EXECUTIVE SUMMARY

Increasingly oversight groups like Imagine Canada, donors, government funders, and Boards of Directors are telling charities that they need to be able to demonstrate that they are effectively managing risks. This is often viewed as a compliance exercise and results in creating a “RISK REGISTER” and presenting a “RISK HEAT MAP” to the Board.

The generally accepted definition of the word “RISK” is the “effect of uncertainty on objectives.”

Risk registers may give the impression risks are being effectively managed, however without any reference to objectives, there is no way of knowing if the charity’s primary PURPOSE and objectives will be achieved with a level of risk acceptable to the Board.

This is a case study of one charity, DeafBlind Ontario Services, who have recently implemented the newest generation of risk management – Objective Centric Risk and Certainty Management (#ORCM). An approach focused on managing the likelihood key objectives will be achieved, not managing a list of risks divorced from top objectives and performance.

Since the 2008 Global Financial Crisis an increasing number of private sector organizations have been forced by regulators and sometimes their boards to demonstrate they are managing risks. The most common response is to create an Enterprise Risk Management (ERM) function, who create and maintain a “RISK REGISTER,” a list of what are usually termed “top risks” to the organization.

The generally accepted definition of the word “RISK” is the “effect of uncertainty on objectives.” Evidence is increasing each year that using risk lists as the foundation for risk management fails to meet this definition. Risk management is effective when leadership teams and boards have information on the risks and certainty key objectives will be achieved with an acceptable level of risk. This information will lead to better decisions on how best to allocate scarce resources.

For charities that want to move forward with effective risk management practices; practices that strengthen decisions and the use of limited resources, and increase stakeholder confidence in the charity’s governance framework, an objective centric approach is required.

Having implemented Objective Centric Risk and Certainty Management in a variety of organizations over the last decade I have seen firsthand its effectiveness. It is best equipped to deliver on the real promise of formal, structured risk management – increased certainty objectives will be achieved while operating with an acceptable level of residual risk. It is aligned with current practice guidance issued by ISO, COSO, and the Institute of Internal Auditors, and is designed to replace traditional risk list ERM and legacy spot-in-time internal audit assessment methods. It is scalable to any size organization, integrates with strategy and top objectives of the organization, and supports management and board decisions. It consistently delivers reliable information on risks that result in better decisions and increase the chances of achieving the entity’s most important objectives.

An overview of the core steps to implement ORCM is below, together with CertaintyStatusline, an objective centric assessment methodology developed by Risk Oversight Solutions (ROS) in Oakville, Ontario. The ROS framework is free and available for download at https://riskoversightsolutions.com/resources/.

The DeafBlind Ontario Services Case Study

DeafBlind Ontario Services, incorporated in 1989, provides an array of services to people who are Deaf, hard of hearing, non-verbal, and deafblind. Their reach extends into remote communities and urban centres across Ontario with supported living homes and customized community services, training and supports to other agencies.

As a provincially funded charity, DeafBlind Ontario Services is accountable to its funder and stakeholders. It continually strives to make the best use of limited funds and focuses maximum possible resources on service delivery. DeafBlind Ontario Services was seeking to improve its decision making and was searching for a risk management approach that would make good sense for them and was affordable. This meant any approach selected needed to produce benefits quickly.

The ORCM approach is a good fit for DeafBlind Ontario Services and its culture. The implementation approach focused on training the management team and applying their new skills to identify and manage risks that could affect achievement of key objectives as quickly as possible. The approach also zeroed in on those elements of the methodology that would establish a solid foundation and start to show results quickly.

The following discusses factors that contributed to ORCM success at DeafBlind Ontario Services as well as challenges encountered.

Success Factors

Three factors were instrumental to success: the DeafBlind Ontario Services Culture, early Integration of risk and strategy, and the implementation approach.

DeafBlind Ontario Services Culture

The ORCM approach is not a good fit for all organizations. It is best suited to a culture that is willing to define clear outcome-based objectives, entertain differing opinions, foster candidness, and embrace critical thinking. It works well in an environment where accountability for making decisions rests with individuals who are in the best position to do so. It encourages individuals to analyze risks that could affect the certainty of achieving objectives, critically assess action, and seek opportunities for improvement. Cultures that promote learning and increase management’s knowledge of objectives and risks and encourage candid discussion of tough issues will do well with an ORCM approach.

A key factor in the success of ORCM at DeafBlind Ontario Services was its alignment with the existing culture. The Finance & Risk Committee established to implement and maintain the ORCM approach built on the strengths already embedded in the Executive Management Team. Members represented diverse functions and established a collaborative working style. Respect and attentive listening to all members were demonstrated throughout the implementation and critical thinking and differing opinions were encouraged.

To ensure decisions rested with the individuals with the necessary authority, accountability for achieving an objective moved from a team-based approach to a designated individual. A shared understanding of the responsibilities of the objective owner and the ability to draw on the broader expertise of the management team was developed.

Training on ORCM was provided and quickly applied to current top strategic objectives. Selected individuals were identified for further training to deepen the organizational knowledge of risk management and develop a center of expertise and resource for all objective “OWNER/SPONSORS” and the management team.

Although ORCM does not need to be implemented in a perfectly aligned culture, it is helpful to understand the culture and what factors might work for, or against, ORCM before moving forward.

Integration of Risk and Strategy

The intent of risk management is to help management make better decisions. It is about understanding what may support or hinder the achievement of your most important goals. With an improved understanding of threats and opportunities, it becomes clear what action, if any, is needed to increase the likelihood of success.

ORCM easily integrates with strategy. As the most important goals of an entity are ideally stated in the strategic plan, it only makes sense to integrate risk management with the development and execution of strategy. This made practical sense for DeafBlind Ontario Services as a charity striving to be as efficient as possible and maximize its use of resources in service delivery. Reports to the Board of Directors on strategic objectives were revised to include relevant risk information and eliminated the need for separate monitoring and reporting. Integrated reports supported the Board in their oversight responsibilities and allowed users to quickly identify the biggest threats to achieving objectives. This step made reporting on strategic progress more meaningful.

Approach to ORCM Implementation

The ORCM approach is a systematic, comprehensive approach to risk governance that usually takes about three years to fully mature. Despite the time required to fully implement, immediate benefits are realized by formalizing the daily practice of managing risks that staff already perform. For example, responsibilities are confirmed, and a systematic approach to assessing risks and their impact to priority objectives is determined.

Like many organizations, DeafBlind Ontario Services strives to make the best use of limited resources. It was important that the benefits of implementing ORCM quickly became evident and early wins were achieved. Two features were built into the implementation approach to allow us to realize early success.

1. Start with a manageable amount of familiar information

It was important to implement ORCM in “bite size” pieces to easily assimilate the information. To be successful, we wanted to focus our efforts and generate quality information over quantity. We carefully selected and applied ORCM on five top objectives. Starting with the strategic plan objectives made good sense as it allowed risk management concepts and application to be anchored to content familiar to the newly established Finance & Risk committee.

2. Training and facilitation

Training in ORCM is essential to its success. Orientation training was provided at the launch stage, was deliberately kept short, and quickly assimilated by the committee as they immediately applied what they had just learned. The training produced immediate results on the five top objectives.

Challenges

With all change initiatives there are challenges and the implementation of ORCM was no different.

Clearing the Calendar

Implementing a sustainable risk management framework like ORCM takes time and effort. Individuals accountable for top priority objectives usually have many pressing demands on their time. Organizations need to be prepared that the initial implementation of risk management will need to be fitted in around existing pressures and conflicting priorities. Flexibility in adjusting the implementation schedule as circumstances change will increase the chances of success.

At DeafBlind Ontario Services, two events during implementation, the COVID-19 pandemic, and the final stages of a major amalgamation, placed unusual stress on the organization and its leaders. Midway through implementation it became obvious we needed to pause due to additional workload pressures on several individuals with primary responsible for assessing risks to key objectives.

When we resumed, a quick refresher of the key concepts and principles was provided along with a review of progress to date. Taking a break made the best sense for this organization. Moving forward with only a partial team would have compromised the quality of the discussions and challenges to risk identification and assessment, and reliability of information produced.

Time commitments for ORCM efforts will ebb and flow. Initial implementation will place greater demands on specific individuals and recede as ORCM matures and becomes rooted in daily decisions. The nature and number of objectives selected for formal assessment will also impact time and effort. A greater investment of time and effort will be required for new strategic objectives where there is an elevated level of uncertainty of achievement. Recognizing the changing demands on commitment and responding with flexibility will help to support success.

Designing Reports that Add Value

One of the benefits of the ORCM approach is reliable information on risks influencing the achievement of top objectives. To be of value, reports need to provide just the right amount of information to meet the needs of the readers and help them to fulfill their assigned responsibilities.

At DeafBlind Ontario Services, careful attention was paid to designing reports that met the needs of two key audiences:  individuals with responsible for the success of the objective (Objective Owners) and the Board of Directors. Several templates were developed and evaluated before landing on report formats that best met their needs.

Objective Owners need information that tells them what could influence success and what, if anything, is being done to manage risk that could affect success. They need robust and fit for purpose information to fully understand the complete picture. Objective Centric Risk Assessment templates were designed to allow all relevant data to be captured in one report. Reports provide details on risks, report on the current confidence level in achieving the objective, provide details on the context for the objective, how performance is measured, and relevant assumptions and concerns. With a complete snapshot at a point in time, information can be efficiently monitored for changes and course corrections can be implemented.

Boards of Directors who are responsible for overseeing risk management want assurance management has an effective risk/certainty management framework in place, and assurance that management is aware and executing actions that addresses opportunities and risks that could influence success. Directors need information that provides them with the big picture; that gives them just the right level of information; and avoids taking them into the weeds of the details. To integrate risk management with strategy, it made good sense to build on the strategic report format already in place for the Board of Directors.

A customized Toolkit was provided to support readers in how to use the information to inform decisions. Without this understanding the relevancy of the information and practical application may be lost.

Recognizing Biases Impairing the Reliability of Information

When interpreting risk information to guide decisions we rely on what psychologists[1] refer to as System 1 and System 2 modes of thinking. Nobel prize winner Daniel Kahneman describes System 1 thinking as operating “automatically and quickly, with little or not effort and no sense of voluntary control[2]”. In other words, our intuition, first impressions and feelings. System 2 thinking “allocates attention to the effortful mental activities[3]”; that is our deliberate reasoning and careful consideration of the facts. Although both systems of thinking will serve us well in many situations our biases[4] emerging in System 1 thinking may impair our ability to interpret information.

The ORCM methodology deliberately includes features to counter the effects of biases and we leveraged those features to our advantage.

For example, an essential element of the ORCM methodology is the facilitated risk assessment sessions on objectives designated as top value creation and preservation objectives. Leading with a skilled facilitator that can probe, and challenge cognitive biases is vital to encouraging the critical thinking and analysis that will provide reliable information. Ideally facilitated sessions include participants with varying perspectives to alleviate the risk of “group think[5].

Other features employed to counter cognitive biases and flawed interpretation of data included:

• Implementing three out of ten available methods for identifying risks to ensure careful exploration of the unimaginable. This is a significant advantage over traditional risk management that often relies upon one method of risk identification: typically brainstorming.
• Relying on the free nine category, 100+ element Risk Oversight Risk Treatment Principles model. The “checklist” type tool assists facilitators and participants to broaden their perspective in determining the best course of action to “treat” a risk to the objective to an acceptable level and increase likelihood of success. See Figure X below for the nine principles.
• Relying on indicator data to monitor progress and guide decisions regarding the confidence in achieving the objective. Using indicator data reduces the risk of wishful thinking and “optimism bias[6]” and provides factual support for our conclusions regarding our chances of successfully achieving our objective. For most objectives at DeafBlind Ontario Services reliable indicator data was available and demonstrating how it could be used to guide actions and decisions increased its value to the agency.

Finally, as noted above, we paused implementation to alleviate stress in interpreting and decisions. This was important to allow individuals space to learn and participate more fully and to improve the quality of decisions. We know from experience that when “…we’re mentally, emotionally, and physically spent …. (we rely) more heavily on intuitive, System 1 judgments and less on careful reasoning. Decision making becomes faster and simpler, but quality often suffers.[1]” Leveraging the success factors above and navigating the challenges at DeafBlind Ontario Services was key to successful implementation   that strengthened decision making and made the best use of limited resources

Conclusion

The time and effort that DeafBlind Ontario Services invested in implementing ORCM has paid off. ORCM has formalized and provided structure to informal risk management processes used daily to make better decisions to increase likelihood key objectives are achieved.

The DeafBlind Ontario Services culture was conducive to the requirements of ORCM. The implementation approach allowed participants to quickly realize benefits. The executive management has a greater understanding of the impact of risks and opportunities on top priority objectives. They now are better able to formally identify and assess risks most likely to impact achievement and have a process in place for monitoring and responding to changes in risk likelihood and consequence and performance being achieved. The level of confidence conveyed to the Board of Directors on efforts to manage achievement of top objectives instills confidence in the Board and other key stakeholders – confidence that is based on factual data that demonstrates progress.

DeafBlind Ontario Services now has a sound foundation of objective centric risk management that will continue to strengthen decision making in the organization and increase its chances of success.

About the Author

 Angela Byrne is passionate about sharing her knowledge and experience and ultimately helping others to succeed. She is president of Angela Byrne Consulting Inc., a practice dedicated to working with organizations to manage risks to achieving strategic objectives. Angela has 30 years of practical experience working with a variety of organizations. She is a Chartered Professional Accountant (CPA) and Certified Management Accountant (CMA) and holds certifications in risk management assurance, internal audit, and information systems auditing. She can be reached at info@angelabyrnecma.com 

[1] https://pages.ucsd.edu/~mckenzie/StanovichBBS.pdf

[2] Kahneman, Daniel, “Thinking, Fast and Slow,” Anchor Canada, 2013, pg. 20

[3] Kahneman, Daniel, “Thinking, Fast and Slow,” Anchor Canada, 2013, pg. 21

[4] https://www.psychologytoday.com/ca/basics/bias

[5] Groupthink is a phenomenon that occurs when a group of well-intentioned people makes irrational or non-optimal decisions spurred by the urge to conform or the belief that dissent impossible.  https://www.psychologytoday.com/ca/basics/groupthink

[6] The tendency for people to be optimistic about future events, especially those seen as following from their own plans and actions. https://www.oxfordreference.com/view/10.1093/oi/authority.20110803100252318

[7] Soll, Jack B., Milkman, Katherine L., Payne, John W., “Outsmart Your Own Biases,” Harvard Business Review, May 2015

Here is a recent presentation I gave to the Young Leaders of Tomorrow about Fiduciary Oversight

2015-09-28 Young Leaders of Tomorrow Presentation

Recently an article I wrote was published on the Charity Village website.

Read the article here:

Building better boards: Strengthening fiduciary and risk oversight