Let's talk about risk

The importance of consultation and communication in risk management

ISO 31000 refers to consultation and communication with stakeholders as a key activity in a well implemented risk management methodology. Let’s examine why these elements are important.

The elements

ISO talks about consultation and communication with stakeholders. So we need to explain why:

• consultation
• communication
• stakeholders

are important. We’ll start with the whom, then discuss the two interactions.

Stakeholders

“A stakeholder is a person with an interest or a concern in something, especially a business.”

A stakeholder is therefore influenced by the objectives of an organization and whether or not it achieves these objectives. Note I’m not saying that every stakeholder is necessarily aiming for the organization to reach (all of its) objectives. On the contrary, a stakeholder may be defined as a stakeholder because his or her interest runs counter to the objectives of the organization.
Not recaptured in the definition is that stakeholders have many means at their disposal to influence whether or not and how or at what price an organization can reach its objectives. A voter, for example, may have interests aligned with a political party. If that party does not achieve its stated objectives, it’s entirely possible the voter will take his or her vote elsewhere, and impede the party from realizing all its objectives.
A political party and its voters are relevant as an example of the diversity of stakeholder interests in another sense as well. A political party has a programme, often a concensus of the diverse needs of its intended voters and its political objectives. Not every voter is as interested in the party achieving the entirety of its programme. On the contrary, quite often there may well be conflicting interests within a party programme. It all depends on the weight of the stakeholders in the decision making process.
Lastly, note that not all stakeholders are external to an organization. Your employees are stakeholders as well. And believe me that you should not automatically assume that they are aligned with each and every aspect of your strategic intent. Because they are not.
Let’s be clear, stakeholders are a force to be reconned with. I’ll come back to that later.

Consultation

“the action or process of formally consulting or discussing”

When we’re defining consulation, we need to define the verb “to consult”.

“have discussions or confer with (someone), typically before undertaking a course of action”

Consultation is all about exchanging information and ideas with someone, preferrably an expert or a party involved and with a particular view on an aspect of what you’re dealing with, prior to an action.
Lots of issues or problems or elements on the road to achieving objectives benefit from being examined from different angles. I’m not suggesting to adopt an overly committee like approach where decisions are postponed and killed in committee. However, quite often problems are only looked at from an extremely narrow point of view. This ivory tower mentality has led to significant mistakes in decision making because certain aspects of a problem where never recognized as such.
In programming, there is a dictum that states “Given enough eyeballs, all bugs are shallow” (Eric Raymond). The same goes for issue management. If enough people involved in the problem look at it from their particular point of view, bringing together all these elements will result in a best possible view on the issue.
However, there is a difficulty with this approach: sometimes the time between potential risk detection and that risk becoming a reality is too short to allow for a full consultation. It pays to have a consultation group of stakeholders with different points of view at the ready to allow for quick consultation.

At BTC, we established a consultation committee on integrity. Representatives from all divisions of the organisation gather on a regular basis to discuss integrity related issues and advice my team on how to approach certain integrity related issues. As stakeholders, they have an expertise which my team members, acting as the integrity bureau, does not necessarily have. This committee can be called together on short notice to discuss concrete issues.

Through consultation, you bring to bear all competence within the stakeholder group on a specific problem you are being faced with. You recognize the value these stakeholders have to you, and by doing that, you recognize their value.
However, and that is essential, by no means to you transfer responsibility or accountability for the decisions taken to deal with issues, problems or risks. That remains the sole responsibility of the organization.

Communication

“the imparting or exchanging of information or news”

Consultation is not enough. In consultation, you gather additional perceptions and information to make better decisions. Once those decisions are taken you need to communicate to all stakeholders. In essence, you want to communicate:

• What: you decribe what the outcome of the consultations and the integration of the information learned into the decision making process;
• Why: you describe, wherever possible and not counter to any commercial objectives, why you’ve decided to do what you do;
• How: to those impacted, you explain how the what will be realized. What can they expect to happen to them or around them in what timeframe;
• Outcome and corrections: once a decision is implemented, it leads (hopefully) to results. These results need to be communicated as well. Based on the outcomes, certain corrections may be chosen. These and their impact and the what, why and how need to be communicated as well.

Bringing it together

One well placed, misinformed stakeholder can bring an entire strategy down.
When dealing with any time of activity of an organization, enhanced stakeholder involvement is important to gain perspective but also to develop acceptance of actions that need to be taken. Inviting your stakeholders to the dance is an important means of gathering the necessary support for implementation or of timely identifying key blocking factors.
When dealing with risks and risk management, this need is amplified. After all, you are investing time and means in avoiding the occurrence of certain situations. But just as with Y2K, a risk avoided is something that did not happen. Clearly involving your stakeholders to get a realistic view on the issues and gathering ideas to deal with the issues in the most effective way possible is a sound business tactic. Moreover, it shows diligence where diligence is due.
By making communication and consultation with stakeholders one of the first elements of risk management, ISO has clearly stated that no risk management approach can be successful without the proper support of the relevant stakeholders.

The auditor as a storyteller

What audit is about

Most of us familiar with the (internal) audit profession know what it is about. I’m not rehashing the excellent definition of the Institute for Internal Auditors. As auditors we need to use our independence to objectively gather, analyse and test facts and figures on the organization’s governance, processes, risk management and controls through the methods and tools at our disposal. Based on the understanding gained in this process we can then assess the performance of the organization and make recommendations to improve its functioning.

These are the cold, hard facts of the profession of internal auditing. We may differ in slight ways in defining what we do, but this is about it.

However, is it?

Where’s the end of the line?

Audits too often end there, by stating facts, but often lacking context. This can lead to significant misunderstandings by those who are confronted with that information, such as the members of the audit committee or the auditees.

The objectively gathered, analyzed and tested facts need context. And to position facts correctly in context, you need narrative. Thus, the end of the line is not establishing the facts and figures alone. At least the Chief Audit Executive needs to be able to convey in an accessible way not only the facts, but also the context in which these facts need to be seen.

Let me illustrate (and I’m heavily borrowing from Stephen Covey for this example) Read the following phrases one by one and try to “feel” a reaction to them:

1. “The man did not seem to notice his loud cousins on the subway.”

2. “After having lost his brother and their father, the man did not seem to notice his loud cousins on the subway.”

You have noticed the second part of the second sentence is identical to the first sentence. But because of the added context, it creates an entirely different sentiment about what is written. But the words written are exactly the same.

The strength of the auditor

The strength of the auditor is not only determined by the quality of the analysis, but by the ability to convey facts in context to his audience of audit committee members and auditees. Weaving context and facts together with narrative is what storytelling is all about. And storytelling is not only about fairytales.

The true bard

Only the true bard will have the ear of the king. The true bard should be the internal auditor, bringing the king, the audit committee and the board key information and insight, unburdened by hierarchy, like the joker did in the Middle Ages. But to get the king’s ear, you needed a good story. Or you needed to be funny. But any stand-up comedian will tell you it’s impossible to be funny without a great story.

Think about it

Consider your audit planning phase. Does your proposed audit planning sequence make sense, even to those not necessarily familiar with all the technical aspects of audit planning? You should not only focus on what you will be doing and how. You need to explain the audit committee members who will approve your planning why you are proposing the audits you are proposing.

Consider the audit execution. The how is often quite easy, once you have determined what you want to audit. But do your audit collaborators understand why you ask them to execute the work program steps you task them with? In essence, are they just putting one brick atop another one, or are they building a cathedral?

What narrative brings

Well developed narrative in a story lends credibility, recollection and relevance to your audit findings and recommendations. They will be remembered more easily, and will in turn lead to better communication to and with the audit committee and the board. They will be able to send a clearer message to the management team, which ultimately may enhance adoption rate of recommendations and even implementation speed.