Helpful Tips For The Beginners
The purpose of this post is to provide quick practical tips and steps to help beginners in the three lines of defense functions and others become better in detecting and predicting risk probabilities and impact severity to empower them to proactively intervene in spotting and addressing automated system process driven issues when necessary. The key headlines covered are:
- The Big Challenges in risk prediction
- Responsibilities For Risk Prediction
- How To Find the Right Risks
- Internal and External Factors Influencing Business Performance
- How Top-Down and Bottom-up work, The Merits and Demerits
- Key Risk Indicators:
- Sample templates
- Conclusion
Introduction
Enterprise Risk Management (ERM) is one of the most critical responsibilities of everyone in every organization and requires that everyone in the organization must individually and collectively demonstrate the ability to put the best interest of their company first by doing the following:
- thoroughly thinking through all business intents and problems, weighing the cost benefits of all options,
- choosing the ones that offer the most benefits while
- upholding ethics and business conducts and the applicable laws and regulations.
Risk Assessment is the first step in the Enterprise Risk Management lifecycle and has two distinct categories of activities, namely: Risk Predictions and Risk Exposures Computation.
Risk predictions involve three key activities:
- finding the right risks
- linking the risks to the company’s strategic goals and objectives
- Predicting likelihood of the risks occurring and potential impacts.
The risk prediction results are used as inputs into the computation of the exposure elements which are used to drive decisions and actions on the risk treatment options.
Risk exposures computation involves the following activities:
- Computing inherent risk values and risk tolerance limits.
- Ranking inherent risks in order of priority and importance
- Selecting the top big inherent risks to focus and making decisions on the treatment options.
- Developing strategic initiatives and implementation route maps for ensuring that those inherent risks above risk tolerance limits are effectively controlled while those below the risk tolerance limits are proactively monitored to prevent escalation beyond the risk tolerance limits,
- Implementing the strategic initiatives, monitoring performance effectiveness and evaluating the gaps above risk tolerance limits
- Implementing Continuous Quality Improvement Programmes to ensure that the risk management processes continue to be relevant in meeting the company’s needs and stakeholders expectations
The Big Challenges
Global surveys and experience have shown that risk prediction is one the biggest areas of challenges to the risk professionals within the three lines of defense (3LOD) functions, particularly the beginners.
One of the key reasons for the challenges is that predicting risks requires good understanding of the company’s purpose and strategic directions, and the factors that influence business performance failures. The beginners in the three lines of defense functions will certainly need time, effective guidance and handholding support to build the required commercial, technical knowledge and experience levels required to deliver quality work results that align with the company’s purpose and strategic directions.
Another big challenge is the developing concerns towards digital technological advancements.
At the moment, digital technological advancements including internet and social media have blossomed the significant benefits derived from the use of Quantum Artificial Intelligence (AI) in driving end-to-end business process automations and performance excellence in diverse fields including Enterprise Risk Management.
Sadly, as the benefits and pressures for deploying advanced digital technologies are increasing, the temptation for some professionals to abdicate their powers, abilities and responsibilities to these technologies is also increasing thereby making this class of professionals being perceived as :
- becoming lazier in seeking quality knowledge and experience,
- lacking patience and critical reasoning in problem solving, and
- ultimately becoming less intelligent in applying themselves in making sound business judgements, decisions and choice of actions to drive business excellence, long-term success and growth.
Again, some other professionals appear seriously overwhelmed with fears that their jobs are being displaced or replaced by these advanced digital technologies.
It is a truism that all technological advancements come with challenges, but my perspectives are that the current advancement in digital technologies, specifically quantum artificial intelligence, internet and social media are never job displacement or replacement agents. They are rather productivity performance enablers and helpful business partners programmed by humans to reinforce work performance excellence by
- providing deeper knowledge (hindsight, insight and foresight) of trends on subject areas and perspectives for the future,
- optimizing time, efforts and resources utilization,
- enhancing quality and volume of data and information processing inputs, methods and outputs,
- empowering users make sound judgements and quality decisions on best choice of actions to moving their organization forward to the right paths of success.
Because no manmade system is perfect or 100% full proof, system malfunctions can occur from the wears and tears of aging physical components, wrongly programmed instructions and environmental factors such as extreme heat or moisture that can affect the hardware system components. Wrongly programmed instructions can happen within any of the software components, namely: Inputs, Processing Methods, Outputs and Terms of reference for analyzing and interpreting output results and making decisions. Any errors in any of the software components will certainly affect the quality of the information required to make sound judgements, business decisions and choice of actions to drive business performance.
When a digital technology system malfunctions, human interventions will certainly be required to ensure accuracy and system continuity. Therefore, it is important that the Risk Assurance and Advisory Professionals should empower themselves by developing good knowledge and experience on Enterprise Risk Management concepts, principles and methodologies and the practical applications in spotting issues and what to do to resolving issues timely to prevent escalations to uncontrollable state.
In addition, the knowledge and experience gained will place the Risk Assurance and Advisory professionals to apply critical thinking in analyzing and interpreting system behaviors and results and making sound judgements and decisions on best choice of actions to resolving the issues and ensure that they meet the business needs and stakeholders’ expectations in alignment with the company’s purpose and strategic directions.