Forum

Replies

• 

  Elmari van Deventer March 9, 2011 9:44

  Dear Mike,

  Thank you for your response.  I am managing a project a currently specifically looking at the RCA process and how we can make it easier for business to comply to the RCA process in our company.  Our first step before re-writing the methodology on RCAs was to look at the processes and policies of each BU and if adherence to these, constitutes in extra controls being implemented within business.  Seems like we have a huge task in hand, I'm afraid.
  
  Mike Haubenstock said:

  We are also considering how to strengthen our RCSA process. We are planning more detailed walkthroughs, independent testing of controls by risk managment to feed control effectiveness ratings as part of the process, assuring that procedures are up to date and being followed, examining more thoroughly the internal history of events to assure that root causes are mitigated, demanding a mitigation plan and issuing a report with overall findings and ratings
• 

  Elmari van Deventer March 9, 2011 9:38

  Dear John,

  I agree with you.  Top Management need to have buy-in for it to filter down into Business or you fight a loosing battle.  Thank you for your input.
  
  John Bruner said:

  I have spent much of my life attempting to make management understand that "control" is all about "Corporate Attitude." If senior management conveys the importance with authority, it will happen. To often, it is a nice to have but not a must have for top management. The two attitudes convey very different strategic and operational approaches for line management. Without an approach to change of this magnitude, organizational potential the effort, support, and conviction expressed at the top.
• 

  Elmari van Deventer March 9, 2011 9:18

  Thanks for the feedback Nagesh, I will respond as requested.
• 

  Nagesh Bharadwaj March 9, 2011 6:32

  Elmari, you are hitting lot of right notes. Now we need to make your risk assessment perform like an orchestra. I want to highlight some of key starting points.
  You mention, Process Level or Strategic risks are not identified. In order to achieve your objective of managing business risks we have to start from the Strategic or Entity level. Do remember your business objective/mission will be the driving force or conductor of the orchestra. If you want to discuss further please write to nagesh@indigostripes.com we can try to understand some of your challenges.
  Best Regards
  Nagesh
• 

  Bryan Whitefield March 8, 2011 21:58

  All good replies.  In addition I believe one of the keys is matching employees to your risk appetite.  Sometimes we need aggressive risk takers and sometimes we need a much more cautious approach depending on what is at stake and where we are in a product/services life cycle.  This will vary across the business and hence we need to vary our teams to suit.  There is no doubt that risk takers are not keen on detailed controls and detailed controls are not good for business units that you want to move swiftly and take significant but well thought out risk.  If you get the mix wrong you have much more chance of underperformance in all the areas you identified in your review.  Get it right and your staff find the way and the time to make it happen.
• 

  Bill Savage March 8, 2011 21:28

  I am working with a financial services client to build out their RCSA program. We are considering including training and employee development as a risk area that will be evaluated as this can be a contributing factor to many other risks (e.g. process execution). Another option that is under consideration is the creation of a "guideline" that would drive some level of standardization around mitigation plans. This would help improve the communication between the risk owners and the other stakeholders of the RCSA process.
• 

  Mike Haubenstock March 8, 2011 21:15

  We are also considering how to strengthen our RCSA process. We are planning more detailed walkthroughs, independent testing of controls by risk managment to feed control effectiveness ratings as part of the process, assuring that procedures are up to date and being followed, examining more thoroughly the internal history of events to assure that root causes are mitigated, demanding a mitigation plan and issuing a report with overall findings and ratings
• 

  John Bruner March 8, 2011 21:05

  I have spent much of my life attempting to make management understand that "control" is all about "Corporate Attitude." If senior management conveys the importance with authority, it will happen. To often, it is a nice to have but not a must have for top management. The two attitudes convey very different strategic and operational approaches for line management. Without an approach to change of this magnitude, organizational potential the effort, support, and conviction expressed at the top.