How can you create a transparent culture for risk reporting?

'Tone from the Top'. 'Walk the Talk'. 'Speak Up Culture.' How many times have you heard these phrases? They are noble, powerful, inspiring. So why do they work amazingly well in some organisations, and fail spectacularly in others? The answer can be summed up in one word. Trust. This noun is defined as the 'firm belief in the reliability, truth, or ability of someone or something'. People in an organisation need to believe in their hearts that they can and should trust someone when they say they report a risk. It matters not whether that person is the CEO, CRO, CPO or your colleague on the next table saying report a risk. What matters is whether you truly believe you can trust them. You create that trust by always acting with integrity.

Anchoring Risk with Honesty To foster transparency in risk reporting, defining and consistently communicating the organization's risk appetite is pivotal. I've witnessed teams flourish when there's absolute clarity about how much risk is acceptable. But clarity alone isn't enough. The integrity of our approach matters. It means being truthful, ensuring that our methodologies are not just consistent but ethically rooted and unbiased. By standing firm in honesty, we not only define our risk boundaries but cultivate an environment where risks are reported without fear or favor.

Creating a no blame risk culture is the most critical element to this. It allows communication and consultation as parts of the risks management process to function effectively and efficiently and encourages shared learning that improves overall risk management.

Communication, a vital process is found lacking in many organizations. The Mission, Vision and Appetite in many organizations are not properly articulated down the ladder in the language which is understood by the first line of defence. This issue to a greater extent can be taken care by feed-back mechanism, if it is there. If not, then Risk Culture may go for a toss.

Out of my experience with international banking groups risk is everybody’s role, by definition there are roles and responsibility of Risk, whistle blowers etc, yet there is a holy triangle it’s top is business and then quality and control. All the organization is operating within this triangle in harmony and empathy, ie risk role is to be protective as well as corrective, his role is to protect the bank but without hindering the business, Vice-versa business role is having satisfied clients generating revenue but without exposing the organization to undesired or unforeseen risks. The triangle is dynamic in reflection with present and expected market conditions and prevailing of risk culture and risk indicators inside the organization.

One thing I have found helpful is being transparent. Follow up with the line manager in areas where we are not clear, ask questions, and escalate before it is too late.The last being most crucial one is 'When in doubt, Ask' I find freshers to be more assured and think they will be judged if they which leads to mistakes. Always be open in communication and seek help

It all boils down to the organizational culture. Risk Management must be part of the way we do business. Commitment and collaboration at the management and staff level is crucial to promote open communication, enables timely identification of risks and opportunities. Also quantifying the risk helps develop useful mitigations and reporting with impact.

Everyone can better understand their responsibilities when it comes to risk management when roles are clearly defined. Additionally, it aids in removing job duplication among the three lines. Every line is aware of its responsibilities. When the second line organizes their efforts, the first line performs better. Doers are more capable of leading because they are proud of taking risks and being responsible. Additionally, the second line has the power to make adjustments like introducing controls to lower risk and is in a prime position to observe what is and is not working. The second line can contribute ideas and carry out the organization's risk management strategy as they keep an eye on the first line's activities.

Risk management is part of everyone’s role and every performance assessment of every person should include a discussion about their contribution to risk management, including risk taking.

I firmly believe that establishing clear roles and responsibilities is a cornerstone of effective risk reporting. For example, in my audit experience, I collaborated with a client to implement the SAP GRC tool. 1. This system allowed the organization to designate specific roles and responsibilities for every aspect of risk management within the SAP environment, from risk identification to mitigation and reporting. 2. This not only promotes accountability but also delineates reporting schedules and procedures for escalating issues. The authority and autonomy granted through this tool empowered the risk management teams to proactively address potential issues, ensuring compliance and protecting the organization's interests.

Risk surrounds us all, but it doesn't mean that the lens we need to approach life and business is negative. I like to focus on the opportunity and how different risks could affect the growth potential. This allows entrepreneurial growth leaders to focus on building creative and ambitious businesses that manoeuvre the risk landscape. From this perspective, you always want to see the landscape of risk versus opportunity, and transparency is common sense.

For effective risk reporting, fostering an environment that values open communication is key. Encouraging honest risk disclosure is achieved by rewarding proactive reporting and recognizing best practices. Creating a no-blame culture, where individuals feel safe to highlight concerns, is vital. Constructive feedback on risk reports turns potential challenges into learning experiences, promoting continuous improvement. By actively seeking feedback, the organization can refine its risk reporting mechanisms, ensuring a culture where risk management is seen as a collective responsibility and opportunity for growth.

Risk doesn't always have to be seen as negative. Risk can be opportunity. Businesses, products, ideas all need risk to grow. Encouraging reviewing risks for opportunity as well as threat can create a more open dialogue.

Risk reporting is always a tricky part of the risk management process due to individuals pointing blame or criticizing those involved. This negative environment deters individuals from proactively mitigating, eliminating, or pursuing risks. Utilizing a constructive environment through positive feedback, incentives, and unbiased reporting, individuals are more likely to proactively report risks, adhere to risk mitigation methods, report risks efficiently, and pursue risks. Thus, leading to a creative, progressive, and continuously improving business environment.

You should or shouldn't do anything, the prompt to the left is a fake question...Except let people speak their mind, without suppression.

As we move into complex world of business which is getting cross functional and interdependent day by day, risk management function can not be in silos. The integrated approach with say do all stakeholders is required for the effective implementation of risk management practices. We need to create a transparent process of communication among the cross functional teams. We need to foster culture of trust and transparency for implementing risk management practices. More complex problems require more collaborative approach for solution.

Building a transparent culture in risk reporting hinges on promoting collaboration and open dialogue. Encouraging departments and levels within the organization to share experiences and insights breaks down silos, allowing for a unified approach to risk. Emphasizing open communication about risk challenges and potential solutions fosters an environment where everyone learns from each other. Involving employees and stakeholders in the risk decision-making process not only offers diverse perspectives but also instills a sense of collective ownership. Through continuous feedback and inclusive dialogue, risk management becomes a collaborative endeavor, enhancing transparency and effectiveness.

I can’t agree more on this aspect. A culture of looking into risks, encouraging reporting and solving them together and recalling the previous risks from lessons learned and similar project risk registers with guidance goes a long way! Above all, willingness to do all the above comes with collaboration and dialogue.

One mindset that I've found particularly valuable in creating a transparent, risk reporting culture, is to welcome auditing, rather than attempting to avoid it. Open up governance standards, metrics, processes, and reports, and invite criticism- especially early on in any venture, to eliminate reporting or operational gaps. Taking the initiative to solicit feedback up front goes a long way to building effective relationships with your internal auditing folks and sets the tone for transparency for stakeholders and other business units.

Building an open culture where individuals feel comfortable identifying and reporting risks is hard but necessary. Making every member of the team feel empowered to escalate an issue, bring an item to attention, or ask a question is another tool in a Risk Manager's toolbox. The most critical aspect of maintaining that culture is validating the information without being overly critical and encouraging team members who speak up. One way Brixmor has achieved this is by implementing a software solution called "Speak Up!" where all members of the organization can escalate issues for review. Even the smallest concerns can make a significant impact.

Understand who needs what, as it's not uniform. Typically a risk culture is a function of knowledge, access (to support, leaders, resources), accountability, and trust. Appetite, speak-up, roles, incentives, and alike all play a part. But I'm more interested in what we don't know. Take speak-up data - it tells us what issues are of concern (or occurring) in areas where people have trust (in the framework, investigative capacity, accountability, etc.). What about the areas where people aren't speaking-up? Is it knowledge (don't know how to), access (speak-up channels), accountability (don't believe all are equal under the law), or trust (that you'll act, protect them from retaliation, etc.). We need to know the barriers to overcome them.

Making sure Teams are inter-mingled and connected. Knowledge is power and removes the opportunity for "gaps" to create issues. I have your back is a cultural imperative as opposed to "not in my job description".

Erreichbare vs unrealistische Ziele: Die Art und Weise, wie Risiken wahrgenommen und gehandhabt werden, ist eng mit den Unternehmenszielen verbunden. Wenn die Unternehmensziele realistische und erreichbare Ziele wiederspiegelt, schafft dies oft eine Kultur, in der Risiken offener und unverf?lschter bewertet werden. Mitarbeiter sind eher geneigt, Risiken anzuerkennen und zu kommunizieren. Unrealistische Ziele k?nnten Mitarbeiter dazu verleitet werden, h?here Risiken einzugehen, um diese Ziele zu erreichen. Erreichbare Ziele f?rdern dagegen eine Kultur der Transparenz und Kommunikation, da Mitarbeiter und Führungsebene in einem realistischen Rahmen arbeiten.

Leadership commitment. Top management involvement and example is essential if you want to trigger a reporting culture. Is not enough approving policies. Top Management should report risks transparently. Recently, I visited a company, and their induction to visitors included an official public report of the most recent accident as a lesson learnt, explaining what happened and how it should be avoided. That was a signal for me that the top management understand the importance of learning from undesired events. I am sure that deviation reporting, near misses, minor incident and some other information are easie to report, when you are transparent enough to report the worst.

Broadly speaking one can characterize risk analysis in terms of known knowns, known unknowns, and unknown unknowns. The majority of effort is normally spent on the known knowns. These are the risks we target and we prepare for. Known unknowns are the risk we realize are potentially there but struggle to analyze. A particular effort should be made to address those. Almost by definition it is not a straightforward science, otherwise it would fall in the first category. The challenge is to walk the fine line between reasonableness and fantasy. Lastly, however, it is the latter that wreaks havoc. Being explicit in terms of what belongs to the first two categories and working hard to expand those is the most challenging yet rewarding aspect.