “objectives”? 

Examples of Special Contexts
a. budgets
b. formal projects (project management)
c. contracts
d. workflows: administrative procedures or technical processes
e. performance management regimes
f.  specialized disciplines

Alternative contexts must still somehow express goals or intended actions that are clear.
Summary

KEY QUOTE
“The ERM champion must scrutinize the planning and even coach managers to adopt a complete planning practice... As a consequence, the risk information ultimately developed will make clear sense.” (Robertson, p.31)

LINKS
 Do you need a risk matrix (risk register) or other templates for risk assessment? Enterprise Risk Management Tools and Templates 
E. Robertson Solving the Enterprise Risk Management Puzzle: Secrets to Successful Implementation (2016). The discussion on Establish Context begins in Chapter 2.2.

New website = RiskCommentary.ca

“Establish the Context” - the most misunderstood and underrated step in the whole risk management process.

Recap of topics so far
Establish the Context
What do the standards mean by “Establish the Context”?
What are the elements and true significance of “Establish the Context”?
The headings in what I call the Context Paper, used to prep a risk ID session:
1. Title of the plan under scrutiny
2. Goals and objectives of that plan
3. Corporate values
4. Risk categories
5. Stakeholder analysis
6. Procedural and due diligence points (constraints)
7. Deliverable

KEY QUOTE
“Do not introduce as risk things into the risk ID session which should, properly speaking, simply be trends and conditions that are already known -- that should have been taken into account in the formulation and design of the plans themselves.”

LINKS
E. Robertson Solving the Enterprise Risk Management Puzzle: Secrets to Successful Implementation (2016)
The discussion on Establish Context begins in Chapter 2.2.
Do you need a risk matrix (risk register) or other templates for risk assessment? Enterprise Risk Management Tools and Templates  

New website = RiskCommentary.ca
Foundation for ERM: you must have the best organizational planning practice you can muster. 

Recap: 3 basic steps in strategic planning process

• internal
• environmental scan
• goal formulation

Three types of planning

• internal organization
• strategic
• operational

Broader schema

• to try to relate planning and management practices (Agile, Lean, ERP, etc.) 
• see Robertson Strategic Planning
• review to see where you might make changes

Is strategic planning dead?

• Mintzberg’s article “The Rise and Fall of Strategic Planning“
• strategic planning is popular; yet somehow mysterious and ineffective (kinda sounds like ERM!)
• his true complaint: not predictive; focused on quantitative targets; not participatory

Recommended practices in strategic planning:

• an iterative process; participatory, involving dialogue and exchange
• well-informed by detection of trends, conditions and emergent issues
• helps promote an integrated culture

Note on the use of academic studies

Conclusions: significance of good strategic planning:

• research and discussion
• common understanding that is developed
• resulting meaningful action

Is it too much to ask that risk managers look at planning?

Summary

KEY QUOTE
“Traditional planning fails to take into account the creative processes and discoveries that generate breakthroughs.” (article ~ Wall, S. and Wall ,S.R.)

LINKS
Aldehayyat J & Anchor J (2010) “Strategic Planning Implementation and Creation of Value in the Firm”
Wall, S. & Wall, S R (1995) “The Evolution (Not the Death) of Strategy”
E. Robertson Strategic Planning: Process, Templates and Effective Implementation (2019)

New website = RiskCommentary.ca
The all-important risk identification process: High Quality Risk Assessment. The first step is actually to fix the organization’s planning practise! 

Six steps in High Quality Risk Assessment
Investigate and fix the planning practice. 

• The intuitive, informal approach -- does it work?
• The importance of the planning language.
• Properly formulated goals.
• Properly informed goals.
• The crucial point in the development trajectory of organizations.
• Conclusion: we need proper planning and management systems in order to mature.

Complete planning practice

• Strategic identity; internal analysis
• Looking outward; external analysis
• Vision
• Gap analysis
• Formulation of goals and objectives 
• Beneficial psychological effects of engaging staff in planning process.

Summary

KEY QUOTE
“Why do so many strategic plans end up on the shelf? It’s curious, given that strategic planning is among the most popular of management tools.” (Robertson, 2019, p. iv)

LINKS
E.Robertson Strategic Planning: Process, Templates and Effective Implementation (2019)

New website = RiskCommentary.ca
Time to get into the ERM process! Let’s start with definitions that reflect a precise method. 

*Definitions: rationale and approach
1. Enterprise Risk Management
2. High Quality Risk Assessment
Significance of High Quality Risk Assessment process
Summary

KEY QUOTE
“One key message here is: do not fall into the trap of trying to lead a risk ID session, much less implement an entire ERM program, where goals and objectives are poorly defined.” (Solving the Enterprise Risk Management Puzzle: Secrets to Successful Implementation p.32)

LINKS
*My definition of ERM shows a clear process, whose results were praised by the BC Auditor General. See blog post of Enterprise Risk Management example: 5-part case study of ERM implementation, Camosun College.

E.Robertson Solving the Enterprise Risk Management Puzzle: Secrets to Successful Implementation (2016)

New website = RiskCommentary.ca
ERM myths, observed by your host over several years’ experience as practitioner and educator. For each point, we will give you the practical take-away to apply in your risk management program.

Myth #8: Managers, directors, analysts, CEOs, etc. know how to implement new programs.
Myth #9: Enterprise Risk Management can best be implemented by using a software application.
Myth #10: Defining risk tolerance is essential to an ERM program.
Myth #11: Monitoring compliance constitutes effective ERM.
Myth #12: Linking corporate strategy to ERM is difficult and complex.
Myth #13: ERM takes 3-5 years to implement.
Myth #14: Good ERM predicts the future; it is effective forecasting. 

KEY QUOTE
Do not fall prey to the myth that the technology, in and of istelf, will inspire acceptance and take-up of the new risk management program.

LINKS / NOTES
Program implementation failure
Synopsis of various studies.

Technology implementation failure - Linked in post
Scroll down to innovation: successful tech implementation part one

Risk tolerance vs risk appetite - pdf
Risk & Insurance Management Society: Exploring Risk Appetite and Risk Tolerance

Compliance
Steering clear of compliance pitfalls © Key Media Pty Ltd.
Unattributed, 31 May 2010. Corporate Risk and Insurance. Excerpt:

"The most common pitfall in compliance programs is an overreliance on policies, procedures and systems, according to Ulysses Chioatto, director of SSAMM Management Consulting.

A cursory glance over all the convictions and enforceable undertakings by ASIC in the past five years highlights this overreliance on policies, procedures and systems by financial services providers in their compliance programs, said Chioatto, with little to no work on people – or to put it another way, the company’s culture. 

Both internal and external auditors as well as compliance and risk officers pore over documents, flowcharts, plans and reports from computer risk and compliance applications, yet breach registers are overflowing, or worse still, completely empty. "

New website = RiskCommentary.ca
What are common misconceptions that can block success in your Enterprise Risk Management program? Your host Edward Robertson has a list of ERM myths, observed over several years’ experience as practitioner and educator. For each point, we will give you the practical take-away to apply in your risk management program.

Myth #1: ERM is one thing.
Myth #2: International standards (ISO 31000; COSO, etc.) give ERM implementation guidance.
Myth #3: ERM is unproven.
Myth #4: ERM imposes an unacceptable administrative burden.
Myth #5: ERM is the purview of audit & finance.
Myth #6: All the various pre-existing risk disciplines and practices will be replaced by ERM.
Myth #7: Managers in all verticals can reasonably be asked to conduct risk assessment.

LINKS
“over 80 risk management frameworks...”
Ahmad, Saudah et al. (2014) “Enterprise risk management (ERM) implementation: Some empirical evidence from large Australian companies”

“30% of time spent in meetings was unproductive...”
S. Rogelberg, et al. “Wasted Time and Money in Meetings: Increasing Return on Investment”

New website = RiskCommentary.ca
Podcast launch! Is Enterprise Risk Management (ERM) dead? There is a stunning disconnect between the unprecedented need for ERM to be “instilled into the corporate DNA” and lacklustre risk manager survey results.  Let’s explore why ERM is broken, and how to fix it.

Welcome to the Risk Commentary podcast
Who is this podcast for?
Mission
Credentials
Is ERM Dead? 
Survey results
Why is ERM so incredibly convoluted and seemingly complex? 

KEY QUOTES
”We are in an unprecedented and evolving landscape unlike anything that we have ever seen historically.” This from the former President of Lloyd’s of London for North America... and yet only 35% of those surveyed have a full Enterprise Risk Management practice.

LINKS
Book: Solving the Enterprise Risk Management Puzzle: Secrets to Successful Implementation (E.R. 2016)

Interview with LoriAnn Lowery-Biggers and colleague Sean Murphy by John Czuba of Legal Talk Network.

The State of Risk Oversight - An Overview of Enterprise Risk Management Practices by AICPA. April 2021.