Here's how you can foster a culture of risk awareness and accountability among employees.

En mi actual puesto de trabajo, hemos identificado una serie de riesgos entro los cuales se encuentran: estratégicos, operacionales, políticos, financieros, reputacionales, de seguridad, entre otros. Lo importante, independiente del tipo, es entender que riesgo contiene dos conceptos claves: incertidumbre y objetivos. En definitiva, y en línea con la definción de la ISO31000, aplicamos el concepto de los efectos de la incertidumbre en la consecución de objetivos, sean ellos estratégicos o específicos.

Establishing regular training sessions and workshops can keep risk management top-of-mind for all employees. Moreover, creating a feedback loop where employees’ insights on risk are valued and acted upon can enhance the overall risk culture. This approach not only mitigates risks but also empowers employees, making them proactive participants in safeguarding the organization.

At a midstream oil and gas company, Steve, the Risk Manager, organizes a workshop to define risks specific to their operations. He gathers employees from various departments to discuss and identify potential risks, such as pipeline leaks, regulatory compliance issues, and cyber threats. During the workshop, Steve uses real-life examples and data to illustrate these risks, ensuring everyone understands their potential impact on the company’s operations and reputation. By clearly defining these risks and explaining their consequences, Steve sets a solid foundation for fostering a culture of risk awareness among the employees.

Fostering a culture of risk awareness and accountability starts with defining what risk means within your organization, engaging employees in open discussions about various risks—financial, operational, strategic, and compliance-related. By creating a shared understanding, employees can better recognize potential issues early. Open communication is key; encourage employees to report concerns without fear of retribution. For instance, implementing regular risk workshops where employees share real scenarios can be highly effective. Emphasizing the importance of risk management through storytelling and tangible examples ensures everyone understands their role in maintaining organizational resilience.

Building a risk awareness and accountability culture involves clear communication and active employee engagement in risk management. Start by educating employees on the importance of risk management through regular training sessions. Encourage open dialogue about potential risks and create a safe environment for reporting concerns. Involve employees in developing risk mitigation plans, ensuring they understand their roles and responsibilities. Recognize and reward proactive risk management behaviors to reinforce accountability. By integrating these practical steps, employees become more engaged and committed to maintaining a risk-aware culture.

Si duda alguna la educación y concientización es la clave para una correcta identificación de riesgos, pero esto debe empezar desde los altos niveles de la organización, porque muchas veces el personal buscar mejorar los procesos, pero las gerencias o jefaturas no dan el aval o no autorizan las inversiones necesarias para ejecutar.

Lo que aplicamos en mi organización va en dos vías: una es la construcción de doctrina o estructura de gestión de riesgos, a través de un procedimiento específico para el tratamiento de riesgos estratégicos y otro para riesgos operacionales (ambos avalados y respaldados por la alta dirección). La segunda acción es la materialización de refuerzos o talleres en la ejecución de estas metodologías para crear conciencia de seguridad y conciencia de gestión de riesgos.

After defining the risks, Steve implements a comprehensive training program to educate staff about risk management. He organizes interactive sessions where employees learn about identifying, reporting, and mitigating risks. These sessions include case studies and simulations that reflect the company's operations. For example, employees participate in a simulated pipeline leak scenario, practicing their response and understanding the importance of swift action. This hands-on approach helps employees grasp the significance of their roles in managing risks, making them more vigilant and proactive in their daily tasks.

Fostering a culture of risk awareness and accountability among employees starts with comprehensive education. Implementing targeted training programs, such as workshops and regular briefings on recent incidents and lessons learned, empowers staff to identify and assess risks effectively. By sharing compelling personal examples where proactive risk management mitigated potential issues, and emphasizing the importance of each individual's role in safeguarding the organization, employees are more likely to integrate risk management into their daily routines. Cultivating this mindset ensures a proactive, vigilant workforce dedicated to minimizing risks and enhancing overall organizational resilience.

Risk professionals need, above all, to get out from behind the desk and "get their hands dirty" - visit the construction site, engage with the project team and view and understand the actual issues in practice. Translating the theory into real time collaboration to influence risk mitigation plans and efforts will foster a new perspective of the risk function and create a sound basis for Risk being viewed as a trusted senior partner and key advisor impacting strategic decision- making

Un buen proceso de gestión de riesgos puede ser transversal a toda la organización. Puede tener definidos los valores de impacto de diferentes naturaleza (financieros, operacionales, ambientales, de imagen, etc.). Es fundamental definir qué es un riesgo, qué un peligro y qué una consecuencia. Si no se logra una claridad al respecto es muy difícil hacer una evaluación de riesgos y utilizarla para priorizar la asignación de recursos que, en definitiva, es el objetivo final de la implementación de un proceso de este tipo.

En una estructura basada en gestión por procesos, se emplea el concepto "due?os de procesos". Ellos son los que conocen de mejor forma su proceso, su secuencia, amenazas y vulnerabilidades, así como también los objetivos a alcanzar. En este sentido, también son concientes de los riesgos a los cuales su proceso se enfrenta, por lo que también aplica el concepto de "due?os de riesgos". No significa que un due?o de proceso sea experto en gestión de riesgos; para eso existen los gestores o unidades de riesgos quienes asesoran y guían. Pero en definitiva, el due?o del proceso tiene bastante que decir y hacer en el tratamieto de los riesgos a los cuales está expuesto.

To ensure accountability, Steve assigns specific risk management responsibilities to key employees. He designates risk champions in each department who are responsible for monitoring and reporting risks within their areas. For example, Jane, a senior engineer, is tasked with overseeing the integrity of the pipelines, conducting regular inspections, and reporting any anomalies. By assigning ownership, Steve ensures that each department has a dedicated point person for risk management, making it clear that everyone has a role to play in maintaining safety and compliance.

In addition to formal rewards, consider creating a ‘Risk Champion’ program where recognized employees can lead risk management initiatives and mentor others. Sharing success stories of risk mitigation in internal communications can also highlight the tangible benefits of proactive risk management. By consistently valuing and celebrating these efforts, you build a strong culture of risk awareness that permeates all levels of the organization.

Steve introduces a reward system to recognize employees who demonstrate exceptional vigilance in risk management. He creates a "Risk Awareness Award" given quarterly to individuals or teams who have identified and mitigated significant risks. For example, when a team successfully averts a potential cyber attack by promptly reporting suspicious activity, they are publicly acknowledged and rewarded. This recognition not only motivates employees to stay vigilant but also highlights the importance of proactive risk management within the company culture.

La misma ISO 31000 considera la mejora continua, tal vez no con los mismos conceptos del ciclo Deming, pero incorporando la necesidad de seguimiento, control y evaluación, tanto de las medidas de prevención y mitigación, como del proceso de valoración de los riesgos. Los riesgos, al ser muchas veces volátiles o "líquidos", van mutando y manifestándose de manera silenciosa, lo que genera la necesidad de seguimiento permanente a las etapas de identificación, análisis y valoración.

Incorporating a regular review cycle for your risk management framework, perhaps quarterly or biannually, ensures it remains relevant and effective. Facilitating ‘lessons learned’ sessions after any major risk event can provide valuable insights and drive improvements. Encouraging a mindset of continuous improvement among employees not only keeps your organization agile but also fosters innovation in identifying and mitigating emerging risks

Create a solid training plan where the focus is not just on "How" but also on the "Why" and "What" aspects i.e. training should not be imparted with just the processing knowledge. Employees performing the task should also be clearly made aware of the background (Why you are doing the activity) and the risks (What are the consequences if not done). This approach would instill a culture of risk awareness and employees would demonstrate accountability for the assigned tasks. Understand the training needs and knowledge gap in the teams and customize the training plan accordingly. You will set the team up for success as one can never go wrong when the basics are taken care!

Finally, Steve fosters a culture of continuous improvement by regularly reviewing and updating the company’s risk management strategies. He implements a feedback loop where employees can suggest improvements based on their experiences and observations. For example, after a major project, Steve conducts a debriefing session where the team discusses what went well and what could be improved. This ongoing process of evaluation and adaptation ensures that the company’s risk management practices evolve with changing circumstances, keeping the company prepared and resilient.

Build compliance-by-design into business processes as much as practicable. This helps promote sound risk culture while minimising the need for staff members to even think about it.