Risk owners should be forced to stand on their own two feet

The first joint conference held by the Risk Management Institution of Australasia (RMIA) and the Australasian Compliance Institute (ACI) on the Gold Coast provided the latest forum for risk professionals to debate in which direction they should be headed and how best to service their organisations. During the GRC Great Debate, Sandra Birkensleigh, Senior Partner at PwC and Non Executive Director for National Australia Bank Wealth/MLC Life, was forthright in her views as a director. Risk owners must take accountability for risk management and risk professionals must stop trying to fulfil that role. "It is not your job to do the business's job which is to run the organisation and achieve objectives," she told over 500 governance, risk and compliance (GRC) experts gathered at the Gold Coast Convention Centre. "What gets confused still a lot these days is whose job is whose...I think what often happens is the business aggregates to the GRC manager, let's call it that for the sake of the argument, and there is then confusion about accountability.hide"Predominantly the biggest difference that this group (GRC professionals) can make is to stop doing someone else's job. Stop. Stand there and say it is not my job, that is your job-I will give you some tools, I will help you understand, I will even hold your hand, but it is not my job. Until everyone from my level to the most junior person starts taking that responsibility we are not going anywhere," she added. Despite her assertion that risk professionals should take a step back from owning risk, Ms Birkensleigh stressed that understanding business is a prerequisite for all in the industry. "It doesn't matter how good you are at the specific risk tasks if you aren't business minded. You have to be able to ask questions and you have got to listen, listen, listen, listen and listen," she said. Fellow panel member and President of RMIA, Grant Whitehorn, said that setting and developing the right culture, rather than listening, is in fact the key ingredient for risk professionals. "To me it is not all about listening, it is all about culture. If I can influence the way people behave and create a culture whereby people behave with integrity I am half way there. But influencing is a pretty hard thing to do. Our focus shouldn't be on the creation of systems and the like, our focus should be on leadership and culture," said Mr Whitehorn, who is also Enterprise Risk Manager, Vodafone Hutchison Australia. This drew disagreement from Ms Birkensleigh. She argued that although setting the right culture is important it is the job of an organisation's leadership rather than risk professionals. "I get tired of hearing the phrase risk culture. Every organisation has a culture, the question is it is the one you want. If it is not the one the board wants or leadership wants they need to change it. They are the people that get watched. So it is about how do you as risk professionals support them to do that? The skills needed are negotiation and influencing skills bundled up in a person who is technically competent and somewhat sceptical. At the end of the day the best advisor that the board can ask for is someone who is going to be honest with them and walk alongside of them," she said. But Professor Justin O'Brien, Director, Centre for Law, Markets and Regulation at the University of New South Wales, agreed with Mr Whitehorn that the GRC personnel are the 'custodians of culture'. For his part David Lawrence, President of the ACI and Chief Operating Officer at the Asia Pacific Exchange agreed that the softer skills -the ability to influence, negotiate and communicate-are crucial for risk and compliance professionals. He backed up Ms Birkensleigh's view that listening is vital to achieve these goals. "I have seen some very capable people that are the worst listeners in the world and until they learn to listen they are not going to be able to influence anybody because they don't know how to communicate with the people they are talking with. You have to be able to communicate in the way the recipient wants to hear, not what they want to hear but how they want to hear it," said the ACI president. In a separate panel debate predominantly involving chief risk and compliance officers, leading industry lights were asked to name one essential element of a risk or compliance function. Monique Batterham, Head of Corporate Governance at Schroders Investment Management, was quick to flag up listening skills and the ability to adapt. She demands that her team spends time amongst the business away from their desk in order to meet these objectives. Karl Davey, Chief Risk Officer at Transpacific Industries, argued that keeping things simple is a priority. "A lot of people try to justify the existence of risk management by developing very complex process and changing terms, but really it just needs to be simple and relevant to an organisation," he said. For Rob Maurich, Chief Risk Officer at CBH Group, setting the right culture is one of the most important aspects for the risk function. "You can have all the processes in place but if the culture, which is typically set from on top, is not right you have a problem," he said. Authority is hugely important if risk and compliance functions are to succeed, fellow panellist Mike Ritchie, Partner, KPMG Financial Risk Management told delegates. "For a risk or compliance function to really have presence in an organisation is key. There will be times when they disagree with the business and need to communicate and try to influence, but at a certain point in time authority is required in cases where they disagree and need to bring about some change," he explained. A supportive executive team is needed for this to occur, he added. Keith Jackson, Chief Group Officer at Towergate UK, said that risk professionals must be curious and prepared to challenge the status quo. "One of the great enemies of risk and compliance frameworks is complacency. Therefore having a degree of curiosity and an open and fresh perspective, particularly if you are looking at forward-looking risks, and being able to challenge the perceived wisdom is critical," he said. According to the panel members it is possible at interview stage to determine potential employees that will likely have these sets of skills. "I ask ninety per cent behavioural questions and I really drill down," said Ms Batterham. "I always ask at the end how, in hindsight, would you have done that differently on tasks they tell me about. If they cannot think quickly and tell you something then you know they are not likely to be able to have that adaptation skill. I have interviewed people who to that question have said 'nothing it was perfect' and I immediately discount them." Mr Davey said that the underrated part of the recruitment process, and often forgotten, is the exploitation of networks to glean a better idea of what a prospective employee has achieved in previous roles. When looking for individuals with authority, Mr Ritchie said: "I look for people with strength of character, people with appropriate belief in their own capability and standing. People who are not going to be stubborn but who can stand their ground. Use references and networks and challenge people over their experiences and ask how they would apply themselves in certain situations." Mr Maurich advised risk professionals to note where potential employees have worked previously because some organisations may have a particular reputation that will give some idea of the interviewee's likely behaviour. "But nothing beats asking questions about how they would respond to particular situations," he added.

Risk owners should be forced to stand on their own two feet

Want to read this article?

Read Next

Markel names head of terrorism in London

Insurers defend Nord Stream’s €400m lawsuit as act of war

Generali splits insurance and asset management in restructure

AEGIS London recruits cyber underwriting team from AIG

German SMEs record rise in cyberattacks, reveals HDI poll

Markel names head of terrorism in London

Insurers defend Nord Stream’s €400m lawsuit as act of war

Generali splits insurance and asset management in restructure

AEGIS London recruits cyber underwriting team from AIG

German SMEs record rise in cyberattacks, reveals HDI poll

Want to read this article?

Read Next

Markel names head of terrorism in London

Insurers defend Nord Stream’s €400m lawsuit as act of war

Generali splits insurance and asset management in restructure

AEGIS London recruits cyber underwriting team from AIG

German SMEs record rise in cyberattacks, reveals HDI poll

Related Articles