Thinking about Risk - Time to Change

As a small boy my Gran told me “Never to confuse worrying with thinking”. Genius advice for life. She didn’t think that worrying was necessarily bad, but a bit like her favorite tipple, which is almost an anagram of Genius, she felt that worrying should only be done in moderation.

Worrying is a perfectly natural thing to do and probably healthy to do for a little bit. Yet it’s thinking that helps us to make the best choices.

Whatever role we are in, the number of things that we have to get our heads around relating to risk at the moment can seem overwhelming and discombobulating. Where to focus and prioritise? Which risks are the ones that are most likely to affect us? How to plan for them? How to figure out what’s controllable and what’s not and to deal with both? How to keep things in proportion? How best to think about the combination of risks and how they interact? How to communicate effectively about risk and get the balance right in recognising risk, being clear how we ?will deal with it and what we need from others?

Doing all of that effectively is challenging. Especially when we feel deeply responsible for the livelihoods and well-being of others and when these risks can have potentially significant personal as well as organizational impact.

If we are not careful,? sometimes individual worries can aggregate and compound and, before we know it, we can end up with what Harvard Health describe in their excellent ?When to Worry about Worrying article? as Generalized Anxiety Disorder (GAD). They identify symptoms of GAD including:

• Persistent, excessive worry about several different things for at least six months
• Fatigue, difficulty sleeping, or restlessness
• Trouble concentrating
• Irritability
• Muscle tension
• Feeling tense or "on edge"

Having the self and collective awareness to recognise these symptoms when we are experiencing a little “GADiness” and then using that knowledge to trigger thinking can be very helpful. It seems logical that if we don’t, then GAD may also make us vulnerable to some common traps when thinking about risk. These might include:

• “It’ll be alright on the night” or “Heads in the sand” syndrome. We find the situation so overwhelming that we just hope that it will go away. In practice through ignoring things and effectively abdicating responsibility we place our organisatiosn and ourselves at even greater risk. ?
• Slaves to Process. Believing that a good process is enough protection against risk. If reinforced with a spoon of siege mentality induced Groupthink, then the result is often a collective judgement by-pass. Professor Eugene Sadler-Smith’s fascinating book “Trust Your Gut” talks about the importance of building intuitive muscle power as a possible antidote to this.
• Not getting the data and information that we need to inform making the best choices. Or being Data Drunk, ?where we’re at the end of? what feels like a data fire hose and find it hard to see the most important things and what they mean. ?
• Planning for events rather than consequences. Many risk matrices are event based when so often the risk is not really about the event but the consequence of an event.? E.g. What happens if there is no internet for a prolonged period. ?
• Not enough focus on Risk in the work of our Audit, or Audit and Risk Committees. This can be through not having the right composition, terms of reference or direction from the board.
• Confusion between the Controllable and Uncontrollable. Controllable being where we can both influence the probability of the risk arising and mitigate its effect when it does. Uncontrollable being where we can’t do the former but can possibly do the latter. ?
• Focussing on an overall risk appetite rather than considering appetites for specific categories of risk. For example, if you’re going to take significant market risk then doing so with low levels of financial, capacity and capability risk. ?
• Unhealthy risk aversion. Being too rooted to prevailing assumptions and too susceptible to anchoring or status quo bias. This can lead us to analysis paralysis and over emphasising risk and under-emphasising upside.
• Being dominated by one major risk. Because of what we perceive to be one or a few major risks we ignore a group of other more moderate risks. They seem inconsequential compared to the big ones. However, in combination they have the potential to significantly impair our ability to deal with those major risks.
• Not using the best approaches to help us make the right choices. In SAP Concur's CFO Guide to Building a Future Focused Finance Team there is an emphasis on the need for finance functions not just to be lean but also to be agile. As an indicator of the opportunity for this, they quote from Digital.ai ‘s 17th State of Agile Report. “Whereas 69% of IT teams use agile approaches only 13% of Finance teams do”. Gary Goodenough, SAP Concur’s Regional Sales Director points to examples of in an SAP Concur report Emerging Trends in Expense Management and Audit Controls ”adopting innovative audit practices, such as those leveraging AI to filter out low risk items can significantly enhance both efficiency and compliance. ?
• Failing to strengthen our core. Not doing what’s going to help the most in most circumstances such as building capabilities, relationships, financial strength and general resilience.
• Not ensuring that we really understand the most important “Dynamics” and how they are shifting. For example ?market, organisational, financial and ?stakeholder dynamics and, most prominently recently, the geopolitical dynamics that are relevant to us.
• Learning from others. Not capitalising on the wisdom of others, especially those who have encountered the risk situations we are most concerned about, and finally;
• Too much Testosterone: In Robert Sapolsky’s brilliant book “Behave” he notes that ?although the influence of testosterone is context dependent “Testosterone increases confidence and optimism, while decreasing fear and anxiety. It boosts impulsivity and risk taking, making people do the easier thing when it’s the dumb ass thing to do. “ ?This suggests age and gender diversity on our boards might be helpful in achieving a balanced approach to risk.?

In its 2024 update to the Corporate Governance Code the UK Financial Reporting Council said that “A board should establish an audit committee” and that “part of its role and responsibilities is reviewing the company’s risk management and internal control framework, unless expressly addressed by a separate board risk committee. “

The Spencer Stuart 2204 Board Index noted that 35 of the constituents of the FTSE100 companies ?now have combined a combined audit and risk committee. Most of the others have “Overseeing risk management” as part of their terms of reference of their Audit Committee and some include relevant categories of risk oversight in their other committees such as Nominations, Remuneration or Sustainability.

After having been an enthusiast for the combined Audit and Risk committee for many years, so that Risk has equal prominence and consideration in the committee’s work, I am now shifting? that view. It feels that for many organisations, especially larger and more complex ones, that a separate overarching and beefed up risk committee may be the right way to go.

Why? First, to help the board to have an overall rather than compartmentalised view of risk. Also because experience suggests that when embedded within an Audit or an Audit and Risk committee, risk still doesn’t get the right balance of time and attention. Those committees also tend, for perfectly understandable reasons, to be populated by financial people of a similar age ?and as a consequence tend not to focus as much as may be necessary on non-financial risks. ?Of course many might argue that all risk ends up being financial risk but I think that misses the point.

Gary Goodenough reinforces this “ In today’s complex business environment, where risks range from data overload to an over-reliance on rigid processes, the call to separate risk management from traditional audit functions is particularly resonant“.

At the very least it is time for all of us, whether we are on a board or not, to have a think about “How we do risk”. There’s some very useful advice in the Risk Coalition’s latest free guide: Raising Your Game which comes at the topic from the healthy perspective of seeing and thinking about risk as a strategic enabler rather than simply downside management. ??

Finally, if you ever need a reminder to stop worrying and start thinking, hum Bobby McFerrin ‘s 1988 hit and legendary earworm tune “Don’t Worry, Be Happy” ?because “In every life we have some trouble, But when you worry you make it double”. Something the construction workers of the RCA building in New York having lunch in the legendary 1932 photo above maybe pushed to the limit!

Patrick Dunne OBE

Experienced Chair, author of the award-winning book Boards and co-author of Five Generations at Work: How We Win Together, For Good

This article has been sponsored by ?SAP Concur industry-leading technology that automates travel, expense and invoice spend processes.

The fee will be donated to ESSA-Education Sub Saharan Africa, a charity which is using evidence to transform educational outcomes through systemic change and to make educational systems more resilient.

?