How to talk to your CEO about risk management

Risk managers must frame the risk conversation to make it relevant to chief executives says, author Julian Talbot.

“You could build a fabulous risk management framework but unless you can get people to care about it, it’s just nothing,” says Julian Talbot, a former chief executive, risk manager and author.

He was delivering a workshop at the inaugural Risk Awareness Week 2019 on the chief executive’s perspective of risk management, while also providing his experience as a risk manager,

He said that chief executives don’t care about risk management frameworks. Indeed, when he became a chief executive himself, he admits that he “didn’t really care about risk management”, despite being an advocate for risk management.

He argues that instead of thinking about risk tools, risk managers need to focus on what it is that a chief executive cares about – decision making and changing culture.

With that in mind, he says that risk managers need to ask themselves whether the frameworks they are creating empower people in an organisation to make better decisions.

He explained: “The job of a chief executive is mostly making decisions, making a lot of decisions, making them frequently and hopefully making more good decisions than bad ones.

“What I cared about probably more than anything else was the culture and the systems and having people that I could trust so that I had the right information. I cared about strategic risks, the things that could bite us in the long run.”

He suggests starting meetings with a rundown of risks but focusing on how they affect the operational objectives of the business.

“If you’re a risk manager and you want to get some traction with your chief executive, then the first thing you need to understand is what they care about – that’s setting the context of this discussion that you are having,” he says.

“You need to focus on objectives, because that’s what the chief executive focuses on. What are the high-level organisational objectives and how does risk management support that? Does risk management give the chief executive or the team leaders and staff that manage the risks tools what they need to make better decisions?”

Whether dealing with the board or chief executives, risk managers need to speak their language and present information in a way that doesn’t necessarily look like a risk framework, he advises.

His top ten tips for engaging the chief executive are:

1. Recognise that the world is getting far more complex and more volatile, so risk is becoming more sophisticated and you need to be thinking about it ways that reflect that. There’s no point looking at simple tools like a risk matrix to solve these complex challenges.
2. Understand behavioural biases – we see risk through our own biases, be a little paranoid about your own blind spots
3. Don’t let any threat be below your threshold of concern – if comes up in conversation think about it. Not all of them need to go on a risk register, but it’s unwise to ignore them
4. Define your risk attitude or tolerance – be really explicit so that anyone could pick it up and under what the organisation’s attitude and tolerance is
5. Analyse root causes – any time something goes wrong don’t wait for it to be a catastrophe or a realised risk, do a detailed root cause analysis of a near miss and you’ll identify vulnerabilities and head them off at the pass
6. Think long term – especially when it comes to incentives. Incentives drive behaviours so think long term, at least annual bonuses or some long tail with deferred benefits. And don’t invest in short term projects when you can invest in long-term projects.
7. Be paranoid – greed is good, but paranoia is better. In high risk organisations like air traffic control things even though lots of things can go wrong, they rarely do and one of the reasons is having a healthy sense of paranoia that we are only one step away from disaster.
8. Interconnectedness – often people work as practitioners but increasingly we are so interconnected.
9. Don’t forget the white swans and multi-coloured swans.
10. Train the next generation of risk managers – nurture the high potential people. You can’t be promoted until you’ve found a replacement.

 To listen to Talbot’s full workshop, click here: https://2019.riskawarenessweek.com/talks/a-ceos-perspective-of-risk-management/