When companies announce that they will be conducting risk assessments of business units and subsidiaries, reactions are always mixed. Some offices fill out the paperwork as soon as possible while others procrastinate until the last minute. And then there are those who question the true intent, agonize over every answer and state responses as briefly as possible for fear of retribution. For them, each question brings uncertainty that too much detail could somehow negatively impact a promotion, bonus or salary review.
Often, the assessment process feels tactical, tedious or even tyrannical. This results in limited cooperation, a mountain of paperwork and inadequate data. And a risk assessment based on inadequate information is a risk in itself.
The best risk assessments provide clear visibility into where a company stands today, which in turn helps determine where it can go tomorrow—and what stands in the way. This risk compass depends on structured and consistent frameworks that align with the business model, enable prioritization in accordance with probability, and drive decisions necessary to achieve strategic goals.
But businesses are social organisms, created, managed and run by people who, despite best intentions, operate with a degree of subjectivity. Paperwork and numbers will only go so far. Better results can often be achieved by clarifying intent, bringing people with the right knowledge and expertise to the table, and having more detailed and transparent conversations. This approach will help organizations uncover new perspectives, optimize resources, monetize assets and improve culture. The key is to focus on root causes over questionnaires and issues instead of inquisitions. By keeping a few principles in mind, this approach, while different, is not difficult.
One important principle is personal interaction. In-person team meetings or workshops in the contributing location are more effective than attempting the risk assessment remotely or bringing stakeholders to company headquarters. Clarity comes from being on the scene. This makes it more likely the right people will participate than if a sole representative serves as proxy.
The assessment framework should drive the conversation, not be the conversation. One goal is to involve team members in the outcomes by soliciting their views on what is valuable for the future of the business. Explore the what-if scenarios and then discuss the secondary and tertiary impacts. To avoid “us” vs. “them” dynamics that can undermine such interactions, focus on the “we” and the collective vision for business improvement, and be sure to share any key findings prior to taking them back to headquarters.
It is also important to be clear why certain issues being explored could be high-risk and to share examples from previous, similar situations. Cultural differences can get in the way of understanding how practices on the ground may be significant at a macro level. Get the team to align on the issues. If they do not, you may need more exploration to achieve a full, clear perspective and determine root causes.
It is also helpful to give local business units that are performing well a chance to share their experiences with others in the global organization who might be facing similar challenges. Not only does this spread best practices, it encourages transparency and promotes potential efficiencies through consistency.
The collaborative approach yields a clearer picture of risks that always existed but of which the team was perhaps unaware. Questionnaires will remain important for structure and consistency, but the data will be richer, and the team will benefit from this new mindset.
Because risk assessments touch on business processes, interactive conversations may highlight, for example, overlapping job responsibilities that could be untangled to shift resources toward high-value activities, or uncover an opportunity to monetize expensive but unused real estate. You may find that time-intensive controls put in place decades ago no longer address a present-day concern, or that excess money is being spent on premiums for less significant risks that would be more affordable to self-insure. Checklists alone would probably not identify these opportunities.
The next time your company conducts a risk assessment, invest as much time planning the dialogue as you do reviewing the documentation. Frameworks and questionnaires are critical, but getting to the real issues at play often comes from deep discussion and significant debate. The information gained will inform the company of its true state, uncover opportunities and help drive it in the right direction.