In the risk space, whether you are operating as a Chief Risk Officer focused on all organizational risk or a Traditional Risk Manager focused on hazard risk, you are working in or designing a risk system that is required to move people and processes to action.

To move people and align resources to action, the most valuable thing a risk leader can do [whether it is a global message on your Enterprise Risk Management initiative or a targeted message on your hazard risk program] is to package the message and “SAY IT IN 5 MINUTES”. Risk initiatives are complex; they involve many stakeholders and processes. For any message to be effective it must successfully negotiate through organizational obstacles, politics and silos. Risk programs will not move forward if the message is not clear and stakeholders cannot understand and connect to the why, how and expectations.

Process More Important Than The End Product

Risk leaders have an incredible opportunity to demonstrate value by committing to putting “the message” into a 5 minute Corporate Risk Video.

By making this commitment, risk leaders will soon learn that going through the process is even more important than the end product. By committing to this “5 MINUTES”, it forces them to listen to and consider the perspective of all stakeholders and it requires capturing a meaningful story that all can see and embrace, one founded in purpose and has value that will be around for many years.

If you can effectively capture the heartbeat and include stakeholders in the process, you will be able to begin driving passion into an organization from the backroom and owners and employees will ultimately drive the risk process.

This exercise will support your culture and this process of being clear & concise will translate into the on-going branding that your risk initiative requires.

5 Steps to 5 Minute Message

Your 5 minutes need to be more than an emotional/feel good story. You will get the most out of it by incorporating the following 5 Steps:

1) Decide what you want your message to do – What action are you looking for? Make the commitment to go past the informative story to one that motivates and drives action.

Put yourself in the seat of every stakeholder and be realistic.

• Will they get your message?
• Will it motivate them to action?

This is the first test of the value of your risk program. If your program message is built on policies and procedures you put in place and your goal is purely compliance, your audience will see this and likely tune out within the first 30 seconds.

2) Be clear on your identity – Successful companies are driven by a mission which is the reason for existence from the front room (C-Suite) of the organization. This mission describes the purpose and overall intentions. It supports the company vision and serves to communicate the purpose based on core values. Company leaders put time and resources into this because, if done properly, it will be the heartbeat that drives what everyone does.

The problem is that corporate heartbeats (values, vision and mission) do not naturally translate passion into risk initiatives. Before writing the script, make sure that you are clear on the risk program purpose and values and be clear in your mind what this looks like.

What it looks like must come out in your message. Risk Leaders have an opportunity to create a heartbeat and drive passion into an organization. Your 5 minutes will have no value if your message is not founded on values that translate into a vision and mission that gives your program passion and meaning. Safety values, vision and mission are core to your risk system design.

3) Define the why, the how and the expectation – Risk statements typically have a lot of buzz words and unrealistic goals. For example, in the hazard risk area, although “Zero Accidents” is a term many use, it often leaves stakeholders frustrated because the challenge is tossed out without valid support or a plan to meet this goal.

Although your 5 minutes can be packaged to look pretty, if you are not addressing the why, how and expectation in a way that is obtainable, people will not connect and your message will just be another story that does not get a second look and does not drive them to action.

4) Include stakeholders – Best practice risk programs have roles and responsibilities for all parties. This is the opportunity to define all stakeholders’ roles and responsibilities, to get their perspective and include them in the message and the final edit. Saying it in 5 minutes is something stakeholders from each of your 3 Lines of Defense can contribute to and should be able to celebrate and support when it is completed.

5) Match the Video with the Script (your people in action) – This is the risk leader’s opportunity to tell the message in a way it has never been told. Each word is important and the video shots supporting the message are extremely valuable as well as the words and phrases that you emphasize. Scripts break your message into the hook, introduction, your value and message on the why and how and provides the expectation and conclusion. The hook gets their attention and ensures the audience is listening and the conclusion is your call to action.

“Say it in 5 minutes” is all about leadership. You cannot expect to engage and move people and processes to support your plan if your passion and your message are not understood or clear. The time you spend developing your 5 minutes can be one of the most valuable things you can do to impact your program.

Author Mark Bennett, Founder of Risk Innovation Group (RIG), is dedicated to helping large employers face the complexities of risk through innovative Enterprise Risk Management (ERM) practices. ERM programs don’t just help large employers manage business risks more effectively; a well-developed ERM program can protect and create value as well as improve business performance and generate a strong competitive advantage.  Contact: m.bennett@riskinnovationgroup.com

Most Enterprise Risk Management (ERM) initiatives originate from the CFO. In most organizations, the CFO is most qualified, most responsible and most required to update the executive team & board on organizational risk. They realize that each part of the organizational risk puzzle is a point of failure that can disrupt revenue streams and there is value in having the structure to identify and deal with the enterprise of risk an organization faces.

Forward-thinking Risk Managers take the position that they are the most qualified, responsible and required to support the CFO putting this risk puzzle together.

• They are most qualified because they have experience in risk assessment frameworks; they work across silos and regularly deal with complex risk. In short, dealing with risk is in the Traditional Risk Manager’s DNA.
• This resume makes them the most responsible to embrace a more comprehensive approach to risk that is robust enough to give a more global risk assessment process a jump start. This can be done by simply piloting & demonstrating how key ERM principles work in their “Business Process Area – Hazard Risk”.
• To earn the right to be a “Champion” to support the CFO in a broader risk initiative, the Risk Manager is most required to get it right in their area. In short, demonstrate value and make an impact in the hazard risk space.

To earn your way to a more strategic role, Risk Managers should select a Landing Spot, Map the Baseline, Be Structured About Improvement and Put Focus on the Overall Design.

Pick Your Landing

Earn credibility by confronting your biggest challenge head on. For most in the hazard risk space, their most complex area is workers’ compensation (WC). The stakes are high, the resources are typically limited and opportunity is significant. This area involves many stakeholders and has many requirements that must all fit together to get it right.

• Take the overwhelming and break it into manageable parts so that logic to structured continuous improvement can take place.
• The parts of WC are program foundation, injury prevention, post-injury management, claims management, controlling medical, safety culture and team collaboration.

Map the Baseline

One of the most valuable things a risk manager can do is take a step back and define the complex area/landing spot’s current baseline.

• A clearly defined baseline is an essential part of making progress. In fact, no changes should ever take place without a clear understanding of all the current controls in place, processes and how they connect to each other.
• To the extent you can define your baseline is the extent your stakeholders (internal & external) will be able to support you. A clear baseline not only defines current controls in place that match up with your “root cause” risk but it quantifies & qualifies what is being done so that available time & resources can be allocated to what is most important.
• Your clearly defined baseline becomes the roadmap for all stakeholders to support you. A baseline should be a living document that is updated as changes take place.

Be Strategic about Improvement

Get your ground game moving. This will open up your progress to some bigger success. The ground game is about focusing on the parts. For each of the parts focus on defining, designing and continuous improvement.

• The “Define” simply means putting focus on what is currently being done, the why to the process and if it is effective.
• The “Design” is about exploring options and identifying better/more efficient and effective processes.
• The “Continuous Improvement” is all about making logical and informed decisions and moving targeted areas forward.

Put Focus on the Overall System Design

This is the fun part that allows you to go for the big yardage and the win. It is fun because it forces you to operate as an entrepreneur. If you do not enjoy this part, you have lost your pulse and need to find it.

• Your “Risk Pulse” is your drive to make a difference and to figure out the complexities of the risk puzzle.

Every puzzle is solvable and if you have the pulse to take on the challenge, you get to use your creative skills, your design skills and your marketing skills as well as project management and leadership skills as your “Risk System” takes shape in front of your eyes.

• Figuring out the puzzle shows that you are finding time to operate strategically and putting thought and structure into the desired outcome. Like building a complex building, you are defining the specifications, designing to specs and building in structured feedback to make sure there are no missed opportunities.
• The specifications involve knowing the demographics, resources, obstacles and specifically what you want your risk system to do. This translates into a clear message and pre-frame that ensures the intent of the message is heard loud and clear.
• The design is all about defining your “ 3 Lines of Defense” and mapping out what is most important with details on how it will be accomplished. Items like roles, obtaining buy-in, accountability and engagement never just happen, they only come with a targeted design to the process.

You cannot achieve the desired behaviors/the output of your “Risk System” without a process for feedback. 

• There needs to be both formal and informal processes to capture feedback from your stakeholders. You need to understand how stakeholders are receiving your message and capture opportunities for insight and engagement.

By applying core enterprise risk principles to the most challenging part of your hazard program, immediate progress will happen in months and sustainable results will be realized within a year. You will have earned the opportunity to transition your risk platform to a broader risk initiative to support the CFO and organization.

Author Mark Bennett, Founder of Risk Innovation Group (RIG), is dedicated to helping large employers face the complexities of risk through innovative Enterprise Risk Management (ERM) practices. ERM programs don’t just help large employers manage business risks more effectively; a well-developed ERM program can protect and create value as well as improve business performance and generate a strong competitive advantage.  Contact: m.bennett@riskinnovationgroup.com

Enterprise Risk Management (ERM) gives a holistic view of all risk across the enterprise and allows for timely decisions based on apples to apples comparisons. It requires process owners to think like owners and to provide timely and accurate reporting. It transitions what is most important into actionable plans that are supported by a consistent process for controls and monitoring. A company seeking to improve workers’ compensation management may be considering ERM improvements, and vice-versa.

Companies who engage in ERM have a strong competitive advantage. It gives all stakeholders the confidence that the management team is applying a structured approach to identifying, assessing and managing the company’s most important risk. It makes a clear statement to the value of appropriate allocation of resources  and efficiency in governance.

With the clear value ERM brings, why are so many companies missing the opportunity? Why do they recognize the value but struggle to get their programs up and running? Our research and experience shows:

1              They make it more complex than it needs to be

2              They spend too much time prepping and not enough time doing

3              They miss opportunities when it comes to technology

We recommend simplifying foundational concepts, streamlining the process into immediate action and using technology to get your program off the ground.

Make it Simple

Most have heard the terms and concepts of ERM, but do not have the time to get their arms around them. To successfully get off the ground and make progress, the first step needs to be — MAKE IT SIMPLE. Not just initially but for the long haul. Peers at an executive level need to be able to be on the same page and the message to process owners needs to be clear. If it is not simple and clear you will waste count- less hours with no real value.

A best practice ERM framework simply means your company has an efficient and effective way to collect risk across the enterprise, a way to quantify risk across business silos and a way to put what is most important into action.

If your employees are not aware you have an ERM initiative, you don’t have one. Foundational to the process is identifying what the team looks like that makes up your 3 lines of defense; defining roles, clearly/concisely communicating the core concepts and engaging stakeholders to be part of the process.

Moving forward, we recommend finding simple and efficient ways to capture the team’s perspective on risk. Keep the questions straightforward and use technology to gather data in a way that is easy for them. Use simple questions like, what could hinder their success in reaching objectives, what risk they have encountered over the last year, what they heard or observed from others and what is happening externally—in industry, among competitors, regulators, etc.?

The next step of the equation is putting time into dealing with governance obstacles. Things start to slow down when “simple” is not applied to the long haul. Look for opportunities to identify obstacles and apply efficiency.

Just Get Started

As companies are attempting to get their ERM programs up and running, they mistakenly think it must be perfectly mapped out before steps can be taken. This, unfortunately, pro- motes the idea of long drawn out committees with no value being realized for upwards of 2 years down the road.

Take steps that build long term success, while in tandem, build in steps to capture immediate value. Many companies take too long to capture their top risk and even longer to translate it into action. While the framework is taking shape and you’re capturing and organizing your top risk, jump ahead of the process, and put key risk you know will likely end up as a top 10 cate- gory into an ERM Plan. This will be time well spent to pilot a repeatable process to consistently assess, mitigate and monitor risk that will be transferable to other risk plans.

Begin with Technology

Unfortunately, some companies get started on an ERM initiative and end up putting their efforts on the shelf. This is a natural outcome of not simplifying and getting started (streamlining the process). Avoid wasted time and efforts by using technology early.

Many companies mistakenly think ERM technology comes into play after a mature program is in place. They do not take advantage of tools that can streamline the educational process, allow for efficient platforms to collect data, transition risk into structured plans and transition obstacles into governance efficiency.

ERM Checklist

• Do staff/process owners know you are focusing on ERM and are they engaged? 
• Is there consistent and effective reporting on risks and controls?
• Are you putting efforts into keeping it simple
• Can cross-silo’d decisions be made from your assessment scale?
• Do you have an easy way to capture risk?
• Is there structured focus on governance efficiency?
• Are your most important risks getting transitioned into action?

Author Mark Bennett, Founder of Risk Innovation Group (RIG), is dedicated to helping large employers face the complexities of risk through innovative Enterprise Risk Management (ERM) practices. ERM programs don’t just help large employers manage business risks more effectively; a well-developed ERM program can protect and create value as well as improve business performance and generate a strong competitive advantage.  Contact: m.bennett@riskinnovationgroup.com

Once a company is successfully able to implement the foundation of their Enterprise Risk Management program, the attention soon shifts to having an effective map that allows important connections to be made.

Almost all companies have organizational charts. Most companies, however, do not have a holistic view that outlines business processes, relationships and resources and how it all fits together. In short, a map that uses technology to support meeting organizational objectives.

Maps give options and technology provides insight that allows getting places quicker and more efficiently. As you are leaving work on a Friday at 5 PM it is certainly helpful to know what alternative routes are available. When your GPS takes you a different route because it can identify bottlenecks due to an accident, it just gave you another advantage.

Organizations are complex. They involve things like business processes, resources, people, policies, relationships, physical assets, applications and data repositories in the midst of dealing with risk, performance and readiness issues. When these things are captured and aligned in business silos it makes your commute (business objective) from point A to B even more challenging.

Business maps, unlike organizational charts, take into consideration the complete picture with a purpose, by design, to efficiently get you somewhere.

Making the Connections

No one knows everything in your organization. There is too much happening and it is constantly changing. To make good decisions, the goal is to find the critical paths, priority and resources that need to be involved.

Start by organizing by resource rather than by use or department. Once the resources are organized and defined, it makes it much easier to establish important relationships. For example, if your resources are defined and you use your business map to draw the lines/make connections between a “risk” that affects 3 different business processes in your organization and turn the solution into a collaborative vs. silo’d effort, you made progress.

Forward thinking companies take advantage of technology that allows important connections to be made.

A Natural Starting Point

As noted by Michael Stack, a principle at AMAXX, workers’ compensation takes a village. When you have and need a village working together, a map is essential. In this very specialized business process area, you are traveling through some very complex neighborhoods and any wrong turn can be costly.

Wrong turns such as poor communication and delayed actions translate into missed opportunities.

How the processes, relationships and resources tie together in workers’ compensation is a system/map that works best when it is defined in a way that is transparent to the team involved.

When a holistic picture is concisely captured and communicated, it makes it much easier for stakeholders to contribute, provide support and make connections that translates into continuous improvement of your program.

Capturing the collaborative efforts of a village takes a clear map in the workers’ compensation space. For companies who have not made the leap to Enterprise Risk Management (ERM), this area becomes a perfect landing spot.

Applying ERM concepts to workers’ compensation programs allows organizations to demonstrate success and milestones that are transferable and build momentum to a broader ERM initiative.

Author Mark Bennett, Founder of Risk Innovation Group (RIG), is dedicated to helping large employers face the complexities of risk through innovative Enterprise Risk Management (ERM) practices. ERM programs don’t just help large employers manage business risks more effectively; a well-developed ERM program can protect and create value as well as improve business performance and generate a strong competitive advantage.  Contact: m.bennett@riskinnovationgroup.com

The term risk takes on a new meaning to forward thinking organizations. As noted by a leading Enterprise Risk Management software provider, Logic Manager, it is a Risk Based Approach to Business.

Risk is the overarching theme across all business areas. It resides in operations, shared services such as IT, HR, finance and other dimensions including, compliance, geographic regions and strategic initiatives to name a few. In addition to these risks, executives also face the risk of governance efficiency, things such as silo’d activity, scattered information, misalignment of priorities and unknown relationships that have a direct effect on the bottom line.

As companies get larger the challenges are real and there are many pieces to the puzzle. In fact, it appears so complex that some companies never make it to the point they start pulling the most important pieces together. Like a deer in the headlight they stand motionless doing what has always been done and can’t get started making valuable connections that have a bottom line impact.

Putting the Puzzle Together

How do you get started? In short you count the pieces, do the edges and look for the connections.

Count the Pieces

Did you ever do the hard work on a puzzle only to find that many of the pieces were missing. The starting point is pretty straight forward. Identify the pieces you are dealing with. In most organizations the pieces are known but not clearly defined.

Do the Edges

Start with the low hanging fruit. In a complex puzzle you go straight to the edges. It takes an overwhelming amount of pieces down to something you can manage. Once it gets started, there is still hard work but it makes it easier to pull together. Begin complex puzzles/ business initiatives in areas that can be used as a foundation to pilot and demonstrate repeatable processes.

Look for the Connections

As you are shifting through the many remaining pieces, the colors and shapes become very important. Build your foundations on taxonomy (systematic classification) that can help identify and take advantage of natural connections that do not normally get made.

Organizations may have the best people, resources and intentions to move initiatives forward, but if they can’t find a logical starting point, it all breaks down and the status quo never turns into a completed puzzle. A risk based approach to business should not take longer than 6 months to get off the ground. In fact, if the puzzle is mapped out correctly, significant value can be demonstrated in 90 days.

Author Mark Bennett, Founder of Risk Innovation Group (RIG), is dedicated to helping large employers face the complexities of risk through innovative Enterprise Risk Management (ERM) practices. ERM programs don’t just help large employers manage business risks more effectively; a well-developed ERM program can protect and create value as well as improve business performance and generate a strong competitive advantage.  Contact: m.bennett@riskinnovationgroup.com

Collecting and prioritizing risk data is only valuable if your organization has a way to transition this knowledge into action. Many companies struggle to go to the next step of making their Enterprise Risk Management (ERM) programs actionable.

ERM drives your biggest risk into plans, ones that align with and support your strategic goals. Plans are assigned an owner and provided a repeatable process that insures root cause risks that make up the plan have controls, the controls have owners and the activities that support controls are clear so they can be effectively implemented and monitored.

Monitoring of controls, effective reporting on progress and establishing relationships that allow for efficiencies among plans and other important business processes are what drives action.

Business Continuity & Continuous Improvement

Some ERM plans have a limited scope for a specific purpose and others are on-going. On-going plans address an important aspect of your business that requires continuous focus. These on-going plans are the organizations opportunity for business continuity and continuous improvement.

ERM plans provide formal documentation on what is currently happening; who owns the activity that is taking place and supporting details on the activities. The objective is to not lose any momentum during times of disruption.

Continuous improvement works best when everyone is in the know and able to contribute. Formalized ERM plans give both the birds-eye view and details for all stakeholders involved to enable them to effectively review and provide their perspective. Collective Risk Team input and participation is what drives collaborative efforts and best use of available resources.

Action is Everything

Two questions drive to the core of ERM – #1 What is the value of your organization and #2 What could kill that value. Foundational to ERM is a risk assessment process that identifies risk and missed opportunities that could kill the value.

There is no progress if the identified risks and opportunities do not transition into plans. The ERM Plan is the consistent and repeatable process to make what is most important, actionable.

Repeatable Process

Best practice plans force accountability and supports plan owners meeting their objectives. They include clear and concise descriptions on purpose, effective ranking displayed through heat maps and a summary of controls attached to each risk. They also include reasoning for the scoring that takes place, feedback on what could go wrong as well as details on what actions are required.

Apples to Apples

When organizations have multiple plans it can be challenging to determine which plan/which focus is most important at any given time.

Scoring on Impact, Likelihood and Assurance feed from each risk within each plan and aggregate up to both Inherent and Residual Indexes which allow for educated decisions on resources both among and within plans.

Author Mark Bennett, Founder of Risk Innovation Group (RIG), is dedicated to helping large employers face the complexities of risk through innovative Enterprise Risk Management (ERM) practices. ERM programs don’t just help large employers manage business risks more effectively; a well-developed ERM program can protect and create value as well as improve business performance and generate a strong competitive advantage.  Contact: m.bennett@riskinnovationgroup.com

The CFO is the most qualified to provide CEO and board operational insight. In most business environments, silos are pronounced and organizational noise is loud. Obtaining and providing a transparent perspective can be challenging.

In an ERM platform, process owners perform risk assessment in a standardized and repeatable method that aggregates up to the CFO. The Chief Risk Officer or Risk Manager is responsible to provide the framework and to ensure assessments are on-going, complete (strategic &  operational) and based on the root causes of the company’s business risk.

A centralized risk repository provides feedback on risk, across functions  and levels, and is qualified and quantified and easily prioritized so the CFO can provide one comprehensive picture to the board.

Operational insight is not something a CFO should be tracking. A structured process ensures current and emerging risk is being evaluated and assessed on a day- to- day basis.

Is there focus on the silos?

All organizations have silos. It is challenging to make connections across silos and difficult to effectively escalate even the most obvious concerns. Data is collected in different places; each area only has a piece of the problem and typically, activities and the conclusions are confined in  silos.

What efforts, resources and thoughts are put into breaking down silos? The core to ERM is addressing silos so that valuable resources are not wasted and cross-functional efficiencies are not lost.

Hazard vs. Business Risk

Traditional risk management deals with hazard-based risk. As hazards are negative, the goal is to avoid or eliminate risk.

There is a “seize the opportunity” component to business risk. All business decisions involve risk; they shift efforts and resources. The upside to these decisions is gain and the downside, loss.

ERM applies risk management logic to business decisions so that efforts and resources shift to an organization’s most important needs and key opportunities are not lost.

Is organizational noise good or bad?

It depends – random and unsubstantiated comments can undermine well thought-out plans.

Opportunity to voice opinions is what drives a healthy culture. Framework that encourages feedback through structure that requires thinking, processing and presenting like business owners sets the stage for a collaborative and innovative environment.

Author Mark Bennett, Founder of Risk Innovation Group (RIG), is dedicated to helping large employers face the complexities of risk through innovative Enterprise Risk Management (ERM) practices. ERM programs don’t just help large employers manage business risks more effectively; a well-developed ERM program can protect and create value as well as improve business performance and generate a strong competitive advantage.  Contact: m.bennett@riskinnovationgroup.com