Let’s start with a question…
What do you suppose is one of the most fundamental tasks found throughout the entire ERM cycle?
If you answered gathering information, then you would be correct!
Gathering information is especially important in the risk identification and risk assessment phases, but I would even go as far to say that it forms the foundation of ERM, at least partially.
Without it, ERM really would be a “voodoo exercise based on Tarot cards” as one fierce critic is fond of saying.
Now there are all sorts of ways to gather information for the purpose of understanding risk.
You’ve got one-on-one interviews, workshops, root cause analysis, and even plain old research.
One other widely used approach we want to focus on today is the survey, which can be used in a multitude of ways, including:
1. Gather risk information from a large group of dispersed people
This is, by far, the most common way surveys are used. If there are many individuals involved, especially dispersed over a large geographical area or organization departments, the survey is the most effective, most practical way to gather risk information.
Tools like Survey Monkey or Google forms enable you to send something out to a large number of individuals quickly. Many ERM software systems even have survey functionality built within the system.
2. Large but more targeted groups
Another way surveys are used, especially for risk assessments, is to send them to a large group with risks (and related objective!) listed out. You can then ask participants to assess the risk, provide data or explanations to support the assessment, and even provide supporting information.
Doing this with a generic tool like Survey Monkey is doable, but it can get a little cumbersome. Surveys within ERM systems help address some, but not all, of the common challenges of surveys.
3. Note taking during one-on-one interviews or even workshops
If you’re speaking one-on-one with people in your company, you will need a way to capture what they’re saying. One way to do this is to load your questions into a survey tool and then essentially answer the survey on their behalf during the interview by answering their name first, then capturing each response into the answer field for each question.
In popular tools like Survey Monkey, you could literally have a page for each topic with multiple questions. As people answer each question, you can fill in their answer(s) there.
Regardless of your reasons for using a survey to gather risk information, and the approach you ultimately take, there are some best practices you need to adhere to.
Now this may seem to contradict previous advice where I’ve warned of the perils of strictly adhering to best practices.
While agility and customization are important from a high-level program perspective, there are situations where best practices should be followed to ensure a good outcome.
Like risk reporting, when it comes to surveys, there’s one principle to keep in mind. Begin with the end in mind.
As Stephen Covey explains in his book 7 Habits of Highly Effective People:
“To begin with the end in mind means to start with a clear understanding of your destination. It means to know where you’re going so that you better understand where you are now and so that the steps you take are always in the right direction.”
Although Covey’s advice is directed to us as individuals, he readily admits that “…applies to many different circumstances and levels of life.”
Sooo…
When it comes to conducting surveys, the first, and most important step I would argue, is to clearly understand what risk information your leadership needs and how you will use the survey to gather it.
This is vitally important because, as we discuss in a previous article on structuring risk assessment questions, it can mean the difference between obtaining valuable insights and obtaining useless fluff.
Once this overall purpose of your survey is nailed down, some other best practices include:
- Keep the number of questions on the smaller side – people rarely have time in today’s business world to complete a 40-minute survey. You don’t want participants just scribbling things down in a hurry. Hurried answers, which will be incomplete or outright wrong, might actually be worse than no response at all.
- Do a test run (…or run a pilot) – grab someone who will NOT be taking your survey officially to go through and verify that both the questions themselves and how they’re arranged makes sense. Before you agree to this, you must be open to both listening to their feedback and taking the appropriate action based on their feedback. (Of course, sometimes the appropriate action is nothing, but that’s a different topic for another day.)
- Tailor questions to the audience – if you’re soliciting information from senior leadership, for example, questions should be kept at a high level and focused on what they want to achieve*. If you’re looking for a deeper level of information, then naturally the questions and list of survey respondents should reflect that need. It is also possible that you will need multiple perspectives around the same topic; in that case, you will need to develop two separate questionnaires.
(*Whatever you do, do NOT ask an executive any ERM detailed process or risk specific technical questions.)
- Have some variety in your questions and answers – is the particular question better suited for a long answer in the form of a paragraph, a yes/no or multiple choice dropdown, or some kind of 1-5 ranking? It is possible, and even highly recommended in some cases, to have a mix of these within one survey, as it helps people think about topics differently. But change just for the sake of change isn’t the way to go. Choose the answer type with purpose and intention.
- Refrain from leading the participant on – it is possible for questions to be asked in a way that leads someone to a specific conclusion. Remember, the point is to obtain unvarnished, honest insights about risk. To do this, it is your responsibility to eliminate bias as much as possible and obtain “pure” answers to your questions.
Besides these best practices aimed at ensuring you get the richest insights possible from using surveys, there are situations where they should be avoided, especially…
- If you don’t have definitive questions.
- If you anticipate the need of an in-depth conversation on the topic.
- If the topic is somewhat unknown and requires some education or a subject-matter expert.
- If there’s no way to standardize the analysis of the output.
- If you want to ensure the questions are really being answered on a consistent basis
- If you feel like the respondents need some guidance around how to think about a specific question or would do better with having someone available to ask questions in the moment.
Absent these constraints, and assuming the best practices mentioned earlier are followed, surveys can be a great way for obtaining valuable insights into the state of risk to strategy and operations.
Does your company use surveys or a combination of other methods to gather risk information?
We’re interested in hearing your thoughts and anything you can share with us. Feel free to leave a comment below or join the conversation on LinkedIn.
If you’re struggling to find a way to gather risk information that works for your company’s specific needs and culture, please reach out to me to discuss your current situation.
