How do you identify key drivers and dependencies of risks?

In my experience a key step to identify drivers and dependencies of risks is understanding the strategic goals and objectives of an entity or business. Where are you headed, what do you want to achieve? Understanding this can help the organization in the identification of the main roadblocks or risks that you may find along the way, hence also finding the control activities to mitigate them.

Drivers of risks, such as market conditions and external sources of investment beta, can include economic indicators, geopolitical events, interest rates, technological advancements, and regulatory changes. Dependencies may arise from factors like supply chain disruptions, global trade dynamics, and changes in investor sentiment. Understanding these drivers and dependencies helps in assessing and managing the potential impact of these risks on investments and portfolios

I notice that nobody has mentioned that risks exist because of processes, primarily. Identifying points of failure as well as holistically across the process is the main driver and reason for the existence of risk within an organisation

Risk registers and matrices structure this collective insight, translating it into organized, actionable formats. In line with the 3C Collaboration Model, effective risk management should seamlessly blend communication, coordination, and cooperation. As we navigate the intricate terrains of project and risk management, the emphasis should be on collaborative tools and techniques that foster a joint identity, ultimately driving towards shared goals and outcomes

I think the strategy that the business takes is a key starting point to assess drivers of risk. The strategy will speak to what markets the business plays in, who the stakeholders will be and therefore how the business can navigate these risks. The rapidly changing and complex environment we all live in, this includes technology and globolisation, forces businesses to become dependent on 3rd parties to deliver their strategy. This increases the risk universe exponentially. But being aware of these various drivers, is a god starting point.

While brainstorming and interviews undeniably offer rich insights, their efficacy hinges on the environment in which they're conducted. A space of trust and openness fosters candid sharing, revealing hidden drivers and dependencies that might go unnoticed in restrictive settings. I've witnessed the difference firsthand in East and Central Africa where cultural nuances play a significant role. For instance, local stakeholders may be reluctant to voice concerns due to hierarchical structures. To truly harness the potential of these methods, it's pivotal to create an environment conducive to unhindered dialogue.

These are great for quantifying, contextualising and identifying root cause and impacts around risks. Working in a vacuum and/or not being the subject matter expert can lead to getting these elements wrong and focussing resource in the wrong places to monitor risks.

Effective risk management through brainstorming and interviews hinges upon the expertise of educated professionals and the active engagement of participants. Together, they enable the identification of a broader spectrum of risks and the formulation of nuanced strategies for their mitigation. This collaborative approach not only enhances the quality of risk management but also fosters a culture of proactive anticipation and preparedness.

Brainstorming and interviews are indispensable in unearthing nuanced insights. While quantitative analyses provide structured data, it's through these qualitative methods that we truly grasp the intricacies of risk drivers and dependencies. Open-ended queries foster deeper understanding, uncovering facets often overlooked. Tools like SWOT or fishbone diagrams enhance this process, aiding in visualizing complex interrelations. These methods aren't mere information-gathering techniques; they're gateways to holistic risk comprehension.

Apart from Frequency and Impact of risks, it is also necessary to understand Velocity and Interconnectedness of various risks. Velocity indicates Time to Impact and Reaction Time. If Time to Impact is low, Reaction Time will be very short requiring speedy actions. Interconnected risks may either increase or mitigate risks and such interconnections need to be brought out and evaluated during brainstorming. These risks may form some clusters or trigger another set of risks through Contagion. Dynamic Risk Assessment should be able to indicate the change, impact and velocity.

I often use data analysis and modeling for regulatory compliance which involves leveraging data and statistical techniques to ensure adherence to regulatory requirements, to identify trends and patterns and detect threats and vulnerabilities. As a starting point, you should have a thorough understanding of the specific regulations and compliance standards that apply to your organization or industry. This will help you determine the data that needs to be analyzed and the modeling techniques that can be applied to ensure compliance.

It's so important to clearly define the problem and agree this with stakeholders before doing the analysis. So much time and resources can be lost going down "rabbit holes" and doing unnecessary analysis. Many times I've seen analysts and modellers start to answer the "wrong question" and they have needed a steer to get back on track to what is needed by the business.

Whenever there is a big decision at hand (large investment) or a lot of money at stake (insurance or vendor selection) or there is an expectation a risk will be quantified (CSRA, credit and market risks), neither quantitative risk registers or a quantitative bow tie will do the job. In these cases it may be required to built a tailor made model, specifically designed for that decision or risk. My team built and successfully used models for water pollution, investment projects, maintenance budgeting, different insurance lines, vendor accreditation, vendor selection and others. By calculating the loss exceedance curve for most insurance renewals and estimating fair cost of insurance saved our company millions, not figuratively, literally.

In my hands-on journey with risk management, data analysis and modeling have proven pivotal. These quantitative methods, when executed meticulously, offer a clarity often elusive in mere qualitative approaches. Sensitivity and scenario analyses aren't just tools; they're compasses directing us through variables and hypotheticals. Monte Carlo simulations, when harnessed aptly, bridge the gap between uncertainty and predictability. And with software like R or @Risk, precision isn't just hoped for—it's assured. Quantitative analysis is the keystone in the architecture of risk comprehension.

Setting consistent data standards, even drawing on something like BCBS 239 as a baseline, avoids duplication, inconsistency and creates standardisation and all the benefits that come with that. If good data standards are maintained, subsequent reporting, charting and thematics becomes easy.

There are two principles that are fundamental to risk management – it should pay to better manage risks and horses for courses. I use 3 different risk managements: basic, standardized and advanced. Let me emphasise this point – horses for courses. A risk register has a role to play but this role is very narrow in scope and it is useless for other important tasks, so something else must be used. It is impossible to create a risk register that solves tasks beyond what was intended for risk registers. For example, risk registers are not useful for risk mitigation or decision making. Don't do quantitative risk analysis, rely on risk registers instead and overpay for insurance as a result. Risk registers cost companies who use them.

Risk Registers and Matrices are useful tools but not to be relied upon alone. A good, consistent risk Dashboard can provide an excelllent overview of the whole risk remit. Once familiarity is built up with the dashboard pertinent issues for escalation can be easily accessed and discussed in the C-Suite and Board level.

Risk registers and matrices are more than mere tools for cataloging; they're essential instruments in proactive risk management. By systematically categorizing risks by impact, likelihood, or driver, they enable managers to make informed decisions. Their visual representation, whether tables or graphs, simplifies complex data, turning potential threats into actionable insights. The real innovation lies in iterative use, allowing for constant updates and adjustments to the ever-evolving risk environment. They serve as the compass, pointing the way to informed risk management decisions.

It's crucial to democratize risk identification. While policies provide a framework, they can't encompass the nuances of day-to-day operations. Take for instance, a company where policy dictates doors remain locked for security reasons. However, without involving ground-level employees in risk assessment, the company may remain oblivious to the fact that employees prop open these doors for smoke breaks, compromising security. By decentralizing risk assessment, we harness the collective intelligence of the organization, bridging the gap between policy and practice. Every individual, every department perceives risk differently; understanding these perspectives is paramount in crafting robust risk mitigation strategies.

Several tools and techniques can greatly facilitate the feedback and review process. Reports offer a structured format for summarising risk-related information and presenting it to stakeholders. Dashboards provide visual representations of key performance indicators, making it easier to identify trends and anomalies. Surveys enable organisations to collect targeted feedback from stakeholders on specific risk-related concerns. Audits offer a systematic and independent assessment of risk management practices, ensuring alignment with established standards and protocols.

During the risk monitoring phase, there are two triggers for a review of the system in place: 1. Following the occurrence of a major event that involves a significant change in the probability of occurrence, the impact of the risk and the possibility of detection. 2. Every three months given the VUCA economic context (volatile, uncertain, complex and ambiguous), it is “risky” to wait a long period to update and recheck the risk management system in place.

Drawing from my on-ground experience, feedback and review aren't just steps in the process; they're the heartbeat of astute risk management. Engaging stakeholders is not a mere formality but a necessity, as their insights can often illuminate unforeseen risk drivers. Monitoring project progress is tantamount to real-time risk calibration, ensuring swift response to any deviations. But the real mastery lies in the pivot: dynamically updating risks based on feedback, ensuring the strategy remains resilient and agile. Tools like dashboards and audits don't just capture data; they encapsulate the evolving narrative of risk, providing a clear roadmap for navigation. It's not just about identifying risks; it's about staying ahead of them.

Risk management is about constant learning, staying current and being willing to evolve and open to new ideas. If this ethos is not followed, risk management becomes almost value-less and boring.

Standardisation and Quantitative Assessment Following on from @James Dorrington’s comments on the need for consistency and benefits of standards and regulations such as BCBS239, it is important to come back to basics and realise a Risk by its very definition, is only the potential for a usual negative outcome, be it from an Asset, Process or external market influence. In today’s A.I. & ML world, Quantitative Mathematical and Statistical Analysis employed by our Actuarial models should in my view be consistently applied to properly manage a business objectives and potential impacts that aligns to both the FCA Consumer Duty and Operational Resilience, the focus is to standardise and define the key Factors or Drivers. Why is this not done?

Risk Management is not the job of Risk Management Department / Risk Manager alone. Concerned department/ function is always the first line of defense and it is important that all business/ function heads are aware about the changes in business environment and notice the dynamic movement of risks, which will affect their own performance and ultimately Organization's performance. This needs a conscious risk culture, regular interactions, respect for cross views, addition/ deletion of matrices in evaluation etc. so that risk awareness becomes DNA of the Organization.

An efficient and effective 'three line of defence' model is useful to identify key drivers and dependencies of risks, above and beyond this is developing a strong risk culture that enables rather than restricts opportunities. When the whole organisation understands risk management and buys into it's principles then you've cracked it as it will heavily influence the rewards side too! As Warren Buffett - the sage of Omaha - most well known aphorism goes.. "The first rule of an investment is don't lose [money]. And the second rule of an investment is don't forget the first rule. And that's all the rules there are." I like this because it really conveys how important Risk Management is to an organisation!

Is it no longer interesting to outsource the risk management function by entrusting it to experts given their in-depth expertise in a context full of risks?