Case study: how to overcome board resistance to integrate a risk management programme

Integrating a risk management programme within an organisation is rife with challenges, from managing resistant boards, to low process maturity, or a lack of resources dedicated to risk management implementation.

Darlene Halwas is currently a board member of Carbon Management Canada with a background in leading risk management functions for companies.

At a Risk Awareness Week session, she discussed the key challenges she faced when implementing a risk management programme at an organisation, and the steps she took to overcome them.

GETTING THE BOARD ON SIDE

“The biggest challenges I have faced are gaining alignment and support at the board level,” says Halwas.

“Generally on boards, you are going to find a composition of members who are there for a variety of reasons and they may have varying understandings, and willingness to understand risk management.”

Halwas says that as the tone is set at the top, such obstructions serve as a roadblock in terms of what the organisation can achieve.

”The assumption is ‘you are here to discuss compliance’, versus the value-add of making an organisation better”

“Executive support can be an issue. If you have to change just one mind – that of the sole decision-maker – that is actually more difficult than being at the board level where you have to adjust a few minds before they will move the decision forward in your favour.”

A further challenge, says Halwas, is shifting the mentality from one focused on compliance to one of value added.

“That challenge takes a lot of patience. It is a natural [consequence] of risk management being situated within an internal audit. So the assumption is ‘you are here to discuss compliance’, versus the value-add of making an organisation better,” she explains.

MANAGING EXPECTATIONS

“I had the pleasure of establishing an enterprise risk management programme for a company where I headed up risk management,” says Halwas.

“The group of staff there were stellar, which made it a great experience. That said, it was a sea change for the organisation as all of our risks were going to be viewed holistically.”

Halwas believes that with any organisation, you have various ‘camps’ or allegiances. However, when you want to do risk management, you are essentially “breaking down allegiances”.

“You are saying on a transparent basis: this is all our organisation. So it was quite a daunting challenge. There were also some unrealistic timelines, and we had to manage expectations.

”The board had more assurances that the organisation was being well run”

“A big learning for me is managing the expectations around the timelines regarding what was successfully doable for us, especially at the start.”

Halwas says this was solved by developing a plan and a methodology that would continually give the board and the audit committee updates on progress.

“Eventually, it became very successful, and I measured success by the fact that the board had more assurances that the organisation was being well run,” she says.

“The board did not question what was going on as much because they had those understandings [through the risk programme structure].”

This new integrated risk approach also helped with budgets, says Halwas, as there was better acceptance for some areas that had not historically been supported by the board, but the risk reporting made them understand their importance.

BE A SOLUTION NOT A PROBLEM

Despite its eventual success, Halwas says there was still resistance through this process.

“Within an organisation, everyone is busy. No one has the time to take on additional work, have more meetings or provide more information. That happened for our enterprise risk management programme,” she explains..

“So one of the approaches we took was going in with an attitude of: ‘How can we help you?’ We have these tools within our group. We are good at modelling, good at taking massive amounts of data and sorting them out and finding trends.”

”It turned into a very synergistic relationship to the point where we were getting approached on an ongoing basis.”

When parts of the organisation pushed back and said they would not be able to provide any information for another month as they were writing, for example, a strategy paper, the risk team responded by saying ‘How can we help you with that paper?’

Halwas says: “We ended up getting the information we needed and they got the support they needed. It turned into a very synergistic relationship to the point where we were getting approached on an ongoing basis.”

SPEAK EACH PERSON’S LANGUAGE

Halwas says that continued executive support is important and will ensure that an enterprise risk management programme can progress.

“If you can count on executive support, it will help in the discussions where you are not at the table. That will help you move risk management forward,” she says.

“Do your homework on the board members and the executive. Ensure you can answer the questions posed by them based on their backgrounds. This builds support and credibility.”

”Measure the wins in inches and the feet will come.”

Halwas adds that this ensures risk teams can get majority support for new risk initiatives and programmes at the board level.

“Understand that there are different ways that people learn. Some are oral learners, some are tactile, some are reading-based. If we are thinking holistically, we need to build programmes that will help people learn and reach them in how they learn.”

Halwas says it is also important to be patient. “That was difficult as it can be hard to be patient when trying to move discussions forward. Measure the wins in inches and the feet will come.”

“Finally, check your own assumptions. My experience is that we are pretty good at talking about risks as risk professionals. But sometimes we do not check our biases and our own assumptions when we are advocating for a decision in our favour.”