You’re in charge of risk management. How do you know if your strategies are working?

Create a risk Model, derive Key Risk Indicators from the Model, Monitor deviations. As soon as your Model stops having predictive value, reassess the situation.

The lack of KPIs/KRIs is like driving without any road signs. It can be from disorientating to lethal. Likewise, if Risk Management wants to play its role as advisor to the management of the company, then setting the appropriate indicators, monitoring them regularly and adapting to them is a necessity for the growth and survival of any organisation.

Choosing what yo improve and thus what to measure depends on where you are in your risk management journey. The first thing I would suggest it to take a baseline of your process safety performance. Then identify the areas which need the most improvement. Build your plan around this and choose both leading and lagging indicators for process safety management. Don't forget to keep an eye on areas which are currently performing well as their performance may drop if you no longer measure it. Making personnel accountable for the metrics can also help implantation. After a set period repeat your process safety performance in all areas and adjust your plan and performance indicators accordingly.

Lo que no se mide no se puede gestionar por eso es relevante saber que pasa con aquellos riesgos más relevantes del negocio. Las métricas o indicadores de riesgos deben ser elegidos cuidadosamente de modo que cumplan una serie de de características, incluso pueden ser definidos como los principios que regirán la construcción de indicadores clave: - Relevante - Simple - Oportuno - Costo efectivo - Orientado a objetivos - Integrado a la gestión Una cosa relevante es no "ahogarse" con muchos indicadores pues suele ocurrir y en gestión de riesgos, especialmente no financieros, "menos es más".

Des KPI / KRI peuvent être mis en place pour juger de la pertinent de la stratégie risque. Exemples : Taux de couverture des processus business par une cartographie des risques, Nombre de recommandations prises en compte dans le Plan d'action annuel relatif aux projets...

In my experience, some of the ways to track and analyze the data are: 1. Real-time dashboard: In IT projects, a JIRA dashboard helps in tracking the progress in real-time allowing stakeholders monitor the risk levels and changes in the indicator values in real time. 2. Early warning triggers: We may configure certain early warning triggers for stakeholders, like send an alert if the budget threshold is beyond 80%. This will help take necessary action before the actual risk. 3. Do the RCA: Conducting the root cause analysis will help identifying the drivers of the risk and target mitigation strategies.

Combination of loss prevention and mitigation to achieve… 1. Lower incidence rates. 2. Fewer large losses - lower average cost per claim balanced by #1. 3. Lower litigation rate - effect on #2. 4. Shorter claim durations and higher closure rates. 5. Lower loss ratio. 6. Lower required reserves.

Applying following steps consistently can gain valuable insights into the effectiveness of risk management strategies. 1. Define specific KPIs that align with the objectives of RM. 2. Establish baseline measurements for each selected KPI. 3. Set up systems and processes to collect relevant data on an ongoing basis. 4. Utilize real-time monitoring tools and dashboards to track key metrics. 5. Analyze incidents and near misses. 6. Benchmark performance against industry standards and best practices. 7. Incorporate predictive analytics to anticipate potential risks based on historical data and current trends. 8. Conduct scenario analysis based on different risk scenarios.

Data analytics in risk management involves collecting, structuring, and analyzing vast amounts of data to identify, assess, predict, manage, and prevent risks within an organization.Also utilizes diverse data sources, such as historical records, external data sets, and real-time information to uncover correlations, patterns, and trends that may signify potential risks. This provides decision-makers with timely insights and enables them to proactively address risks and implement effective measures to mitigate or avoid harm to their business processes and infrastructure.

Firstly the best approach would be to conduct regular reviews to analyze the performance of the risk management processes and identify any gaps or areas for improvement Secondly there will be need to compare results with the stated objectives

If ERM is in line with the business strategies of the company, you will see that there are risk responses which are announced in them. Because as I always emphasise, ERM feeds strategies and strategies feed ERM. It is constructive and enhanced loop.

Like many things in risk, context is key, when and where you use benchmarking is almost as important as the benchmark. It’s a very efficient method for creating relative certainty. If you’re focused on regulatory risk this can help you understand where you are versus your peers. It can only provide “averages” and so don’t expect to be precise. Consequently, it’s more about the discussions it will provoke and the subsequent focus that really matters rather than the precisely inaccurate analysis.

Choosing a risk manager or consultant with industry expertise and the data surrounding your peers is key when it comes to benchmarking. Can you benchmark against yourself? Sure. But the goal isn't to be average, but to highlight your successes and failures among the entire industry to truly measure if you are in line with where you should be. How did your peers get to where they are, good and bad, the results will tell you and guide you to the right risk management plan.

The link between risk and strategy within its continuous cycle should be established. Performance results of this cycle should yield; 1- Effectiveness in identifying risk/opportunities 2- Effectiveness in managing risk in line with strategies 3- Does the company's risks and strategies support how the company positions itself within its current market and/or industry

Benchmarking is always a powerful tool, which can provide useful insights for the market, peers and competitors. Under my point of view though back testing your own results is even greater a tool, since it allows you to reflect on your strategy and practices and derive most valuable conclusions.

From my perspective and client practice, first, it's necessary to have a feedback loop. Thus, are you soliciting and inviting feedback, formally and/or informally, on your risk management training, campaigns and initiatives? All too often there is not a 'safe space' to have open and honest feedback. The other element I would focus on is to pressure test based on your feedback. Even if teams have been through formal risk training, based on feedback, are you 'pressure testing' potential 'hot-spots' or gaps, perhaps with in-person follow-up sessions or ethical dilemma workshops, to ensure that the training has not only been completed but understood and embraced as a part of ethical and sustainable decisions and decision-making.

When it comes to feedback in risk management, establishing feedback loops allows stakeholders at all levels to provide input on the effectiveness of RM strategies for example annual evaluation of Risk Management Committee as to how the RM function facilitate the achievement of objectives and effectiveness of RM. Further, feedback from Department Heads through surveys, suggestion boxes, and regular forums will help to capture diverse perspectives. Learning aspect includes implementing training programs and workshops to enhance risk awareness and knowledge across different departments. It will facilitate effective mitigation strategies. Benchmark the RM with industry peers to learn and adopt best practices such as ISO 31000:2018.

In my experience actively seeking input from stakeholders on our work helps us refine our strategies. It's important to create an open atmosphere where people feel comfortable sharing their thoughts. Testing strategies based on feedback, like discussing ethical scenarios, ensure everyone understands and applies them. Learning and adapting is an ongoing process involving training and comparing to best practices. Using feedback helps us be more prepared for risks and anticipate potential issues.

Risk Management is not about solving all the problems or eliminating all the risks. Instead, it is about proactively planning so that when things happen, the company has an appropriate roadmap for the needed steps to move forward.

Learning and adapting from feedback is a continuous cycle that ensures the refinement of strategies over time. Constructive feedback serves as a catalyst for improvement and innovation, contributing to the evolution of risk management practices.

In my experience, strategies work if you notice their approach being acknowledged and adopted much before the results are seen, that’s your first sign that it’s working ! Next comes focusing on those quick wins of setting the process and identifying the risk owners and actioners with validations from them on the mitigation strategies. Your team becomes your advocate and not you. Unless and until you don’t put in the work of applying risk management at the onset of the project / program ( seldom this happens the status at the onset is always GREEN ?and risk management comes into play when things go RED ??)

Monitor the frequency and severity of actual risk events that occur. A decrease in the number and impact of incidents suggests your strategies are working. Track and analyse "near misses" where potential risks were identified and mitigated before they caused any harm. This indicates your proactive approach is effective.

Combining your indicators with benchmarks and stakeholder sentiment is crucial for uncovering blindspots in your risk management methodology and program. Often times the tactical and operational risk practitioner may overlook "corner case" situations that are highly risky to your specific business and strategic objectives by department / varying persona roles. This alignment helps to fine tune your model for more consistent, repeatable, and easily actionable risk insights.

In my role overseeing risk management, I gauge the effectiveness of our strategies through a seamless blend of quantitative metrics, qualitative feedback, and strategic alignment. Monitoring incident resolution rates, frequency, and severity of risk events provides tangible indicators of our ability to identify and mitigate risks promptly. Regular stakeholder feedback offers valuable insights into the perceived effectiveness of our efforts, while analyzing the alignment of our strategies with organizational goals and industry best practices ensures relevance and adaptability. This holistic approach enables us to continually refine and enhance our risk management practices, ensuring they remain robust and responsive to evolving challenges.

The geo-political changes and the impact has to be baked in real-time into the measurements. E.g the Russia Ukraine war & our largest learnings from Covid19 situation.