Basics of Risk Management – Step 4:  Close the Learning Loop to Optimize Your ERM Performance 

March 2012 Feature Article

By Diana Del Bel Belluz, M.A.Sc., P. Eng.

In this fourth article on the basics of risk management, I'll share tips on how to effectively navigate the ERM implementation journey.

This 4-part series of articles introduces the Risk Wise ERM Implementation and Organizational Learning Cycle and its four essential steps for bringing ERM to life in any organization:

    1. Define the context and criteria for enterprise risk management (ERM)
    2. Assess risks and its implications for performance and stakeholder value
    3. Integrate ERM into business practices
    4. Close the learning loop to fine-tune & optimize ERM

Seasoned ERM leaders will freely admit that establishing the culture of ERM is a journey not a project. Optimal risk management performance isn't achieved by merely introducing ERM tools and techniques. It requires the sustained cultivation of systematic and proactive risk management behaviour.

Indeed, the ERM journey is an exercise in culture change and organizational learning.

Yet many executives charge off on their ERM journey without giving much thought to where they are headed or what is the best path to ERM success. Without an ERM development roadmap, it's no wonder that so many ERM programs fail to gain traction, stall, or are abandoned altogether.

 "Experience is inevitable. Learning is not."
- Paul J. H. Shoemaker 

Successful ERM implementation requires both:

  • an organizational learning framework (e.g., Risk Wise ERM Implementation and Organizational Learning Cycle) to benchmark ERM progress, and 
  • an ERM roadmap to guide the way forward and continually develop the organization's ERM capabilities.

In the fourth step of the cycle, the ERM program is fine-tuned based on a thorough evaluation of the organization's ERM effectiveness, its successes and its shortcomings. To close the learning loop, the leadership team applies the insights gained from the evaluation by updating the ERM roadmap.

Have you defined your ERM roadmap? Whether you have an established ERM program or are just starting out, you need a roadmap to guide your organization on its unique ERM development journey.

Here are 3 tips for charting your ERM roadmap.

Tip #1. Begin with the End in Mind

As with any journey, knowing the desired destination is crucial for making decisions about what capabilities you need to get there. Do you need a bicycle, a canoe or a rocket ship to take you where you want to go?

To define your ERM vision you need to decide:

  • The desired level of performance that your ERM program must produce. This means articulating what value a successful ERM program will deliver and how you will measure its performance. This becomes 'true north' on your ERM maturity 'compass' (see tip #2).
  • The level of ERM capabilities that will enable your organization to meet its ERM performance goals. This means defining three kinds of ERM capital required to advance the organization's unique corporate mission:

*  STRUCTURAL capital (i.e., ERM framework, processes, and tools)  

*  HUMAN capital (i.e., your people's ERM knowledge, skills and culture), and   

*  RISK INTELLIGENCE capital (i.e., how leaders drive the ERM information flows and behaviours that optimize organizational results).

It is a mistake to blindly follow risk management "best" practices because you may end up pursuing a program that is too simple or too sophisticated for your particular needs and unique ERM vision. At Risk Wise we have facilitated many executive teams to develop their organization's ERM vision in as little as 30 minutes.

ASK YOURSELF: What benefit should the ERM program deliver to the organization? What problem will this ERM initiative solve? How should ERM benefit decision-makers? What capabilities will it take to deliver our ERM vision?

Tip #2. Check Your Compass

To properly design any initiative to enhance ERM performance, a solid assessment of the organization's current ERM capabilities and performance is required.

"Prescription without diagnosis is malpractice,
whether it be in medicine or management."
 

- Karl Albrecht 

Many ERM maturity models exist. However, we developed the Risk Wise ERM Maturity model because in our review of over a dozen of the most popular risk management maturity models, we found they focused almost exclusively on the components of the ERM program and contained very little on the key capabilities required to actually implement ERM.

This gap between the design of the risk framework and the capabilities required to implement it is analogous to having a beautifully designed automobile but no driver with the skills to handle the car or to navigate the route to arrive at the destination.

The three types of ERM capabilities (STRUCTURAL, HUMAN, and RISK INTELLIGENCE) support each other like the three legs of a stool. If any one is omitted, the integrity and effectiveness of the ERM program will be compromised. Risk Wise can benchmark your ERM performance and teach you how to conduct an ERM maturity assessment in as little as 2 hours by using our proven ERM Capabilities Assessment Instrument.  

ASK YOURSELF: Is our current ERM performance adequate on these three levels: 

  • Operational. Is there adequate progress against plans to manage priority enterprise risks? How effective are our current management strategies in aligning risk exposures with risk appetite / tolerance?
  • Strategic. How well do our ERM priorities and strategies align with our current business priorities?
  • Systemic. How well do our ERM capabilities meet the organization's needs and anticipate future needs?  

Tip #3. Be Opportunistic

When executives review the results of the assessment of their current ERM performance and capabilities and compare it their ERM vision, they can quickly identify the gaps in their ERM program. It can be tempting to try to bridge all the ERM gaps immediately and simultaneously.

It is wiser to develop a multi-staged route that is achievable given your available ERM resources and the totality of your organization's other priorities and commitments. It gives your people a chance to absorb new approaches and expectations for ERM behaviour. At the end of each phase, you can review your progress and 'recalculate' your route based on the lessons learned. 

At Risk Wise, we offer an ERM Roadmap and Planning Workshop to help our clients chart their unique step-by-step path to methodically build their ERM capacity and maturity. Through structured discussions, we facilitate the senior team to define key long-term milestones and a short-term action plan for ERM implementation.

ASK YOURSELF: Does our ERM development plan strike a balance between strategies to:

    1. strengthen our ERM processes and structures,
    2. develop our people's ERM competencies through training and on-the-job experience,  
    3. cultivate an ERM mindset, and  
    4. optimize the flow of risk information?

 

The Risk Wise bottom line…

Implementing ERM is an exercise in organizational change. An ERM roadmap is an essential tool to keep your organization moving toward ERM maturity. You need to embrace the discipline of learning to continually improve your ERM systems, practices, culture, and performance.

*

To avoid taking a wrong turn on your ERM journey and wasting your effort, time and money, contact: Diana.Belluz @ riskwise.ca  or by telephone at (416) 214.7598.

Follow the links to:

Current Special Offers for Subscribers

Current Special Offers for Subscribers

The codes to access the following special offers have been emailed to all Risk Management Made Simple Advisory subscribers:

  • SPECIAL OFFER: $460 off the full conference fee for Risk Management Made Simple Advisory subscribers on the Resilience 2017 to be held on April 24-26, 2017 in Edmonton, AB. (Subscribers have been sent the instructions on how to access this offer).  Not yet a subscriber?  Don't miss out, click here to sign-up for your complimentary Advisory subscription.

  • SPECIAL OFFER: $150 off the full conference fee for Risk Management Made Simple Advisory subscribers on the Canadian Privacy Summit 2017 to be held on May 2-3, 2017 in Toronto, ON. (Subscribers have been sent the instructions on how to access this offer).  Not yet a subscriber?  Don't miss out, click here to sign-up for your complimentary Advisory subscription.

Not yet a subscriber, but want to access these special offers?

When you subscribe to the Advisory, we'll send you the code for all current special offers along with a link to your New Subscriber Bonus, a copy of Moving Beyond the Risk Map to Operational Vigilance.

FIND OUT FOR YOURSELF why risk management leaders subscribe, click to access the ARTICLE INDEX of all past issues of the Risk Management Made Simple Advisory.

"I save and study each issue of the Advisory. I appreciate how Diana gives very practical advice and links it to fundamental theories and best practices." 

Sherrie Hyde, Risk Manager, Lutherwood

Current Special Offers for Subscribers

The code to access the following special offer has been emailed to all Risk Management Made Simple Advisory subscribers:

  • SPECIAL OFFER: $460 off the full conference fee for Risk Management Made Simple Advisory subscribers on the Resilience 2017 to be held on April 24-26, 2017 in Edmonton, AB. (Subscribers have been sent the instructions on how to access this offer).  Not yet a subscriber?  Don't miss out, click here to sign-up for your complimentary Advisory subscription.

  • SPECIAL OFFER: $150 off the full conference fee for Risk Management Made Simple Advisory subscribers on the Canadian Privacy Summit 2017 to be held on May 2-3, 2017 in Toronto, ON. (Subscribers have been sent the instructions on how to access this offer).  Not yet a subscriber?  Don't miss out, click here to sign-up for your complimentary Advisory subscription.

Not yet a subscriber, but want to access these special offers?

When you subscribe to the Advisory, we'll send you the code for all current special offers along with a link to your New Subscriber Bonus, a copy of Moving Beyond the Risk Map to Operational Vigilance.

FIND OUT FOR YOURSELF why risk management leaders subscribe, click to access the ARTICLE INDEX of all past issues of the Risk Management Made Simple Advisory.

"I save and study each issue of the Advisory. I appreciate how Diana gives very practical advice and links it to fundamental theories and best practices." 

Sherrie Hyde, Risk Manager, Lutherwood

FREE DOWNLOAD

Moving Beyond the Risk Map to Operational Vigilance

Read more about the Risk Management Made Simple Advisory.

"It is so refreshing to read a newsletter that offers real solutions for risk management challenges."
Cathy Taylor
Director, Risk
Kinross Gold Corporation

Jump Start your risk management program.

Receive personalized advice from Risk Wise

See Details

Diana's Pick

Neuroscience and the Nonprofit Manager (written by Andy  Segedin and published in the NonProfit Times) shares some of the tips on how to counteract common biases and habits that impede effective decisions.

The article is based on a workshop that Diana Del Bel Belluz of Risk Wise presented at the 2015 Risk Summit organized by the Nonprofit Risk Management Center.