Author Archive

EXECUTIVE SUMMARY

Increasingly oversight groups like Imagine Canada, donors, government funders, and Boards of Directors are telling charities that they need to be able to demonstrate that they are effectively managing risks. This is often viewed as a compliance exercise and results in creating a “RISK REGISTER” and presenting a “RISK HEAT MAP” to the Board.

The generally accepted definition of the word “RISK” is the “effect of uncertainty on objectives.”

Risk registers may give the impression risks are being effectively managed, however without any reference to objectives, there is no way of knowing if the charity’s primary PURPOSE and objectives will be achieved with a level of risk acceptable to the Board.

This is a case study of one charity, DeafBlind Ontario Services, who have recently implemented the newest generation of risk management – Objective Centric Risk and Certainty Management (#ORCM). An approach focused on managing the likelihood key objectives will be achieved, not managing a list of risks divorced from top objectives and performance.


Since the 2008 Global Financial Crisis an increasing number of private sector organizations have been forced by regulators and sometimes their boards to demonstrate they are managing risks. The most common response is to create an Enterprise Risk Management (ERM) function, who create and maintain a “RISK REGISTER,” a list of what are usually termed “top risks” to the organization.

The generally accepted definition of the word “RISK” is the “effect of uncertainty on objectives.” Evidence is increasing each year that using risk lists as the foundation for risk management fails to meet this definition. Risk management is effective when leadership teams and boards have information on the risks and certainty key objectives will be achieved with an acceptable level of risk. This information will lead to better decisions on how best to allocate scarce resources.

For charities that want to move forward with effective risk management practices; practices that strengthen decisions and the use of limited resources, and increase stakeholder confidence in the charity’s governance framework, an objective centric approach is required.

Having implemented Objective Centric Risk and Certainty Management in a variety of organizations over the last decade I have seen firsthand its effectiveness. It is best equipped to deliver on the real promise of formal, structured risk management – increased certainty objectives will be achieved while operating with an acceptable level of residual risk. It is aligned with current practice guidance issued by ISO, COSO, and the Institute of Internal Auditors, and is designed to replace traditional risk list ERM and legacy spot-in-time internal audit assessment methods. It is scalable to any size organization, integrates with strategy and top objectives of the organization, and supports management and board decisions. It consistently delivers reliable information on risks that result in better decisions and increase the chances of achieving the entity’s most important objectives.

An overview of the core steps to implement ORCM is below, together with CertaintyStatusline, an objective centric assessment methodology developed by Risk Oversight Solutions (ROS) in Oakville, Ontario. The ROS framework is free and available for download at https://riskoversightsolutions.com/resources/.

The DeafBlind Ontario Services Case Study

DeafBlind Ontario Services, incorporated in 1989, provides an array of services to people who are Deaf, hard of hearing, non-verbal, and deafblind. Their reach extends into remote communities and urban centres across Ontario with supported living homes and customized community services, training and supports to other agencies.

As a provincially funded charity, DeafBlind Ontario Services is accountable to its funder and stakeholders. It continually strives to make the best use of limited funds and focuses maximum possible resources on service delivery. DeafBlind Ontario Services was seeking to improve its decision making and was searching for a risk management approach that would make good sense for them and was affordable. This meant any approach selected needed to produce benefits quickly.

The ORCM approach is a good fit for DeafBlind Ontario Services and its culture. The implementation approach focused on training the management team and applying their new skills to identify and manage risks that could affect achievement of key objectives as quickly as possible. The approach also zeroed in on those elements of the methodology that would establish a solid foundation and start to show results quickly.

The following discusses factors that contributed to ORCM success at DeafBlind Ontario Services as well as challenges encountered.

Success Factors

Three factors were instrumental to success: the DeafBlind Ontario Services Culture, early Integration of risk and strategy, and the implementation approach.

DeafBlind Ontario Services Culture

The ORCM approach is not a good fit for all organizations. It is best suited to a culture that is willing to define clear outcome-based objectives, entertain differing opinions, foster candidness, and embrace critical thinking. It works well in an environment where accountability for making decisions rests with individuals who are in the best position to do so. It encourages individuals to analyze risks that could affect the certainty of achieving objectives, critically assess action, and seek opportunities for improvement. Cultures that promote learning and increase management’s knowledge of objectives and risks and encourage candid discussion of tough issues will do well with an ORCM approach.

A key factor in the success of ORCM at DeafBlind Ontario Services was its alignment with the existing culture. The Finance & Risk Committee established to implement and maintain the ORCM approach built on the strengths already embedded in the Executive Management Team. Members represented diverse functions and established a collaborative working style. Respect and attentive listening to all members were demonstrated throughout the implementation and critical thinking and differing opinions were encouraged.

To ensure decisions rested with the individuals with the necessary authority, accountability for achieving an objective moved from a team-based approach to a designated individual. A shared understanding of the responsibilities of the objective owner and the ability to draw on the broader expertise of the management team was developed.

Training on ORCM was provided and quickly applied to current top strategic objectives. Selected individuals were identified for further training to deepen the organizational knowledge of risk management and develop a center of expertise and resource for all objective “OWNER/SPONSORS” and the management team.

Although ORCM does not need to be implemented in a perfectly aligned culture, it is helpful to understand the culture and what factors might work for, or against, ORCM before moving forward.

Integration of Risk and Strategy

The intent of risk management is to help management make better decisions. It is about understanding what may support or hinder the achievement of your most important goals. With an improved understanding of threats and opportunities, it becomes clear what action, if any, is needed to increase the likelihood of success.

ORCM easily integrates with strategy. As the most important goals of an entity are ideally stated in the strategic plan, it only makes sense to integrate risk management with the development and execution of strategy. This made practical sense for DeafBlind Ontario Services as a charity striving to be as efficient as possible and maximize its use of resources in service delivery. Reports to the Board of Directors on strategic objectives were revised to include relevant risk information and eliminated the need for separate monitoring and reporting. Integrated reports supported the Board in their oversight responsibilities and allowed users to quickly identify the biggest threats to achieving objectives. This step made reporting on strategic progress more meaningful.

Approach to ORCM Implementation

The ORCM approach is a systematic, comprehensive approach to risk governance that usually takes about three years to fully mature. Despite the time required to fully implement, immediate benefits are realized by formalizing the daily practice of managing risks that staff already perform. For example, responsibilities are confirmed, and a systematic approach to assessing risks and their impact to priority objectives is determined.

Like many organizations, DeafBlind Ontario Services strives to make the best use of limited resources. It was important that the benefits of implementing ORCM quickly became evident and early wins were achieved. Two features were built into the implementation approach to allow us to realize early success.

  1. Start with a manageable amount of familiar information

It was important to implement ORCM in “bite size” pieces to easily assimilate the information. To be successful, we wanted to focus our efforts and generate quality information over quantity. We carefully selected and applied ORCM on five top objectives. Starting with the strategic plan objectives made good sense as it allowed risk management concepts and application to be anchored to content familiar to the newly established Finance & Risk committee.

  1. Training and facilitation

Training in ORCM is essential to its success. Orientation training was provided at the launch stage, was deliberately kept short, and quickly assimilated by the committee as they immediately applied what they had just learned. The training produced immediate results on the five top objectives.

Challenges

With all change initiatives there are challenges and the implementation of ORCM was no different.

Clearing the Calendar

Implementing a sustainable risk management framework like ORCM takes time and effort. Individuals accountable for top priority objectives usually have many pressing demands on their time. Organizations need to be prepared that the initial implementation of risk management will need to be fitted in around existing pressures and conflicting priorities. Flexibility in adjusting the implementation schedule as circumstances change will increase the chances of success.

At DeafBlind Ontario Services, two events during implementation, the COVID-19 pandemic, and the final stages of a major amalgamation, placed unusual stress on the organization and its leaders. Midway through implementation it became obvious we needed to pause due to additional workload pressures on several individuals with primary responsible for assessing risks to key objectives.

When we resumed, a quick refresher of the key concepts and principles was provided along with a review of progress to date. Taking a break made the best sense for this organization. Moving forward with only a partial team would have compromised the quality of the discussions and challenges to risk identification and assessment, and reliability of information produced.

Time commitments for ORCM efforts will ebb and flow. Initial implementation will place greater demands on specific individuals and recede as ORCM matures and becomes rooted in daily decisions. The nature and number of objectives selected for formal assessment will also impact time and effort. A greater investment of time and effort will be required for new strategic objectives where there is an elevated level of uncertainty of achievement. Recognizing the changing demands on commitment and responding with flexibility will help to support success.

Designing Reports that Add Value

One of the benefits of the ORCM approach is reliable information on risks influencing the achievement of top objectives. To be of value, reports need to provide just the right amount of information to meet the needs of the readers and help them to fulfill their assigned responsibilities.

At DeafBlind Ontario Services, careful attention was paid to designing reports that met the needs of two key audiences:  individuals with responsible for the success of the objective (Objective Owners) and the Board of Directors. Several templates were developed and evaluated before landing on report formats that best met their needs.

Objective Owners need information that tells them what could influence success and what, if anything, is being done to manage risk that could affect success. They need robust and fit for purpose information to fully understand the complete picture. Objective Centric Risk Assessment templates were designed to allow all relevant data to be captured in one report. Reports provide details on risks, report on the current confidence level in achieving the objective, provide details on the context for the objective, how performance is measured, and relevant assumptions and concerns. With a complete snapshot at a point in time, information can be efficiently monitored for changes and course corrections can be implemented.

Boards of Directors who are responsible for overseeing risk management want assurance management has an effective risk/certainty management framework in place, and assurance that management is aware and executing actions that addresses opportunities and risks that could influence success. Directors need information that provides them with the big picture; that gives them just the right level of information; and avoids taking them into the weeds of the details. To integrate risk management with strategy, it made good sense to build on the strategic report format already in place for the Board of Directors.

A customized Toolkit was provided to support readers in how to use the information to inform decisions. Without this understanding the relevancy of the information and practical application may be lost.

Recognizing Biases Impairing the Reliability of Information

When interpreting risk information to guide decisions we rely on what psychologists[1] refer to as System 1 and System 2 modes of thinking. Nobel prize winner Daniel Kahneman describes System 1 thinking as operating “automatically and quickly, with little or not effort and no sense of voluntary control[2]”. In other words, our intuition, first impressions and feelings. System 2 thinking “allocates attention to the effortful mental activities[3]”; that is our deliberate reasoning and careful consideration of the facts. Although both systems of thinking will serve us well in many situations our biases[4] emerging in System 1 thinking may impair our ability to interpret information.

The ORCM methodology deliberately includes features to counter the effects of biases and we leveraged those features to our advantage.

For example, an essential element of the ORCM methodology is the facilitated risk assessment sessions on objectives designated as top value creation and preservation objectives. Leading with a skilled facilitator that can probe, and challenge cognitive biases is vital to encouraging the critical thinking and analysis that will provide reliable information. Ideally facilitated sessions include participants with varying perspectives to alleviate the risk of “group think[5].

Other features employed to counter cognitive biases and flawed interpretation of data included:

  • Implementing three out of ten available methods for identifying risks to ensure careful exploration of the unimaginable. This is a significant advantage over traditional risk management that often relies upon one method of risk identification: typically brainstorming.
  • Relying on the free nine category, 100+ element Risk Oversight Risk Treatment Principles model. The “checklist” type tool assists facilitators and participants to broaden their perspective in determining the best course of action to “treat” a risk to the objective to an acceptable level and increase likelihood of success. See Figure X below for the nine principles.
  • Relying on indicator data to monitor progress and guide decisions regarding the confidence in achieving the objective. Using indicator data reduces the risk of wishful thinking and “optimism bias[6]” and provides factual support for our conclusions regarding our chances of successfully achieving our objective. For most objectives at DeafBlind Ontario Services reliable indicator data was available and demonstrating how it could be used to guide actions and decisions increased its value to the agency.

Finally, as noted above, we paused implementation to alleviate stress in interpreting and decisions. This was important to allow individuals space to learn and participate more fully and to improve the quality of decisions. We know from experience that when “…we’re mentally, emotionally, and physically spent …. (we rely) more heavily on intuitive, System 1 judgments and less on careful reasoning. Decision making becomes faster and simpler, but quality often suffers.[1]” Leveraging the success factors above and navigating the challenges at DeafBlind Ontario Services was key to successful implementation   that strengthened decision making and made the best use of limited resources

Conclusion

The time and effort that DeafBlind Ontario Services invested in implementing ORCM has paid off. ORCM has formalized and provided structure to informal risk management processes used daily to make better decisions to increase likelihood key objectives are achieved.

The DeafBlind Ontario Services culture was conducive to the requirements of ORCM. The implementation approach allowed participants to quickly realize benefits. The executive management has a greater understanding of the impact of risks and opportunities on top priority objectives. They now are better able to formally identify and assess risks most likely to impact achievement and have a process in place for monitoring and responding to changes in risk likelihood and consequence and performance being achieved. The level of confidence conveyed to the Board of Directors on efforts to manage achievement of top objectives instills confidence in the Board and other key stakeholders – confidence that is based on factual data that demonstrates progress.

DeafBlind Ontario Services now has a sound foundation of objective centric risk management that will continue to strengthen decision making in the organization and increase its chances of success.


About the Author

 Angela Byrne is passionate about sharing her knowledge and experience and ultimately helping others to succeed. She is president of Angela Byrne Consulting Inc., a practice dedicated to working with organizations to manage risks to achieving strategic objectives. Angela has 30 years of practical experience working with a variety of organizations. She is a Chartered Professional Accountant (CPA) and Certified Management Accountant (CMA) and holds certifications in risk management assurance, internal audit, and information systems auditing. She can be reached at info@angelabyrnecma.com 


[1] https://pages.ucsd.edu/~mckenzie/StanovichBBS.pdf

[2] Kahneman, Daniel, “Thinking, Fast and Slow,” Anchor Canada, 2013, pg. 20

[3] Kahneman, Daniel, “Thinking, Fast and Slow,” Anchor Canada, 2013, pg. 21

[4] https://www.psychologytoday.com/ca/basics/bias

[5] Groupthink is a phenomenon that occurs when a group of well-intentioned people makes irrational or non-optimal decisions spurred by the urge to conform or the belief that dissent impossible.  https://www.psychologytoday.com/ca/basics/groupthink

[6] The tendency for people to be optimistic about future events, especially those seen as following from their own plans and actions. https://www.oxfordreference.com/view/10.1093/oi/authority.20110803100252318

[7] Soll, Jack B., Milkman, Katherine L., Payne, John W., “Outsmart Your Own Biases,” Harvard Business Review, May 2015

Comments (0)
Jul
13

Balancing Danger and Opportunity

Posted by: | Comments (0)

Many would agree that the pandemic times we are living through are unlike any that we have seen in the past. It has quickly forced companies to rethink how they engage with their clients and deliver their products and services. Many industries have seen revenues dramatically shrink and economic indicators predict gloomy days ahead. Collectively we have already decided that we will not be going back to the old ways of business. Too much has changed. 

For many, this is a time of crisis. When uncertainty accelerates and new risks emerge there is a tendency to hunker down to protect the organization.  This appears to be the case for many organizations. Risk management efforts are being invested in managing risks that threaten organizational value while little attention is being paid to managing risks that may impact growth opportunities.

Yoram (Jerry) Wind [1] reminds us that “In the Kanji characters used in both Chinese and Japanese, the word ‘crisis’ is written with two symbols, the first meaning ‘danger’ and the second ‘opportunity.’”

Losing sight of the dual nature of a crisis and paying too much attention to one side at the expense of the other may threaten the future viability of the company.  Balancing ‘danger’ and ‘opportunity’ will be easier for some companies than others. Two ingredients are needed for success; the right perspective and an effective risk management system.

For those companies that have been able to respond to the pandemic disruption and for the most part carry on business as usual they will find themselves responding to new risks from a perspective of strength. Less time will be spent on managing risks that threaten organization value and energy will be available to assess risks that point to new opportunities.

In contrast, organizations that are struggling with business as usual, will likely be preoccupied in managing risks that threaten their existing value. As difficult as it may be, some energy needs to be left to focus on managing risks to growth objectives that will provide a new path to customers and revenue. This requires a shift in perspective; one that is willing to assess risks impacting current revenue objectives and explore possibilities for responding that will increase the value of the organization.

Bringing the right perspective to managing risks will have little impact if your system is flawed. Ideally, your risk management system is designed to manage risks that pose a ‘danger’ to objectives while also allowing a response to risks that present ‘opportunity’.

If your risk management approach does not invest time and effort in assessing risks that signal when growth objectives need to pivot it may be time to change up your risk approach.

After all, the ultimate purpose of a risk management system is to help you make better decisions and increase your chances of success.  Now more than ever risk management systems need to deliver.

If yours isn’t doing that, it may be time for a change.

Article Credits:

[1] Wind, Yoram (Jerry), “Ten Guidelines for Creating Opportunities in a Time of Crisis”, April 2020

https://knowledge.wharton.upenn.edu/article/ten-guidelines-create-opportunities-coronavirus-crisis/

Categories : Risk Management
Comments (0)
Mar
26

Risk Management In Times of Uncertainty

Posted by: | Comments (0)

You may remember hearing about the successful landing of US Air Flight 1549 in the Hudson River on January 15, 2009. Thankfully everyone walked away from the “miracle on the Hudson”.

Risk on Miracle on the Hudson

Despite the passage of time this event provides a valuable lesson in risk management that is important today as we deal with the COVID -19 pandemic.  In our rush to respond to the crisis, we cannot forget the basics. 

Effective risk management demands that we keep our objectives front and centre while identifying and assessing the risks and determining action that will helps us achieve our goal.

In responding to the COVID-19 pandemic, now more than ever it is important to not lose sight of our objectives and the priority of those objectives. 

Captain Chesley “Sully” Sullenberger and his co pilot Jeffrey Skiles never lost sight of their objective to preserve as many lives as possible while assessing the risks and determining a course of action; all in the space of about 3 minutes.

The plane took off at 3:24 and Captain Sully called out “birds” at 3:27. At 3:30 the plane landed on the Hudson and at 3:32 everyone was out of the plane.

From the time the pilot called out “birds” to landing on the Hudson, Captain Sully and his crew had to decide if they could get back to LaGuardia. Returning to LaGuardia would have meant crossing over the city of Manhattan and putting people on the ground at risk. If the plane crashed with full fuel tanks the plane and everything around it would be incinerated. Another option was to try and make it to the Teterboro Airport that was closer but still required flying over a populated area. Lastly, should the crew try to land on the Hudson? Of course we know the plane successfully landed on the Hudson and everyone survived.

This is what risk management is all about. On your way to your destination, a number of obstacles can get in the way and you need to respond in order to get back on track so that you ultimately reach your destination.

The changing impact of COVID 19 is exerting time constraints and demanding that we continually re assess our options and make decisions. We need to quickly identify and assess the risks, despite not having all the information we would like, and decide very quickly the best path forward to ensure that we ultimately reach our destination. Using the Objective Centric Risk Management approach keeps objectives front and centre.

If you haven’t tried this approach maybe the time is now.  In these uncertain times when everything we’ve known has turned upside down and we are seeking better ways to achieve our goals, perhaps now is the time to embrace the Objective Centric Risk Management approach.

The best source for Objective Centric Risk Management is Tim Leech. His site is Risk Oversight Solutions.com

During these uncertain times we are all stronger together as a community. If you have any questions, comments or insights to share, feel free to email me to abyrnecma at rogers.com

Categories : Risk Management
Comments (0)

Here is a recent presentation I gave to the Young Leaders of Tomorrow about Fiduciary Oversight

2015-09-28 Young Leaders of Tomorrow Presentation

Comments (0)

Recently an article I wrote was published on the Charity Village website.

Read the article here:

Building better boards: Strengthening fiduciary and risk oversight

Comments (0)

Read on to discover why flexibility is important in any shared service arrangements

Read the article – Performance-based contracting and the road less traveled by Andy Akrouche

Thought provoking article and comments on the concept of emergent strategy to better address the complexity of social change.

Read the article – Strategic Philanthropy for a Complex World

Read this article to discover recommendations that have the potential to create datasets useful for evidence-based decision-making in solving social problems.

Read the article – Big Data for Social Innovation

Aug
14

Boosting Nonprofit Board Performance

Posted by: | Comments (0)

Excellent lessons on transitioning new leaders.

Read the article – Boosting Nonprofit Board Performance Where it Counts

Learn how to reduce risk associated with outsourcing activities.

Read the article – Risk Management Throughout the Vendor Relationship Lifecycle

corporations2

nonprofit2

government2