Article series update: Risk Managers at Risk

According to the 2023 AICPA/NC State Survey on Enterprise Risk Management Practice[1], only 11% of financial institutions surveyed indicated that ERM “Mostly” or “Extensively” provided competitive advantage to their organization. In contrast, 25% ranked it as only “Somewhat” valuable, and 64% felt the value was “Minimal” or “Not At All”!

Which leads to a simple question... How do you gain relevance and preserve your position when only 1 of 9 senior executives think your function provides them with a competitive advantage?

You do so by seizing the agenda and initiative, selling your organizations on the inherent value of ERM, and using better tools to monitor risk and create new insights and value. 

But first, you address your current gaps!

1. AICPA/NC State Survey on Enterprise Risk Management Practice: Background and Findings

For nearly fifteen years, the AICPA and North Carolina State University have sponsored a survey on ERM practices and perceptions. The survey is detailed and of a high quality. For those interested in learning more, we encourage you to view the full report at https://erm.ncsu.edu/library/article/2023-risk-oversight-report-erm-ncstate-lp.

The survey reveals major gaps in current ERM processes and management in the following areas:

a) Overall State of Risk Management Maturity: End-to-End Risk Management Remains Elusive

· Only 34% of respondents felt that their ERM processes were “end-to-end.” 

· 29% of Financial Institutions lacked formal ERM processes or were still in the planning stage.

b) Strategic Value of Risk Management: Few Emerging Insights and Low Impact on Decisions

· Only 11% of respondents felt that ERM provided enough competitive advantage. 

· 57% felt that ERM didn’t track emerging strategic, market or industry risks effectively. 

c) Impact of Culture on Risk Management: Existing Organizational Beliefs Limit ERM Effectiveness

· 55% of organizations gave little to no ERM training to executives over the past two years.

· 63% felt that risk activities had minimal or no influence on performance compensation. 

d) Risk Identification and Assessment Processes: Uneven, Siloed and Not Holistic

· Only 54% use a consistent ERM form and process, usually only in “traditional” risk areas, such as IT, Legal/Regulatory/Compliance, and Financial. 

· Market, Strategic, and Industry risk—along with newer emerging risk such as Reputational and Political Assessments—don’t receive enough focus. 

· 72% of risk assessments are typically informal and qualitative rather than numbers-driven, with little integration across the enterprise.  

e) Risk Monitoring Processes: More Explanatory and Robust KRIs Needed

· 72% of managers didn’t perceive existing KRIs as robust enough to provide early warning.

2. What Does it Mean for You and Your Current Role?

Ironically, survey participants largely agreed that the volume and complexity of enterprise risks have continued to increase over the last several years, but more than half felt that the current ERM process was not the most effective way to handle those risks.

This may be a communication or a perception problem, but it’s what people think.  You are not a strategic priority, and your current value is low. Competing priorities frequently take precedence and your function is not perceived as a useful or strategic decision-making tool for the organization. This needs to change.

Drawing on these survey findings and our personal experience in creating effective ERM functions both as employees and consultants, we would like to share a 7-step action plan we have used successfully to assist you in the year ahead:

1. Clearly define—and communicate—the vision for ERM and sell it to the Senior Management, the C-Suite, and the Board.

2. Select a Risk Taxonomy and Refine / Update your Risk Appetite Statements 

3. Scale Your KPIs and KRIs Properly with Better Frequency and Severity Rankings

4. Develop Appropriate ERM Systems that Emphasize LOB Accountability and Reporting

5. Prioritize and Triage Risks for Intervention Vs. Review

6. Develop Educational Programs Around Risk Frameworks

7. Monitor risk across the enterprise holistically by identifying correlations and potential cascades 

In subsequent articles, we will expand on each of these seven topics to share our experiences and insights, drawing on what worked—and didn’t work—for us as we struggled with similar issues. 

2024 represents a unique opportunity to seize the agenda and improve the current internal ERM perceptions. Let’s not waste it.

Welcome to 2024!

[1] 2023 The State of Risk Oversight An Overview of Enterprise Risk Management Practices, 14th Edition

According to the 2023 AICPA/NC State Survey on Enterprise Risk Management Practice[1], only 11% of financial institutions surveyed indicated that ERM “Mostly” or “Extensively” provided competitive advantage to their organization. In contrast, 25% ranked it as only “Somewhat” valuable, and 64% felt the value was “Minimal” or “Not At All”!

Which leads to a simple question... How do you gain relevance and preserve your position when only 1 of 9 senior executives think your function provides them with a competitive advantage?

You do so by seizing the agenda and initiative, selling your organizations on the inherent value of ERM, and using better tools to monitor risk and create new insights and value. 

But first, you address your current gaps!

1. AICPA/NC State Survey on Enterprise Risk Management Practice: Background and Findings

For nearly fifteen years, the AICPA and North Carolina State University have sponsored a survey on ERM practices and perceptions. The survey is detailed and of a high quality. For those interested in learning more, we encourage you to view the full report at https://erm.ncsu.edu/library/article/2023-risk-oversight-report-erm-ncstate-lp.

The survey reveals major gaps in current ERM processes and management in the following areas:

a) Overall State of Risk Management Maturity: End-to-End Risk Management Remains Elusive

· Only 34% of respondents felt that their ERM processes were “end-to-end.” 

· 29% of Financial Institutions lacked formal ERM processes or were still in the planning stage.

b) Strategic Value of Risk Management: Few Emerging Insights and Low Impact on Decisions

· Only 11% of respondents felt that ERM provided enough competitive advantage. 

· 57% felt that ERM didn’t track emerging strategic, market or industry risks effectively. 

c) Impact of Culture on Risk Management: Existing Organizational Beliefs Limit ERM Effectiveness

· 55% of organizations gave little to no ERM training to executives over the past two years.

· 63% felt that risk activities had minimal or no influence on performance compensation. 

d) Risk Identification and Assessment Processes: Uneven, Siloed and Not Holistic

· Only 54% use a consistent ERM form and process, usually only in “traditional” risk areas, such as IT, Legal/Regulatory/Compliance, and Financial. 

· Market, Strategic, and Industry risk—along with newer emerging risk such as Reputational and Political Assessments—don’t receive enough focus. 

· 72% of risk assessments are typically informal and qualitative rather than numbers-driven, with little integration across the enterprise.  

e) Risk Monitoring Processes: More Explanatory and Robust KRIs Needed

· 72% of managers didn’t perceive existing KRIs as robust enough to provide early warning.

2. What Does it Mean for You and Your Current Role?

Ironically, survey participants largely agreed that the volume and complexity of enterprise risks have continued to increase over the last several years, but more than half felt that the current ERM process was not the most effective way to handle those risks.

This may be a communication or a perception problem, but it’s what people think.  You are not a strategic priority, and your current value is low. Competing priorities frequently take precedence and your function is not perceived as a useful or strategic decision-making tool for the organization. This needs to change.

Drawing on these survey findings and our personal experience in creating effective ERM functions both as employees and consultants, we would like to share a 7-step action plan we have used successfully to assist you in the year ahead:

1. Clearly define—and communicate—the vision for ERM and sell it to the Senior Management, the C-Suite, and the Board.

2. Select a Risk Taxonomy and Refine / Update your Risk Appetite Statements 

3. Scale Your KPIs and KRIs Properly with Better Frequency and Severity Rankings

4. Develop Appropriate ERM Systems that Emphasize LOB Accountability and Reporting

5. Prioritize and Triage Risks for Intervention Vs. Review

6. Develop Educational Programs Around Risk Frameworks

7. Monitor risk across the enterprise holistically by identifying correlations and potential cascades 

In subsequent articles, we will expand on each of these seven topics to share our experiences and insights, drawing on what worked—and didn’t work—for us as we struggled with similar issues. 

2024 represents a unique opportunity to seize the agenda and improve the current internal ERM perceptions. Let’s not waste it.

Welcome to 2024!

[1] 2023 The State of Risk Oversight An Overview of Enterprise Risk Management Practices, 14th Edition

Begin with the end in mind. -Stephen Covey

Our previous article laid out 7 steps to restoring credibility and importance to the ERM function for organizations. In this article, we address the two most fundamental questions that ERM professionals frequently overlook: 

1) What is the current role that the function has assumed? And more importantly, 

2) What is the optimal role that best serves the larger organization’s ERM needs? 

Hint: They are often misaligned.

In our experience, ERM organizations can evolve through three stages of development, although most get stuck in the process.  The lines between the three are not fixed, of course, but the roles provide a good starting point for you to evaluate where you are currently and where you want—and need—to be.

The progression is as follows:

  In the last edition of our article series on how to make ERM more effective, we laid out the typical roles that ERM organizations assume and how those roles can evolve over time. It generated a lot of interest and enthusiasm, especially among ERM professionals who have primarily invested in their organization’s technical and technology development, and not focused as much on defining their larger role within their organizations.

We received multiple inquiries from many of you who agreed with the three stages, but wanted a tool to help assess where you currently stood (especially in relation to your peers), and most importantly, what concrete steps you might take to accelerate your journey in increasing your organization’s effectiveness. 

Thank you for your input and we hope we can address these issues. We have developed a brief survey assessment tool for you to gauge your current status and focus on your future priorities. We hope you find it useful, and based on your feedback on this article, we will try to provide similar tools and templates as appropriate in our future articles releases.

To review the prior article, which now includes a link to the assessment survey tool, please click here.

Thanks again for all your feedback and interest. Please keep the feedback and suggestions coming so we can be more effective in working together and learning from each other.

Our previous article discussed possible roles the ERM function may assume in organizations. This article addresses what are, from our perspective, the most two most overlooked steps in the entire ERM process:  

1) How to build Risk inventories using a standard Risk Taxonomy? and 

2) What is required to create an effective and useful Risk Appetite Statement (RAS)? 

Quite simply, organizations do not invest enough time or effort into organizing the risks they identify into logical groups, or into drafting Risk Appetite Statements that are useful. This is a critical shortcoming that often handicaps the entire ERM process, because these two elements provide the overall direction and risk boundaries for every unit of the organization.  And when done properly, they ensure that risk ownership and management extend to the business unit level. 

The good news, however, is that these problems can be quickly addressed with just a bit of focused attention. Let’s lay out the steps required for you to strengthen your processes and build that ownership within your organization.

When beginning the ERM process, organizations typically jump into the process of inventorying and defining the specific risks they face, based on their individual situations and the specific industries to which they belong. This is good, but the results are too specific and often idiosyncratic. And why reinvest the wheel? Many detailed and useful Risk Taxonomies currently exist which provide comprehensive risk inventories and descriptions, which in turn vastly simplify the process of benchmarking performance with peer companies in the future. In the Insurance industry, for instance, ISO 31000, COSO, and the NAIC all have industry-specific taxonomies. If you are just starting out, try to use one of them. If you already have a risk inventory, try to harmonize your work with these established frameworks. It will organize your existing work into groupings that facilitate peer comparisons, and enable you to generate reports and comparisons that will intrigue your company executives, and are increasingly being requested by regulators and rating agencies. 

Once the high-level risk identifying and organizing are completed, you must over-investin creating high quality Risk Appetite Statements, first at the corporate and then at the Line of Business level. The Risk Appetite Statement is the company’s formal pronouncement of desire or reluctance to assume specified risks, and at what levels. It is, in effect, the Company’s “Strategic Plan” for Risk, and should be closely integrated with the Company’s overall strategic plan. Very few of the RASs that we have reviewed, however, even come close to meeting this objective.

At a minimum, the Corporate RAS should provide a general narrative on the company’s risk management philosophy and contain the following elements: 

· A description of the 8-10 critical risks the company faces,

· Quantitative metrics for the Risk Capacity, Risk Tolerance, and Risk Appetite for the Risk,

· Key Risk Indicators and their defined ranges, typically in “traffic light” groupings. 

These groupings form the basis for the Risk Reporting templates which are developed at this time and included as part of the RAS effort. Higher quality RASs usually include some discussion on the exact mechanisms for risk measurement, monitoring, and frequency, and what the control and governance processes are as they relate to the individual risk groups. Occasionally, RASs also include a brief glossary of Risk Terms and Definitions as an addendum. We strongly endorse this practice, as it promotes the establishment of a common risk language and vocabulary across the organization. RASs may also discuss ways to align overall compensation on a risk-adjusted basis, but these goals remain largely aspirational.  The CFO or CRO is often the Executive Sponsor for the Corporate RAS effort, and the Board typically approves the Corporate RAS after significant input and deliberation from the C-suite and other stakeholders. 

Many ERM organizations miss an opportunity to help their organizations and create value by neglecting to extend this process to the individual lines of business. Once the Corporate RAS has been accepted, the corporate sets the risk tolerances and limits. How do these aggregate limits align with the sum of business unit risks? How do they change as the postures of each of the business units change? And what are the interactions?  These are hard questions that must be addressed—especially by the ERM function. Very few of them do so effectively, however.

Yet, most of the raw materials for risk managers to develop these insights are available if they are willing to partner with their business counterparts. Every business unit creates a budget and strategy document (admittedly of varying qualities!). Translating these objectives into Key Risk Indicators and Tolerances, at least initially, is something that Risk Management should be doing proactively. And drafting an LOB-specific RAS is a straightforward process, based on the parameters established in the Corporate RAS and on what can be inferred from the LOB budget and strategy documents. 

A more strategic perspective greatly enhances both ERM’s effectiveness and your personal stature in the organization. Moreover, information is power. No other organization in the company has the mandate to review and own risk across business lines or to manage it. And the insights you can create are tremendously valuable to the organization. Knowing our defined corporate risk capacity, what businesses are exceeding or “overusing” that capacity? Why? Is this contemplated, accidental, or intentional? And how can it be managed most effectively, both immediately and over the longer term? No individual business manager can answer these questions, and many might not even want to know the answers even if they could find them. But you can, and in service to your organization’s health and future, you should.  

Why aren’t you seizing the opportunity?

P.S.: If you would like a sample template of a detailed Corporate Risk Appetite Statement which exceeds what’s commonly used currently, feel free to download it from our website, www.srarisk.com/insurance.

Everything Should Be Made as Simple as Possible, But Not Simpler. -Albert Einstein

Using Decision Matrix Risk Assessments (DMRA) to categorize and prioritize risks is clearly the standard tool for most Risk Managers as they evaluate risk tradeoffs. And Risk Matrices have a lot going for them: they’re extremely powerful visual tools to convey positional information, they condense large amounts of data into understandable groupings, and they’re easy to construct, based on the dimensions and scales chosen. They’re easier and cheaper to create than more sophisticated analyses like Failure Mode and Effects Analysis (FMEA) or Monte Carlo simulations, and readily explainable to everyone in the organization. 

There is even a standard and common four step process that just about everyone has seen in their careers: 1) Identify the risk factors 2) Rate the risks 3) Combine / Multiply the ratings and 4) Rank the Risks. Determine what the matrix says. Depending on your risk tolerance and mitigation effectiveness, create your mitigation plan, work through it in sequence and then update the matrix. Your published output will look something like this:

Everything Should Be Made as Simple as Possible, But Not Simpler. -Albert Einstein

In last week’s article, we explored some of the shortcomings of the traditional Decision Matrix Risk Assessments (DMRA) approach to categorize and prioritize risks and their tradeoffs. The DMRA is the standard approach widely used to present risks to Senior Management, Rating Agencies, and Board Committees. Although the tool provides a starting point for risk analysis, it suffers from some serious mathematical shortcomings that limit its effectiveness to categorize risks based on the usual information used in creating the matrix.

We concluded with the revised DMRA, which more accurately reflects the grouping that can be logically inferred from the tool. It is as follows[1]:

Everything Should Be Made as Simple as Possible, But Not Simpler. -Albert Einstein

Previously, we talked about the sort of role your ERM organization might choose to assume, based on three specific prototypes we have seen in the past. We next reviewed Risk Appetite Statements and KRIs. These are powerful tools to identify which risks your organization purposely decides to select from among the universe of risks that is faces, simply by being in business. We then suggested some approaches to use risk matrices more effectively as you prioritize your monitoring and mitigation efforts for those specific risks. 

Today we ask: how do you tie all these pieces together? The answer: By ensuring tight and effective linkage between your ERM platform and process. 

Unfortunately, many organizations (even decent sized ones) get this wrong, and fail at one of two extremes. One extreme is to use Excel spreadsheets and manual ad-hoc processes to aggregate their data. The resulting process leans very heavily on manual effort and the “tribal knowledge” of the individual participants. Thus, inconsistent approaches, slow and cumbersome processes, and knowledge gaps with absences, retirements, etc. The lengthy data preparation process reduces Senior Management and Board evaluation time and prevents high quality strategic evaluation and review.

The second extreme is to invest in the right tools, but in the wrong way, i.e., a proliferation of individual tools (usually GRCs) at the line of business level. Although this approach provides some discipline and consistency because of the individual tool itself, the proliferation of unique packages, risk frameworks, and approaches makes risk management at the enterprise level virtually impossible. Everyone is lost in the detail and the systems deployed excel at inventorying risks but not at interpreting or managing them strategically.

In both instances, the majority of the efforts revolve around collecting, aggregating, and preparing data rather than truly analyzing trends, identifying root causes, or fostering continuous improvement. These outcomes are a far cry from what Regulators, Rating Agencies, or Senior Management really require.  And what we would consider to be strategic ERM, which is the capacity 

There is actually a third group as well. They don’t fail, but they never quite succeed. They invest resources in the right systems and achieve reasonable consistency in their processes, striving to succeed but just muddling along. Overall ownership across the enterprise is uneven, as is individual performance. Overall, it’s fair to say that very few companies actually succeed in achieving a truly strategic ERM capability, which enables you to manage the risks you choose to take within your desire tolerance, monitor that risk continuously, and adjust as needed based on changes to the internal risk appetite and the external risk landscape.

From our perspective, the key to success resides not in the features of the systems used or the competence and sincerity of the participants involved. Rather it comes the superior integration of the two and can be achieved only when organizations ensure that all of their ERM processes are designed to be Measurable, Accountable, and Distributed (MAD). 

Let’s explain: Profound organizational change—of any kind—only occurs when people redefine themselves and their roles in the organization in a new way to meet the changed expectation they face. This bears repeating any time an organization embarks upon an improvement project of any kind. Change the mindset, and you change the behavior. Don’t change the mindset….and you change nothing.

The implications for strategic ERM management, therefore, are simple and profound. 

First, you need to be passionate about being Measurable and insist that your KPIs, KRIs, Risk Statements, and Metrics are numeric and quantifiable. Terms like “I think,” Medium, or “Excellent” are the enemy of strategic excellence. Replace them with “I know based on peer review,” “50% percentile based on competitor performance,” or “Highest Net Promoter Score in Latest Survey.” Banishing ambiguity enhances focus, reduces ambiguity, and builds commitment. Everyone says: “you get what you measure.” More important over time, however, is that people internalize the metrics on which they are measured. 

Accountability breeds actions, decision, and resolution. No one wants to be identified as a slacker. In the ERM context, this means that individual Risk Owners or those responsible for risk identification, mitigation planning and implementation, etc. need not only to be identified, but explicitly tracked using a mechanism that is broadly transparent across the organization. Peer pressure is the most effective means to ensure consistent performance. Make sure that any process you create for risk deliverables is transparent enough to track ongoing performance of all of its participants, especially in regard to reporting individual performance all the way to the highest levels of the organization.

Finally, the overall effort needs to be Distributed to accelerate the process and move the ERM’s mix of data preparation vs. strategic analysis. You need timely and consistent ERM reporting with minimal effort. This happens only when you distribute risk tasks to multiple owners and automate the risk roll up and consolidation process through a centralized tool. Oddly enough, broadly distributing this part of the risk process actually makes it more efficient and resilient, as long as you can ensure that all parties behave appropriately (see Accountability above!).

If MAD are the three design principles to build a robust and strategic ERM process within your organization, what are the implications? And more specifically, what are the actual platform or system requirements that you should evaluate (or may need to reprioritize) when considering a new system or determining how to improve your current one? And how do these requirements support the underlying processes you need to create?

In next week’s article, we’ll address these important questions.

In our previous articles, we reviewed the data and process elements required for superior ERM performance. As we mentioned, the key to success resides not in the features of the systems used or the competence and sincerity of the participants involved. Rather it comes the superior integration of the two and can be achieved only when organizations ensure that all of their ERM processes are designed to be Measurable, Accountable, and Distributed (MAD). 

If MAD are the three design principles to build a robust and strategic ERM process within your organization, what are the implications? And more specifically, what are the actual platform or system requirements that you should evaluate (or may need to reprioritize) when considering a new system or determining how to improve your current one? And how do these requirements support the underlying processes you need to create?

Our observations here are necessarily speculative, and may of course depend on your individual circumstance, corporate culture, and business strategy. But the following considerations should always be major decision factors as you think about upgrading your system and process capabilities, both now and as the future landscape continues to evolve.

Here is a quick list of features and an initial assessment of their changing importance in light of our discussion.

HIGH IMPORTANCE

1. Risk Identification, Assessment, and Mitigation

2. Reporting

3. Collaboration Features

4. User Friendly Interface 

5. Data Security

6. Updates and Improvements

Clearly any system has to identify, assess, and mitigate risk even to be considered. But increasingly, collaboration features and the user interface should be very high on your consideration list. As you distribute tasks and accountability across the organization and empower risk owners and participants, they need to give and receive feedback seamlessly, thereby refine their outputs to drive high quality and customized reporting. Tailored data permission and access is highly desired, but as a general rule data should be as freely accessible as possible to all participants. Cloud access is also important for ongoing data security, upgrades, backup, etc. As with any system, ongoing support and upgrades are essential.

MEDIUM IMPORTANCE

· Integration

· Regulatory Compliance

Although many platforms emphasize their extensive libraries of APIs and ability to integrate your multiple internal or home-grown systems, you may want to consider very carefully whether the benefit justifies the effort. If the best process is rooted in collaboration of distributed risk owners with highly specific and individualized KRIs, the need to automate the process becomes less compelling. Better to let the expertise and judgement reside with the Risk Owners and have them make the judgement calls and adjustments. Regulatory Compliance is a critical capability that organizations (particularly in regulated industries) require, but more likely falls into the realm of GRCs, not Strategic ERM.  Don’t overwhelm your Board and Senior Management team with unnecessary detail that will distract them from focusing on the few critical issues that can threaten the enterprise. Compliance can become an existential issue, of course, but not every reporting period (we hope!).

EMERGING OR POTENTIAL FUTURE IMPORTANCE

· Scenario Analysis

· Incorporating New Technologies

Finally, some potential features and considerations may need additional time to evolve. As ERM becomes more sophisticated and nuanced in its approach, Scenario Analysis, Monte Carlo simulations, and What-if assessments will become a more important evaluation factor. For now, however, this is not a realistic consideration for all but the largest and most sophisticated companies. But this will likely change when ERM when there is tighter linkage between ERM platforms and processes. A similar theme is currently unfolding with the incorporation of new technologies in the ERM platform space. Many vendors tout their emerging AI capabilities for monitoring and analysis. This may prove to be a significant disruptor of existing business practices and processes, but only time will tell. Blockchain seemed to experience a similar level of enthusiasm previously, but its impact has been minimal in the ERM space. AI may prove to be different, but it’s unclear for now. And most companies have neither the data nor the processes to leverage the technology immediately. Best to stay seated for now, and invest your efforts in building core competencies rather than chasing new technologies.

Recommendation: Carefully think about how to mesh your ERM platform and organizational process to deliver higher level insights and value to your organizations. Redefine the traditional roles of participants and create enabling mechanisms to build and reinforce the new required behaviors. 

Don’t settle for the status quo and continue with business as usual. Get MAD!

I hear and I forget. I see and I remember. I do and I understand. -Attributed to Confucius

Introduction

In a recent LinkedIn post, my colleague Steven Strickman pointed out that some additional troubling insights about the state of ERM that I had overlooked. One was that the majority of organizations surveyed—by their own admission—lacked end-to-end processes and overall maturity in their ERM process. Perhaps more troubling, however, was their training performance, as nearly 70% of respondents indicated that senior management had received no ERM training within the last two years! Technical training is a crucial aspect of professional development in any industry, particularly in the regulation and technology-driven world of financial services and insurance. 

Can you imagine a comparable time lag in Compliance, Employee Practices, or Product Training? 

HR professionals in Financial Services argue passionately, and rightly so, that there’s an intensifying war for talent, especially post-Covid, the Great Resignation, etc. Yet, we are failing not only our future employees, but even our existing employees by not equipping them with essential knowledge and skills. What’s going on? 

We don’t have all the answers, but we do have observations on how to make ERM training a more important and interesting part of the overall ERM process, and provide ERM professionals with better credibility and visibility within their organizations.

Tailored Learning By Style

Picture yourself in a room (like high school or college), listening to a monotonous lecture on quadratic equations or trigonometric functions. It's likely to be a tedious experience, especially when it’s chock full of theoretical concepts and lacks a practical context for understanding how to apply those concepts. In addition, communication is almost completely one way. Although the presenter may field questions during or after the lecture, lecture “participants” are “recipients,” and are often uncomfortable interrupting or slowing down the class when they don’t understand something. As a result, considerable opportunities for comprehension and knowledge retention are lost.  Are concepts like Risk Thresholds, RAROC, VAR any different? And therefore, is ERM training any more effective?

Training often fails to consider “learning how people learn” to address their audience’s needs and spark their interest. Let me explain. There has been considerable research on how people learn and communicate, with the insight that there are 7 or 8 learning/communication styles, with one being dominant in any given individual.[1] Just like being right or left-handed, you are more comfortable and proficient with one style, although you may use the others at different times and to a lesser extent. Have you ever had a conversation with someone, and everything just clicked in terms of communication and understanding? Likely you both have the same dominant learning style. 

And what about those instances where, as much as you tried, you just couldn’t get through to another person? Most likely, your dominant learning styles were different. The funny thing about human nature is that people don’t recognize this and often use their dominant style more forcefully rather than translating their thoughts into the other person’s style. This just makes things even more frustrating for both parties!

So, what does this have to do with ERM training? We would suggest a lot, because by addressing the audience on its own terms, you make the training much more engaging and meaningful.

Before we begin any ERM focused training, we start with a brief experiential exercise by breaking the audience into small groups of 5-6 people, with the groups competing to solve a given problem, typically under a 10–15-minute time constraint. We introduce the challenge in a central location, and each group works in private breakout rooms, reporting their solutions to the central location when they are finished. We then review and evaluate each team’s proposed solutions and later debrief them on their approaches. 

The exercise is powerful because it reveals each person’s individual approach and how it corresponds with or differs from the approach of others on the team. Nothing is more predictive of a team’s success or failure than their ability to recognize and work through these differences. By debriefing the teams on how their efforts succeeded or where they went off-track, they gain a greater appreciation for their individual differences, which ironically, makes them subsequently function much better as a team.

In addition, we calibrate the training approaches used in our training discussions based on the insights we derive from the experiential exercise.[2] Concrete examples need to be created and translated into the different learning styles of the participants to ensure understanding, relevance, and audience engagement. This approach drives active participation in the learning process. This active involvement ensures that participants are not merely passive listeners, thereby enhancing their understanding and retention of the subject matter. 

Typically, they find this approach to ERM training much more engaging and consistently grade it as more worthwhile and relevant than what they had previously experienced in other training sessions. It’s a shame that our high school and college instructors weren’t as familiar with this approach. 

Other Considerations You May Want To Address

In addition to Tailored Learning By Style, all training (but especially ERM training) becomes more meaningful when participants can see its practical application. By incorporating real-world examples into the training, we can demonstrate how the theoretical concepts being taught are used in everyday life. In today’s complex risk environment, we could discuss how demographic, economic, or political challenges can create the potential for catastrophic losses, either individually or through correlated risk events. This not only makes the learning process more interesting but also helps participants remember the concepts better as they can relate the events to things they hear about daily on newsfeeds, Facebook, etc. This is a free and easy way to reinforce the knowledge and methodology that you have introduced in your sessions.

Attempting to grasp a large amount of information at once can be daunting. It's akin to trying to consume an entire meal in one bite! To make the learning process more manageable, complex topics are broken down into smaller, digestible parts. This method, known as incremental learning, starts with the basics and gradually introduces more complex ideas. 

Obviously, lectures and handouts may not suffice to explain complex concepts. In such cases, visual aids such as diagrams, charts, and videos can be invaluable. These tools can simplify complex ideas and make them easier to understand. For instance, a flowchart could be used to illustrate the steps involved in explaining a risk correlation matrix, or a video could be used to demonstrate a complex risk concept. You should attempt to ensure that all participants easily understand the materials. Tailor your message to communicate to the dominant learning style of each participant. By catering to specific learner groups, these aids can make the learning material more engaging and comprehensible.

Reinforcement of previously learned material is also a powerful tool in the learning process, as it enhances recall, thereby making the training “stick.” This is unfortunately one area that is woefully neglected in most organizations. As an ERM professional, you are obligated to ensure that everyone in your organization not only learns how to be a risk manager, but remembers how to be one as well. 

There are many schools of thought here, but most training information and memory of it decays rapidly after the initial delivery, unless it is reinforced. Generally, three reinforcements seem to work best, usually at 30, 90, and 180 days after the initial training. The good news is that you don’t need to repeat the training, provided that you reinforce shortly after the initial training. Short email reminders, questions, or anecdotes seem to be effective if they are relevant and directly related to the topics of the initial training.

Conclusion

Technical training can be a challenging endeavor, given the complexity of the subjects involved. This is as true in ERM as in other areas, but few organizations have figured out how to make the training more interesting and relevant so that participants enjoy rather than dread the experience. By applying the insights and approaches we have outlined in this article, you can propel not only ERM but your entire organization on a better training path. With the right strategies and tools, all training sessions—even ERM ones—can be transformed into engaging and rewarding experiences. The ultimate goal is not just to acquire knowledge but to apply it effectively in real-life scenarios. You know what to do. So, keep learning, stay curious, and learn by doing. And continue to explore and introduce others to the fascinating world of ERM. Your organization and your peers will thank you!

[1]Howard Gardner, Theory of Multiple Intelligences (Visual, Linguistic, Mathematical, Kinesthetic, Musical, Interpersonal, Intrapersonal, Naturalistic).

[2] If you are interested in learning more about the exercises we use and would like to try them, feel free to contact us directly. We only ask that you keep them confidential since they lose their impact if known to participants in advance.

By Steven Strickman, LSSMBB and Gary Preysner, CPCU, LSSBB

A lot of companies have basic / rudimentary Risk Management Processes and Systems, which makes them sitting ducks for either the wrath of the Board Risk Committee (or Activist Shareholders) when they get pummeled by a risk…or two or three.  But don't despair - here are some things you can start doing IMMEDIATELY that can lessen or negate these bad outcomes.  Here are 7 things you can start doing right now / this quarter that will help your company navigate choppy business / economic climates and impress your Management team and the Board that you are proactively keeping the company and its interests safe.

How to upgrade your Risk Management Practices, quickly:

   1. Review/Update Your Current Risk Register / System

          a.  A Risk Management process is a lot like an automobile – it runs really well when driven frequently, but is hard to start when it’s been idle for a long time.  Thus, it’s time to update your risk register, prune risks which are no longer relevant / have been mitigated, and begin triaging the ones that matter.

   2.  Define Maximum Downsides to Each Risk, Along with Likelihoods, As They Stand Today

          a. Next, it’s time to define your prioritization factors / method.  And the best way to begin is by identifying the maximum impact that each of the risks can have on the company (and assigning dollar quantities), as well as the potential affected stakeholders, both internal and external that are affected.

   3. Review the company's Near-Term Strategic Plans to See Which Risks have greatest potential impact

          a. It’s also important to review the company’s Strategic Plan and Goals periodically and see which of them might be jeopardized by the higher-ranking risks on the list.  Putting risks through this filter is critical to Senior Management and the Board.

   4. Add Emerging Risks and Re-prioritize the List

          a. Survey / Interview Business Process Owners / Subject Matter Experts on emerging risks, both internal and external.  Be mindful about the changing Economic, Political and Environmental landscapes, and how they might present both risks and opportunities.

   5. Define stakeholders who would be affected by the high priority risks and alert their departments

          a. It's important to identify not just the “proximate” risk stakeholders, but also the adjacent upstream and downstream stakeholders, and how they would be affected by both the risks and the risk management actions. 

   6. Assign the Priority 1 and Priority 2 Risks to Owners / Responsible Parties, ASAP

          a. Assign the top two priority tiers of risks to Risk Owners / Responsible Parties for management and mitigation.  Ensure that these individuals are at the right level, and that reporting lines are clear.  

          b. Have the Risk Owners develop mitigation plans with milestones, as well as communications      plans for reporting progress and escalating issues and incorporate them in the updated Risk Register.

   7. Review progress on Risk Management and Mitigation, soon

          a. Conduct progress review meetings.  

          b. Quickly identify and address constraints and dependencies which may hinder risk  management efforts.

          c. Update risk status based on actions taken / constraints identified, etc.

          d. Go back to Step (a).  Iterate and refine at least every six months.

These 7 steps will instill confidence in your Senior Management team and your investors, among others.  They will show that you understand risk, take it seriously, and are doing more than just checking the “yes, we have a Risk Register" box.  Good luck and smooth sailing. 

Steven Strickman, LSSMBB is a Founding Partner in the Ironwood Consulting Group, LLC, as well as the President of Serratus Management Consulting, Inc. and specializes in Risk, Operations and Expense Consulting for the Insurance industry.  He is also a development partner with SRA Watchtower. 

Gary Preysner, CPCU, LSSBB Gary Preysner, CPCU, LSSBB, is the President of The Ironwood Consulting Group and is the Insurance Enterprise Risk Practice Leader with SRA Watchtower. He works with insurance companies across the globe to improve their insurance-specific processes and implement new technologies, while simultaneously strengthening their risk management capabilities. Contact Gary to discuss how he has developed creative and novel solutions to some of the most difficult process and risk challenges that insurance companies face.  

SRA Watchtower (SRA) is a technology solution provider serving the Financial Services, Insurance and Technology Industries. SRA's proprietary technology and methodology was designed and built by industry experts to enable clients to navigate risk and drive growth. SRA Watchtower is an intuitive risk intelligence and performance management platform built to continuously inform, enlighten, and empower executives and boards. SRA has helped hundreds of banks effectively navigate through significant risk events since the 2008 financial crisis. 

Learn more at https://www.srawatchtower.com/watchtower/insurance