GCC Sutra #1 - Integrated Risk Management Framework (Part 1)

GICs/GCCs/CoEs and are essentially distributed global teams for large organizations set up to take advantage of talent, technology & trends as part of their strategic growth imperatives.

Most organizations have been compelled historically to either improve their Risk Management practices to align with growth and constantly changing external/ internal risk factors or in the worst case forced to rethink their risk management strategy due to an underlying issue/escalation.?

The dynamics of a regional site/center away from headquarters mandated to have a risk management framework that is tightly coupled and aligned to global practices very soon face the challenge that the geographies they operate add an extra layer of complexity in terms of regulatory/statutory requirements, the local culture and people/work practices.?? My experience reflects that the regional framework needs to be much more robust and comprehensive considering the risk appetite away from headquarters is lower factoring in the brand image and obligations a remote site faces in today’s environment and quite complex local requirements. Practically speaking just replicating global practices will never work.

Having spent nearly 3 decades in setting – growing – maturing – and excelling global captives, the attempt through this series of articles is to bring some of the best practices tried and tested with impact in real-world scenarios for global centers of large organizations based in India. The study and practices however can be reviewed for applicability and implementation for any organizations located globally and are agnostic to the domain in which they operate.

First is to have a context on what are the organizational risk parameters we should be considering for an integrated approach to mitigate them. (Fig #1)

Secondly would like to focus in this article on stakeholder management and most importantly change management which is one of the most difficult parts of any organizational transformation and in majority of cases also the primary root cause for failures.

Successful large-scale risk transformation requires a combination of heart, art, and science to keep the momentum and deliver sustainable outcomes.

The biggest challenge in starting a risk transformation is often not the “why” or the “what,” but the “how.” Questions include how to set it up and conclude it, and then transition back to enhanced business as usual. Large-scale risk transformations often fail because change is not effectively implemented across the organization: milestones are ticked off without improving risk management, addressing underlying culture, or reducing risk. In this article, we consider different forms of risk transformations and unpack the heart, art, and science of their successful delivery and conclusion.

Key success factors for a large-scale transformation:

Purpose: Motivation is the bedrock for the success of any transformation. In the initial stages, you need a clear definition of what success looks like and why change is necessary. Ask what better post-transformation will be, and rally around that vision. Initially, the imperative to change helps rally the organization but this initial thrust dissipates over time.? It is important to have deliberate interventions, including a strong tone from the top that reinforces the importance of what is being transformed and why.

Process:? Second, have a detailed and dynamic plan. It is critical to have a detailed plan that sets out what needs to be done and by when. Then, that plan needs to be adjusted as you and your team move through it, embracing learning and adapting. A plan review cycle can help achieve this. A documented operating rhythm clearly gets things in motion and allows for much need transparency on what and when progress reviews need to be planned and conducted establishing clear accountability across the organization. One great learning is to initially have a more aggressive review cadence and as things start making progress it is important to review the frequency and no of stakeholders required for these periodic reviews.

Pride: Third, ensure accountabilities are clear. A plan is no use unless it drives outcomes. To enable this, mechanisms need to be put in place so that people understand what they need to get done and by when. Careful architecting of accountabilities, coupled with pragmatic governance, will sharpen accountabilities by shining a light on both progress and where help or escalation is needed. In my experience, this works best when you also foster a mindset of learning from failures and escalating concerns early.

Generally, for any organizational transformation which impacts are larger section of people, process, and technology there will be a range of challenges to overcome, and these will differ depending on the context the organization is confronting.

Two common challenges are getting the change to permeate throughout the organization and ensuring changes are sustainable.

One key blocker to getting changes to permeate is change fatigue, especially in the middle of the organization where change is crucial. Strong change management and communications to support leaders at all levels is important, as is helping leaders build their own skills to drive the change. Playing back the incremental wins as they happen along the way can also help to inject energy and maintain a sense of progress. Ultimately a transformation program isn’t successful unless the changes are sustainable after the program finishes. Establishing an enduring capability beyond the formal program that can monitor, continuously improve, and sustain the outcomes delivered is often overlooked but is critically important.

After supporting numerous businesses through transformations, have found that while the science of transformations is crucial to get right, it is the heart and the art that deliver transformation programs to their successful conclusion and sustainably embed the change across the organization (Fig #2).?

Science speaks to the mechanics that need to be in place around program structure, integrated plan development, delivery mechanisms, and regulator engagement throughout the process.

Art refers to capabilities, accountability, prioritization, and use of targeted interventions to keep the program on track.

Heart includes genuine shared motivation or purpose, a transformation mindset, a willingness to challenge cultural norms, and a program of communication that connects with the professional identity of employees.

With science and art, the key conditions are in place for a successful risk program. But heart is a prerequisite for deep cultural change, which is required for a sustainable enterprise-wide transformation.

Getting to the ‘heart’ While we live in a rationality-driven work environment, human actions and behaviors are driven by deeper mindsets and cultural traits. Driving a transformation that changes those mindsets and cultural traits is hard; it needs to go below the surface and work with what motivates the organization and its individuals.

Motivation: “Because the regulator wants it” is not an intrinsic motivation—one needs to dig deeper and consider the motivations of employees. Successful transformation in any circumstance will require as much of a change in mindset as in any system or process. An in-depth diagnostic of the psychology of the organization can help define a vision of change that connects to the collective motivation and purpose of the organization and ensures that the desired change will stick in the long term. “Serving our customers better” is an example of a collective motivation.

Transformation mindset: The mindset of the transformation needs to balance delivery discipline and accountability; agility and pragmatism; continuous improvement; and a sense of chronic unease.

This finely balanced mindset will enable organizations to do what they say while still being able to course-correct and improve when new information becomes available and to quickly spot and address emerging challenges.

If a risk transformation is initiated in response to a major incident, an honest appraisal of what drove the failures and adequate humbleness when considering risk transformations.

Culture: Organizations have a variety of cultural traits that help them thrive in transformation but also some that hold them back. Traits that often lead to unsuccessful or stalled transformations include being too siloed or too collaborative. This can lead to change being implemented inconsistently or stopped by a few business areas, or over-collaboration that results in a lack of productivity and missed deadlines. Continuous reflection is required to be aware of and address deeply rooted cultural challenges, including honest appraisal of successes and failures, celebration of positive cultural behaviors, and constructive challenging of cultural norms, all while maintaining psychological safety.

Communication: ?Motivation must reach the hearts and minds of employees. An intensive and continuous dialogue with a broad set of stakeholders allows a transformation program to keep its finger on the pulse while also enabling staff to own challenges and drive solutions. Communication needs to build on the organization and its leadership’s personal motivation—this is what makes it genuine and effective. Appreciating the ‘art’ More basic than the heart but still more fundamental than the science of transformation is the art. The art supports the smooth and effective delivery of a program that leads to sustainable change–versus merely delivering a set of activities and milestones.

Capability: The skills required to transform are often not those required to manage. A risk transformation program team must have capabilities across project execution, strategy, and risk management. The team should adopt both an inward- and outward-looking mindset that leverages the experiences of others (for example, learning visits at global peers and regular exchange with local peers). Key roles in the business and the risk function may require new talent to bring fresh impetus to transform or deviate from ingrained practices.

Accountability: Large-scale risk transformations require collective accountability: the whole executive team must stack hands to deliver the target outcome. The complexity and duration of these programs make them hard to execute; they are often costly and feel more like a burden than an opportunity. Balancing the accountabilities of individuals versus the whole organization, and linking program outcomes to remuneration, are both critical. Strong top-down authority from the board and CEO is essential in supporting prioritization, providing advice, and clearing roadblocks.

Prioritization: One of the biggest challenges is managing competing priorities and ensuring that the organization can absorb the amount of change required. This requires clear articulation of short- and long-term milestones to prioritize and sequence change at regular intervals.

Intervention mechanisms: This means to anticipate hurdles and support course correction must be created. Formal mechanisms to identify expected challenges in the form of regular premortem exercises and formal program reviews are essential. The central decision-making body needs the authority to rapidly course correct through reprioritizing or redeploying resources. This is also critical to Risk transformations: The heart, the art, and the science address change fatigue, which will naturally occur over the course of a long-drawn program.

Program structure: Organizations often consider risk transformation as the accountability of the risk function. However, this setup may just scratch the surface and fail to address root causes and systemic issues. Effective large-scale risk transformation requires accountability for the program to be assigned across functional leadership and business areas, where many of the inadequacies in systems, processes, and behaviors originate. Coordination between these stakeholders is essential and often driven by a neutral, central program team that sits outside of lines one and two. The rationale is that the engagement between these lines is often part of the problem. The central team intervenes and escalates when the program is off track, with support from a communications team and change infrastructure. While the central team is accountable for coordination, it is important that the accountability for framework design and implementation delivery remains with the business-as-usual owners.

Integrated plan: Integration of roles, responsibilities, and deliverables within the overall program is challenging. Creating an integrated view of change by using an integrated plan allows for prioritization, sequencing, and interdependency management. It also allows for a clear lineage between relevant problem statements, target states, activities, milestones, and outcomes. Structuring the plan into design, implementation, and embedment is helpful to coordinate delivery and distinguish the shift from the design of framework elements in functional areas to their implementation in business areas. The embedment stage includes ensuring new practices become part of the organization’s DNA and smoothly transitioning back to enhanced business as usual.

Delivery mechanism: ?Implementation of complex change across the business (line one) is often where risk transformations fail. The best-designed set of change initiatives can fail without an effective delivery mechanism that supports implementation and sustainable embedment of change. Developing a mechanism to ensure appropriate engagement between lines two and one in the design of change initiatives—and a well-coordinated and considered delivery mechanism for supporting line one implementation—is critical. Ideally, this mechanism is aligned with natural business rhythms such as quarterly delivery and performance cycles.

Regulatory engagement: Transparency and continuous dialogue with regulators are important. Proactive, professional, and respectful engagement can enable greater understanding and appreciation for regulators with respect to the challenges faced in large-scale risk transformations and can encourage offers for guidance and positive reinforcement. It is crucial to understand the regulator’s priorities and motivation—they are large institutions with public profiles, reputations, and individual ambitions. The end is often only the beginning the above three elements (heart, art, and science) demonstrate, successfully concluding a risk transformation.

The heart, the art, and the science of transformation seldom end with just milestones in a work plan, ending a monitorship, or meeting regulatory commitments. These are important, but genuinely transformative success lies in the smooth shift from programmatic setup to sustainably uplifted business-as-usual operations with embedded mechanisms for further improvement. The uplifted capabilities need to be fully embedded into the regular business and risk cycles owned by their business-as-usual owners. They need to be regularly reviewed for fit-for-purpose and scope for further improvement. These regular cycles can include annual strategic planning, risk appetite refresh, policy reviews, assurance, audit schedules, quarterly change prioritization, and performance tracking as well as trigger-based uplifts driven by new business, new products, new regulations, and incidents. The relatively short time frame of a risk transformation allows for the improvement of frameworks, processes, and governance, but it takes time and often a few improvement cycles for the organization to fully embrace and internalize them. Finally, the learnings of the transformation should be captured and shared because the external environment is constantly evolving, and often another risk transformation looms around the corner.

End of Part -1

Next Steps: I am available for mentoring/consulting/independent director engagements and you can reach me on [email protected]

Next Edition for GCC Sutra:? Integrated Risk Management Framework