How can you ensure your risk management culture adapts to new threats?

Maintaining a vigilant risk management culture is essential for organizational resilience. Regular discussions, beyond routine concerns, should encompass emerging threats, fostering a proactive environment. Team training should emulate a superhero ethos, enhancing the collective ability to identify and address potential issues preemptively. Integrate technology as a reliable ally, offering real-time insights for informed decision-making. Conduct scenario playdates to envision diverse risk scenarios and ensure policies are updated regularly, aligning them with current best practices. Leadership should embody a mentorship role, not only in routine meetings but also actively participating in risk discussions.

Assessing the risk culture of an organization involves evaluating its attitudes, beliefs, and behaviors related to risk management. This would include areas such as leadership commitment, clear risk governance, transparent communication, and alignment of risk appetite/tolerance/management with business objectives, employee engagement, adaptability to change, and commitment to continuous monitoring and improvement.

Risk evolves and in view of the ever changing business and regulatory environments, we need to ensure we stay in tune by continually assessing existing state to stay ahead of emerging risks and ensure that our controls remain effective over time. Continuous focus and maintaining a robust risk management techniques, strategies and processes is a quick win for operational resilience.

A strong risk management culture will allow a business to tackle threats and opportunities proactively. A common mindset with a strong culture would be to turn a threat into an opportunity. On the other hand a weak risk management culture we often refer to as the “head in the sand approach”. Which would you prefer?

One thing I have learned in my 17+ years in the GRC space, is that nothing works without a top-down approach. It is up to C-suite to set the Risk policy and culture. After that, the rest of the company can then figure out the right path to align to that vision. Too often, internal programs are skewed or influenced by middle management who are affraid to report up poor performance in the program. Nothing is perfect. Get an external unbiased view of where the program and culture truly stands, and then put a plan in place with KPIs to improve and monitor. Then repeat annually. Once the company achieves their KPIs, then you are in maintenance mode and can bring the audits internally.

Regularly review and update risk management policies and procedures to ensure they remain relevant and effective against new threats. This should be a collaborative effort that involves input from various departments and stakeholders. Maintain open lines of communication to ensure that changes in risk management policies and procedures are effectively communicated throughout the organization. Foster a flexible risk culture that is capable of adapting to changes. This means encouraging employees to be open to new ideas and approaches to risk management.

Transparency, trust and accountability are necessary for a strong risk culture. To achieve these, it is imperative to involve stakeholders and include them in the journey. Everyone is ultimately a risk manager.

Involving stakeholders in the risk management process fosters ownership, accountability, and collaboration. Engage them to solicit feedback and insights, aligning risk management practices with their expectations and needs. This collaborative approach enhances risk awareness and strengthens the organization's resilience to potential threats.

According the to latest World Economic Forum Cybersecurity Outlook report "When it comes to the supply chain, which is one of the areas that demands the most collaboration, 54% of organizations fail to understand cyber vulnerability in their supply chain sufficiently – and it shows. Furthermore, 51% of leaders say that their supply-chain partners have not asked them for proof of their cybersecurity posture. It seems that many organizations do not know the extent of their supply-chain cyber risk because they do not ask...The cyber maturity gap between large corporations and medium/ small companies is constantly widening, creating a systemic supply-chain security risk." If we don't look outside the box your biggest risks will come from there.

O envolvimento dos stakeholders nesse mecanismo é essencial, pois gera engajamento e abre acesso neste canal de comunica?ao. Para manter-se atualizado, o melhor parceiro de negocio para que isso aconte?a de forma eficaz, s?o as areas de negocios.

To ensure your risk management culture adapts to new threats, promote continuous learning and awareness across your organization. Encourage open communication about emerging risks and foster an environment where employees feel comfortable reporting potential threats. Regularly update risk assessment processes to reflect current trends and technologies. Invest in training programs that equip staff with the skills to recognize and respond to new risks. Integrate adaptive risk management strategies into the core business planning and decision-making processes. Collaboration with external experts and industry groups can also provide fresh insights and best practices for managing new threats.

A clear vision gets attention and a clear mission to achieve it gets buy in. Both need to be communicated clearly and in terms everyone can understand. It's important to highlight both risks and opportunities i.e. showing both the down and up side.

Na busca de uma vis?o unificada em rela??o a gest?o baseada em risco, a miss?o, objetivo e apetite a risco deve ser estabelecida pela alta administra??o, que deve explicitamente dar exemplo de como agir em rela??o aos riscos e o quanto de risco deve-se assumir em busca dos objetivos. Ficando claro o limite que a empresa deve se envolver, assim fica mais claro para todos os colaboradores como agir em rela??o aos riscos e sai do mundo teórico da gest?o baseada em risco, lembrando que deve-se sempre priorizar caminhos éticos.

Scope risk, also known as goal drift, occurs when project objectives are not clearly defined from the outset. For good risk management, it's essential to communicate your project roadmap to stakeholders from the outset, and to stick to it. Indeed, if the scope of your project is not known to everyone, they may be tempted to revise their requirements along the way. We need to define clear project parameters to emphasize the project's scope. Objective drift is much less likely to occur if you agree on the scope of the project and communicate your vision to stakeholders from the outset. Another way to reduce the risk of goal drift is to organize regular review meetings.

Starting from on boarding a new associate, not just profitability and operations goals but spending time to explain both the need and the results for positive risk management allows for all to buy into the overall strategy. It is never enough to generalize "stay safe, be safe, etc." With a broad stroke, communicate the overall culture that has (or will be) developed regarding risk management and outline specific strategies.

It is crucial to provide employees with ongoing training and awareness programs to keep them informed about the latest threats and risk management strategies. This will help them to stay ahead of potential risks and mitigate them effectively.

This boils down to risk awareness. A risk may exist but if staff are not trained to be aware and look out, it may go unreported or until it materialises.

Realizad educa?a corporativa periodica e investir recursos (tempo x or?amento) é fundamental para um gerenciamento de riscos preventivo e eficaz.

Educating, training, and increasing staff knowledge about risk management culture requires a multi-faceted approach. Some effective strategies could be: 1. Tailored Training Programs: e.g Risk Awareness Sessions. 2. Interactive Learning and Simulations: e.g Case Studies and Real-World Scenarios 3. E-learning Platforms and Microlearning 4. Integration with Performance Metrics 5. Mentoring and Cross-Departmental Learning 6. Regular Communication and Knowledge Sharing: e.g quarterly risk forums or roundtables 7. Ongoing Evaluation and Feedback: By adopting a combination of these approaches, organizations can ensure their employees are well-versed in risk management, leading to a stronger, more proactive risk culture across the company

Proactive risk management culture like speak up, listen up, mock drills, etc helps to manage the emerging risks and also assess the design and operating effectiveness of the controls. Maintaining a risk repository and aligning process controls and org units to the risks helps to fix ownership and accountability of risk at an enterprise level.

There is good conduct and positive risk culture which should be recognised and, where applicable, rewarded. Performance incentives, speak up culture, risk awareness and outcomes should all be considered.

The best risk manager I ever worked with did her best to talk to anyone in the company, from the CFO to the dock workers, buying, shipping, design, and marketing. She found that the line worker often knew more about developing or potential risks than anyone else. She would also run risk scenarios and did her best to avoid single risk points of disruption or failure. The lesson is simple - be curious, learn from everyone in the business, and run scenarios to find what does break and clelbrate that which is resilient.

It’s very hard to change people’s minds; and it’s entirely reasonable for them to believe that no one is rewarded for risk management. We fear whistle blowers will be fired, not anticipate they’ll be promoted or rewarded. Overcoming this preconception requires clear and consistent communication by upper and middle management. They need to identify people making a difference and holding them up as examples in newsletters and speeches.

Keep in mind that here, "risk management excellence" has to also revolve around the individual's or team's ability to change in response to new threats.

Developing the idea that mistakes and errors do happen in business and that reporting them should be seen as a chance to learn and fix things - not blame people - is also good practice

This is probably one of the most important aspects of risk management. The current reality about our existing risk management processes is that they are always a number of steps behind the actual risks. The most important way to keep up is by adopting dynamic risk management which continuously evolves as the business evolves. Business leaders need to ensure that they are walking the journey with their assurance providers so that they are not always doing post mortems but adopting a proactive approach to reducing potential risks with new ventures

Being vigilant and aware is the essence of an effective risk management culture. the more synergies get built, the more robust and effective the culture becomes. In the fast changing world, the time taken to respond to risks can be a game changer

The best analogy I have for ERM is that of a radar which constantly sweeps the horizon to detect new threats and to manage known ones. Risk management should continuously monitor and update risks through regular reviews and dialogue with stakeholders. It has to present the most updated and relevant risk profile.

Subscribe to and regularly monitor for updates to regulations and frameworks that impact your risk domain. Build your program to be agile so that adjustments can be quickly implemented. Lastly adjust our approaches to risk to be more advisory than operational check off the box exercises, we all can be better educated on risks and the perspectives of how that risk impacts the overall business.

To ensure your risk management culture adapts to new threats, stay informed by monitoring industry trends and news, regularly review risk assessments to include emerging risks, provide ongoing training to employees, foster cross-functional collaboration, maintain a flexible framework for rapid adjustments, conduct scenario planning exercises, integrate technology solutions, and garner leadership support for adaptability and continuous improvement. These measures enable your organization to effectively identify, assess, and mitigate new threats as they emerge, safeguarding against potential risks and ensuring resilience in the face of uncertainty.

Use scenario planning to work through how the risks impact your operations and culture to analyze unpredictability and variability. This helps leaders and team members appreciate the viability of assumptions (whether pragmaticistic or theoretical) and risk interdependencies that can influence outcomes. Scenario planning activities require the commitment of time to participate. This investment of time can provide light bulb moments for organizations to be prepared for an actual risk event and the cultural response.

There are very important and interesting points highlighted here already. My two cents on this would be to keep a close eye on the new trends in your respective industry/processes and try to make more conversations/dialogue on these trends with employees. Maybe you could share monthly news letters with few links to articles on new trends. Also, you could encourage your senior leaders to take part in sessions which discuss new developments in the industry so that they could brainstorm with executives and mid level officials in addressing these developments in your organization. Through these discussions, new things will ultimately blend in to your organization culture.

I believe the key to adapting risk management and culture to new threats lies in ensuring that rotating personnel within the company are immediately made aware and trained in their new roles. This guarantees that they swiftly align with the organization's risk management strategies, enabling timely and effective handling of risks. Additionally, establishing a repeatable and sustainable system for onboarding and training can help maintain this alignment over time.

To evaluate if the risk culture is adapting to new threats, it is important for the risk managers to be constantly learning. One important source of information are other risk managers. Participation in forums, billateral conversations are always useful to be aware of new theats.

To ensure adaptability to new threats, beyond the outlined steps, prioritize continuous monitoring, foster flexibility, integrate technology, encourage collaboration, conduct scenario planning, and emphasize leadership commitment. These measures enhance resilience and enable proactive risk management in a rapidly evolving landscape.