How to manage risk from the bottom up 

Tra­di­tion­al risk man­age­ment approach­es put man­agers and C‑suite exec­u­tives at the helm, charged with pre­dict­ing, iden­ti­fy­ing, avoid­ing and con­tain­ing cer­tain risks. But could a bot­tom-up mind­set pre­vent more issues from occur­ring in the first place?

More com­pa­nies are increas­ing­ly offer­ing all employ­ees a greater degree of train­ing and agency in risk man­age­ment. This approach has been adopt­ed by Prog­e­ny, an inde­pen­dent finan­cial plan­ning and asset man­age­ment com­pa­ny. Chief risk offi­cer (CRO) Char­lotte Willis believes risk man­age­ment and report­ing is everyone’s respon­si­bil­i­ty, a con­cept that can lead to the quick and effec­tive imple­men­ta­tion of actions and prob­lem-solv­ing.

“As staff have invest­ed time and ener­gy into help­ing shape strate­gies and action plans, their engage­ment and account­abil­i­ty is almost always assured from the out­set, com­pared with a top-down only approach,” Willis says. 

Each busi­ness area with­in Prog­e­ny has ini­tial respon­si­bil­i­ty for iden­ti­fy­ing and quan­ti­fy­ing risks using a risk man­age­ment frame­work. How­ev­er, sig­nif­i­cant work has been under­tak­en with team heads to help them under­stand how their deci­sions affect the whole com­pa­ny, as well as their own spe­cif­ic areas. 

Along with heads of depart­ments, they can esca­late new or emerg­ing risks to a risk and audit com­mit­tee, which itself works with the CRO, senior lead­er­ship team and exec­u­tive board to pri­ori­tise these risks.

When teams accept and agree respon­si­bil­i­ty it also means greater align­ment in pur­su­ing new strate­gies or busi­ness goals, Willis adds. How­ev­er, estab­lish­ing a con­sis­tent approach to risk man­age­ment is a chal­lenge, she admits. 

“Some depart­ments are nat­u­ral­ly more oppor­tunis­tic and entre­pre­neur­ial, where­as oth­ers are maybe more nat­u­ral­ly gov­erned and risk averse. This places greater impor­tance on the for­mal­is­ing of require­ments and respon­si­bil­i­ties for all staff,” she explains.  

Knowledge gains

It will always be up to indi­vid­ual CROs to decide if a bot­tom-up approach is suit­able for their com­pa­ny and indus­try. For Michael Brown, health and safe­ty con­tent man­ag­er at com­pli­ance firm Cita­tion, it brings a num­ber of advan­tages in health and safe­ty man­age­ment, giv­en employ­ers have a legal duty to con­sult with their employ­ees or rep­re­sen­ta­tives on health and safe­ty mat­ters. 

“Employ­ees them­selves can often offer solu­tions that are over­looked by man­age­ment by virtue of being more famil­iar with how work is actu­al­ly com­plet­ed,” he says. 

Such a path can also mit­i­gate risks when new process­es or equip­ment are imple­ment­ed in the work­place, ensur­ing any con­cerns are not ignored, accord­ing to Brown.

“Con­sul­ta­tion in these instances helps to iden­ti­fy poten­tial risks and haz­ards with a new process before it’s ful­ly up and run­ning, to save time, effort, mon­ey, and most impor­tant­ly, it may avoid pos­si­ble injuries from poten­tial mis­use of the equip­ment lat­er down the line,” he explains.

In finan­cial ser­vices, risks can be acute. Dr Luke Car­riv­ick is deputy exec­u­tive direc­tor at ORX, the world’s largest mem­ber organ­i­sa­tion for oper­a­tional risk pro­fes­sion­als in finan­cial ser­vices. He thinks a bot­tom-up approach is a “great way of mak­ing the actu­al risk tak­ers think more clear­ly about what they do”. 

How­ev­er, he points to a down­side: an over­ly nar­row focus on infor­ma­tion by indi­vid­u­als or teams can mean some broad­er risks could be missed. For exam­ple, ensur­ing the aggre­ga­tion of sim­i­lar risks, which in iso­la­tion might be imma­te­r­i­al, but in com­bi­na­tion could be impor­tant. 

A more con­tem­po­rary approach is now being used, akin to crowd­sourc­ing, Dr Car­riv­ick explains, with a diverse set of indi­vid­u­als polled on a par­tic­u­lar top­ic, with­in or even across insti­tu­tions. In cas­es where peo­ple don’t know what to mon­i­tor or look for, what he describes as “noisy infor­ma­tion from a range of sources” needs to be col­lat­ed when iden­ti­fy­ing new or emerg­ing risks. 

“Some banks are pilot­ing the crowd­sourced con­cept,” he explains. Indus­try stud­ies like the ORX Hori­zon are built on this prin­ci­ple, he notes, with the lat­est ver­sion iden­ti­fy­ing emerg­ing tech­nol­o­gy as the finan­cial ser­vices indus­try’s most con­cern­ing emerg­ing oper­a­tional risk.

Risk man­age­ment is also becom­ing increas­ing­ly dig­i­tal, with the dig­i­tal­i­sa­tion of finance occur­ring along­side the automa­tion of pre­vi­ous­ly man­u­al process­es. “By embed­ding risk man­age­ment into the busi­ness-as-usu­al process and by being increas­ing­ly reliant on met­rics that can be auto­mat­i­cal­ly cap­tured, this bot­tom up, data-dri­ven mon­i­tor­ing of activ­i­ty then begins to dri­ve your under­stand­ing of your risk pro­file,” Car­riv­ick adds.

Trust and creativity 

It’s crit­i­cal to recog­nise that employ­ees on the ground are clos­est to the oper­a­tion and have “a wealth of expe­ri­ence and knowl­edge on what caus­es dis­rup­tion”, believes Julie God­dard, a busi­ness con­ti­nu­ity con­sul­tant at Data­bar­racks, which pro­vides a range of IT dis­as­ter recov­ery and busi­ness con­ti­nu­ity ser­vices. “They also tend to come up with cre­ative and clever solu­tions, because they’re prob­a­bly doing it already to some extent as they nav­i­gate through their day job,” she says. 

God­dard also notes the impor­tance of devel­op­ing trust with­in the hier­ar­chy, so employ­ees know their views are val­ued, while man­age­ment must agree the thresh­olds with­in which they would be hap­py for staff to man­age risks them­selves. This could be based on their company’s risk appetite, and be a cost val­ue, the num­ber of cus­tomers affect­ed, or the extent of dis­rup­tion. Above the set lev­el, issues would then be esca­lat­ed. 

A bot­tom-up approach to risk man­age­ment should now under­pin busi­ness strat­e­gy and oppor­tu­ni­ty, Willis advis­es. “The more engaged every­one with­in the firm is with what all too often is a chal­leng­ing sub­ject, the bet­ter it is for every­one,” she says. “Risks can be reduced and oppor­tu­ni­ties can increase, both of which can have a real­ly pos­i­tive impact on busi­ness growth and a firm’s bot­tom line, while improv­ing cus­tomer out­comes and deliv­er­ing an out­stand­ing client ser­vice.” 

To achieve this, CROs could always fol­low a sim­ple piece of advice from God­dard. “If you are brave enough, put a sign on the mir­ror in the loos say­ing: ‘You are look­ing at the organisation’s risk con­sul­tant’.”