Many risk professionals, including myself, have come to appreciate (after years of experience) that ERM is more than a science…or a set standard or process that must be followed at all costs.
There certainly is a time and place for these formal processes.
But like cooking, there’s also an art to ERM, especially when it comes to reporting and communications.
Formal reports that present data should be considered the ‘science’ part, while communications with business leaders and stakeholders is the ‘art.’ It’s impossible to have one without the other.
What has happened in past years though is risk reporting has been viewed as another stop in the process or cycle of ERM. You have risk identification, assessment, analysis, monitoring, then at some point, reporting.
This made sense 10+ years ago when ERM was really considered by most as a tool for minimizing risks and preventing failure. However, the demands and uncertainty of today’s business environment require ERM to be more agile than a formal process allows.
For reporting, this means creating documents, sometimes simply for the sake of saying it has been done. I only use that phrase because these reports simply repeat back what executives, the Board, and other stakeholders already know, if they even look at them at all.
But as I discuss in this previous article, practitioners are comfortable with creating reports and that’s the extent of it.
While dashboards, slide decks, and other parts of a report can be visually robust, data rich, and prompt some discussion, it’s communication throughout the entire ERM and decision-making process that really makes the difference.
Instead of a once- or twice-a-year conversation, which is next to useless in today’s business environment, regular communications – emails, phone calls, hallway conversations, or scheduled Zoom calls – between the business leaders and ERM can help the ERM function stay top-of-mind when it comes to the risks, opportunities, and action plans of business and strategic objectives.
Taking a more personable approach will certainly be less intimidating, which is what you want if ERM is going to play an active role in the company’s decision-making.
These more personable communications can occur at different points or intervals, such as:
- When a milestone of an objective is reached, ERM can provide a quick (emphasis on quick) status update on risk(s), which can include insights on whether more risk can be taken in pursuit of the goal.
- At different points in the ERM cycle, ERM should tell the business what and to expect next and when they should expect it.
- Every 2 months or so, a casual 1×1 conversation to see how the business leader is doing, how their business function is going – any challenges, big accomplishments, changes, plans for the next 3-6 months, etc.
These communication points don’t have to be formal. Informal conversation is good too, but know that you can include visuals when it makes sense (not for #3 above).
These touch bases don’t need to take very long and can be as simple as saying, ‘Hey, are you available for a few minutes to talk about…?” Then make sure to keep it to a few minutes, not 30 minutes.
It’s important to not be overly optimistic on time frames of when you’ll return with an update. We tend to be more aggressive in our planning than our execution, so refrain from overcommitting. It is better to do what you say you will do than continuously miss deadlines; fulfilling expectations builds trust between the business and ERM.
It will take time to get communications and reporting dialed in to the right frequency and content.
Effective ERM, including reporting and communications, is like a chemistry class – it’s going to take some trial and error to get things right.
Baby steps are important when it comes to working with the business – you don’t want to overwhelm executives and business representatives. Sending 10-15 calendar invites out all at once will overwhelm them, and besides, scheduling that many meetings will also make risk communications appear more formalized when a quick ‘stick your head in the door’ will do.
Personalities are an important factor to consider as well. You will need to be adaptable in how you communicate and interact with the stakeholder. Perhaps they’re the type who prefers a prescheduled meeting over something more spontaneous. Or they prefer verbal communications followed up with a written email instead of verbal only.
Understanding different personality traits and knowing how to respond is one of those skills you will need to develop. In fact, I would argue that soft skills likes this are some of the most important to have.
You may have one director who is especially blunt, but he has deep institutional knowledge and understands all the interconnections in the company. While you may have to manage this person carefully, once you have a good rapport or relationship, he will talk to you just about anything.
But then you have another leader who’s very laid back and okay with you just ‘dropping by’ their office with little to no notice.
These soft skills are at the heart of effective communication or rather that ‘art’ side of the coin. There will certainly always be a need for reports to share data and other insights, making it the ‘science’ side of the coin. Good ERM practices at any company, regardless of size, complexity, or industry, combine both sides of these coins for optimal outcomes.
As Leonardo da Vinci is credited as saying, “To develop a complete mind: study the science of art; study the art of science.”
How does your company handle ERM reporting and communications throughout the year?
Please don’t hesitate to join the conversation on LinkedIn to share your thoughts.
If you would like to move from just preparing reports (science) to include more communication (art) to provide timely insights to decision-makers, please reach out to me to start that discussion.
