Category: Risk Solutions

Six key approaches for Boards get a glimpse of operational risk

A Board’s key functions are to provide supervisory guidance for company strategy, manage enterprise risks, hire, manage and fire (if required) the CEO and ensure financial solvency and legislative compliance of an organisation.

For some Board members, it can be hard to find the right balance between providing guidance and getting too involved in day-to-day management.  Particularly for volunteer boards. So how can Boards get a glimpse of operational risk?

Whether your organisation is an aged care provider, a disability services organisation, childcare centre or not-for-profit, these approaches can help you get a glimpse into operational risk.

Receiving consumer feedback

Meeting with and hearing from both staff, clients and their families provide an insight into operations and the broader context in which operational risks exist.  This could be achieved in a number of ways:

• client & family surveys
• staff surveys
• attending organisational functions or events eg. End of year Christmas party
• participating periodically in client and family engagement committees
• visit services

Awareness of critical incidents

Critical incidents can be another indicator of how well operational risks are managed.

De-identified scenarios and their outcomes need to be routinely presented to Board, or via relevant quality or safety sub-committees.  These incidents give a glimpse into the organisational systems and practices in which operational risks occur.

Hearing from senior managers about operational risk in their respective areas

As part of your regular Board agenda, include reports from senior managers on a rotating basis about their respective functional areas.  Actively seek information on their top 3 issues and operational risks.  Having senior managers present rather than just submit a report gives Board members the opportunity to ask questions directly of stream leaders.

Asking about company frameworks and policies

Frameworks, policies and procedures outline the organisation’s approach to managing operations.  Board members should seek information on company frameworks:

• When were the frameworks, policies and procedures last updated?
• What gaps are there in implementation?
• What is the plan to address these gaps and by when?
• What continuous improvement efforts are being considered and how are they governed?

Tip:  Frameworks, policies and procedures for both service delivery and back of house are equally important. Some examples are listed below: Service delivery frameworks New client intake and assessment procedures Clinical/Care Governance Framework and clinical/care specific procedures (eg. Medication management, falls prevention, wound management and preventing pressure injuries) Quality and Safety Framework Corporate frameworks Financial management practices; payroll, procurement, contract management (and fraud prevention) IT & cybersecurity Emergency management and business continuity Human resources related procedures, including Work Health and Safety

Training and on-boarding to help Board members interpret performance data

Skill mix on a board often includes a breadth of board member experience; perhaps a doctor or nurse, an accountant, a lawyer, etc.   It is important that Board members understand both the sector challenges and the day-to-day issues that arise in order to ask good questions about operations.

Performance dashboards are not useful if Board members are not able to interpret and conceptualise data with informed curiosity about performance.

Investing in internal audit

Internal audit is an independent third party, initiated by the Board or Management, who audits your business practices.  Internal audit provides an external perspective on the functioning and compliance of key areas of risk within an organisation. (Such as those in the table above).

Internal audit reports provide recommendations for improvements to your company practice and may make you aware of issues previously unknown to you.

 

Written by:

Stephen Ratcliffe, Senior Risk Consultant – ERM

Australia’s care sectors (aged care, child care, disability services) are all in the midst of major change.  Royal Commissions, system-wide reforms and significant abuse findings have led to legislative changes and greater responsibility and accountability for Boards & Directors of care services.  All these changes create uncertainty, and uncertainty can give rise to strategic risk.

For the care sector, keeping vulnerable people safe, managing significant workforce and financial risks and remaining insurable are key concerns for Boards and Directors.  But how can organisations strengthen their Enterprise Risk Framework to add value and create confidence rather than be a list of ‘stuff’ to be managed?

For the last five years Ansvar’s Risk Solutions team has provided complimentary risk consultancy services for its clients.  Ansvar has identified four key themes to help grow the risk maturity of care organisations: Risk Governance, Risk Processes, Risk Resources and Effective Implementation of risk frameworks. Self-reflection questions are provided for each theme.

 

1) Risk Governance

This refers to the risk structures in the organisation, accountabilities and delegations with respect to risk and the design and implementation of an Enterprise Risk Management Framework.

Consider:

• Is risk management aligned with uncertainties to achieving business strategy?
• Do you have the right skill mix on your Board to govern risks to complex care and safeguarding to prevent abuse?
• Do the structures in your organisation enable information flow to the Board and support informed decision making?
• Has the organisation set a risk appetite for higher-risk decisions such as significant projects, major expenditure or acquisition/sale of assets?
• Does the Board review its Enterprise Risk Management Framework and have a plan for its continuous improvement?

 

2) Risk Processes

A Risk Management Framework is brought to life through risk procedures.  A risk procedure should define how the organisation identifies, assesses and treats risk. As well as how the outcomes of risk assessments should be recorded, reported, monitored and communicated.  It should include reflection on incident management records to provides intelligence about the efficacy of risk controls

Consider:

• Do you have clear processes to help staff understand how to assess a risk?
• Do your risk assessments consider the effectiveness of current controls?
• Does your risk reporting link to measurable data to strengthen the confidence in your risk management activities?
• Does your risk register direct Board attention to the risks that matter most to help prioritise allocation of finite resources?

 

3) Risk Resources

This refers to an organisation’s staffing resources to manage risk, training and capability within the organisation and at Board level and IT systems or practices to support risk reporting and monitoring

Consider:

• Do you have adequate resources and capabilities within the organisation to ensure the Risk Management Framework operates effectively?
• Does Board orientation include information about strategy, enterprise risk management, care governance and the roles and responsibilities of Directors?
• Where capability gaps may exist, do you support training to build the skills and competence required to manage risk?
• Do you have organisation-wide risk management information systems that are integrated and support risk data aggregation and transparent reporting?

 

Effective Implementation

Frameworks and procedures are just a piece of paper if not implemented.  Often failures in risk management are as a result of poorly implemented frameworks or committees not undertaking their full scope of duties per their Terms of Reference.

Consider:

• Have you completed a gap analysis of your Risk Management Framework and Audit and Risk Committee terms of reference to see if all the described duties and practices are actually in place?
• Is there a staged plan to implement any outstanding actions? Is it reviewed regularly at Board?

 

Written by:

Stephen Ratcliffe, Senior Risk Consultant – ERM

 

A Board’s key functions are to provide supervisory guidance for company strategy, manage enterprise risks, hire, manage and fire (if required) the CEO and ensure financial solvency and legislative compliance of an organisation.

For some Board members, it can be hard to find the right balance between providing guidance and getting too involved in day-to-day management. Particularly for volunteer boards. So how can Boards get a glimpse of operational risk?

Here are six approaches you can take to create confidence that you’re receiving all the information you need to make good, defensible decisions as a Board member:

 

Receiving consumer feedback

Meeting with and hearing from both staff, residents and their families provide insight into operations and the broader context in which operational risks exist. This could be achieved in a number of ways:

• resident & family surveys
• staff surveys
• attending a facility function or event eg. Resident Christmas party
• participating periodically in resident engagement committees
• visit aged care sites

 

Awareness of critical incidents

Critical incidents can be another indicator of how well operational risks are managed. De-identified scenarios and their outcomes need to be routinely presented to Board, or via relevant quality or safety sub-committees. These incidents give a glimpse into the organisational systems and practices in which operational risks occur.

Hearing from senior managers about operational risk in their respective areas

As part of your regular Board agenda, include reports from senior managers on a rotating basis about their respective functional areas. Actively seek information on their top 3 issues and operational risks. Having senior managers present rather than just submit a report gives Board members the opportunity to ask questions directly of stream leaders.

 

Asking about company frameworks and policies

Frameworks, policies and procedures outline the organisation’s approach to managing operations.  Board members should seek information on company frameworks:

• When were the frameworks, policies and procedures last updated?
• What gaps are there in implementation?
• What is the plan to address these gaps and by when?
• What continuous improvement efforts are being considered and how are they governed?

 

Tip:  Frameworks, policies and procedures for both service delivery and back-of-house are equally important.   Some examples are listed below: Service delivery frameworks: – New client intake and assessment procedures – Clinical/Care Governance Framework and clinical/care specific procedures (eg. Medication management, falls prevention, wound management and preventing pressure injuries) – Quality and Safety Framework Corporate frameworks: – Financial management practices; payroll, procurement, contract management (and fraud prevention) – IT & cybersecurity, emergency management and business continuity – Human resources-related procedures, including Work Health and Safety

 

Training and onboarding to help Board members interpret performance data

Skill mix on a good aged care board often includes a breadth of board member experience; perhaps a doctor or nurse, an accountant, a lawyer, etc. It is important that Board members understand both the sector challenges and the day-to-day issues that arise in aged care in order to ask good questions about operations.

Performance dashboards are not useful if Board members are not able to interpret and conceptualise data with informed curiosity about performance.

 

Investing in internal audit

Internal audit is an independent third party, initiated by the Board or Management, who audits your business practices. Internal audit provides an external perspective on the functioning and compliance of key areas of risk within an organisation. (Such as those in the table above).

Internal audit reports provide recommendations for improvements to your company practice and may make you aware of issues previously unknown to you.

 

The Risk Solutions team from Ansvar will be in attendance at the ACCPA 2023 National Conference 25-27 October at the Adelaide Convention Centre. Be sure to stop by booth #107 to speak to the team.

 

---

Source: Guest Post: Six Key Approaches for Boards – Inside Aging

 

Written by:

Stephen Ratcliffe, Senior Risk Consultant – ERM

Australia’s aged care sector is in the midst of a seismic shift. System-wide reforms, changed funding models and significant changes in legislative requirements for aged care providers and directors – all of which create uncertainty. Uncertainty can give rise to risk.

For the sector, keeping vulnerable people safe, managing significant workforce and financial risks and remaining insurable are key concerns for Boards and Directors. But how can organisations strengthen their Enterprise Risk Framework to add value and create confidence rather than be a list of ‘stuff’ to be managed?

For the last five years Ansvar’s Risk Solutions team has provided complimentary risk consultancy services for its clients. Working with aged care providers, Ansvar has identified four key themes to help grow the risk maturity of care organisations: Risk Governance, Risk Processes, Risk Resources and Effective Implementation. Self-reflection questions are provided for each theme.

 

1. Risk Governance

This refers to the risk structures in the organisation, accountabilities and delegations with respect to risk and the design and implementation of an Enterprise Risk Management Framework.

Consider:

• • Is risk management aligned with uncertainties to achieving business strategy?
  • Do you have the right skill mix on your Board to govern risks to complex care and safeguarding to prevent abuse?
  • Do the structures in your organisation enable information flow to the Board and support informed decision-making?
  • Has the organisation set a risk appetite for higher-risk decisions such as significant projects, major expenditures or acquisition/sale of assets?
  • Does the Board review its Enterprise Risk Management Framework and have a plan for its continuous improvement?

 

2. Risk Processes

A Risk Management Framework is brought to life through risk procedures. A risk procedure should define how the organisation identifies, assesses and treats risk. As well as how the outcomes of risk assessments should be recorded, reported, monitored and communicated. It should include reflection on incident management records to provide intelligence about the efficacy of risk controls.

Consider:

• • Do you have clear processes to help staff understand how to assess risk?
  • Do your risk assessments consider the effectiveness of current controls?
  • Does your risk reporting link to measurable data to strengthen the confidence in your risk management activities?
  • Does your risk register direct Board attention to the risks that matter most to help prioritise the allocation of finite resources?

3. Risk Resources

This refers to an organisation’s staffing resources to manage risk, training and capability within the organisation and at the Board level and IT systems or practices to support risk reporting and monitoring.

Consider:

• • Do you have adequate resources and capabilities within the organisation to ensure the Risk Management Framework operates effectively?
  • Does Board orientation include information about strategy, enterprise risk management, care governance and the roles and responsibilities of Directors?
  • Where capability gaps may exist, do you support training to build the skills and competence required to manage risk?
  • Do you have organisation-wide risk management information systems that are integrated and support risk data aggregation and transparent reporting?

 

Effective Implementation

Frameworks and procedures are just a piece of paper if not implemented.  Often failures in risk management that we see in the sector are a result of a failure to implement risk frameworks or committees not undertaking their full scope of duties per their Terms of Reference.

Consider:

• Have you completed a gap analysis of your Risk Management Framework and Audit and Risk Committee terms of reference to see if all the described duties and practices are actually in place?
• Is there a staged plan to implement any outstanding actions?  Is it reviewed regularly by the Board?

 

The Risk Solutions team from Ansvar will be in attendance at the ACCPA 2023 National Conference 25-27 October at the Adelaide Convention Centre. Be sure to stop by booth #107 to speak to the team.

 

---

Source: Guest Post: Strengthening your Risk Framework – Inside Aging

 

Written by:

Stephen Ratcliffe, Senior Risk Consultant – ERM

In this guest post, Stephen Ratcliffe, Senior Risk Consultant at Ansvar Insurance, discusses the impact of the Royal Commission on the care sector, and the emergence of third-party companies to assist with compliance.

He looks at the challenges faced in the implementation of policies and the important role of management in developing implementation plans, conducting a gap analysis and regularly engaging with third-party providers to ensure the advice aligns with actual practises, as failure poses substantial risks and liabilities for organisations and leadership.

A series of Royal Commissions, both past and present are bringing significant shifts in the legislative and operational landscapes of care sector organisations – but not everyone is ready for these shifts.

It’s not surprising then that numerous third-party companies have stepped in to assist organisations in meeting the growing burdens of compliance. Ansvar’s observation has been that clients taking up these services are either new businesses or organisations that have fallen behind in maintaining their policies and procedures with contemporary practices.

At face value, third-party support can be a lifeline for organisations, especially if they’ve had staffing vacancies in roles that would usually have responsibility for developing or updating procedures, or establishing organisational frameworks. Perhaps they don’t have the specific expertise to develop frameworks and procedures in-house. Tools and templates are a valuable support for organisations to guide them in the right direction.

Often third-party documents are compliance-based and seek to address sector standards for the purposes of achieving accreditation or referring back to Australian and International Standards to provide a theoretical basis for organisational frameworks. It is worth noting though that compliance sets the minimum standard required in order to operate, it should not be interpreted as evidence of operational excellence.

Where Ansvar is starting to see issues with third-party developed documents is the vast differences in how organisations choose to tailor (or not) these templated policies and frameworks to their organisation.

Our consulting experience with clients suggests very few of the clients with third-party procedures have been able to demonstrate that they actually follow the procedures and policies as they are documented. Sometimes we see policies and procedures are viewed as just a document on the shelf and do not reflect actual practices at all. This creates significant liability risk for organisations.

So much so that the use of third-party templates is beginning to raise red flags rather than provide comfort that policies and procedures are in place. This is not because of the quality of the templates, but rather a significant failure of organisations to bring these templated procedures and frameworks to life.

It is the duty of management teams to ensure that policies, procedures and frameworks are being enacted and the role of boards to hold management to account for doing this.

Here are our 3 top tips when using third-party policy and framework templates:

 

1. Conduct gap analyses against critical organisational frameworks

• • Are the policies and procedures detailed enough?
  • Do they reflect actual practice in the organisation? How do you know?
  • Do the committee structures and reporting requirements in the frameworks occur
    as described?

Assess your practice against your policies and frameworks for these high-priority areas:

• • Governance documents (Board Charter, Delegations of Authority, Board-Sub Committee Terms of Reference.
  • Enterprise Risk Management Framework – including methods used to identify risk and the practical steps used to assess risk and develop risk controls.
  • Financial management plans and critical controls – including fraud prevention, procurement, and contract management.
  • Quality and Improvement Framework.
  • Work Health and Safety policies and procedures, including Return to Work.
  • Clinical Governance Frameworks.
  • Safeguarding to prevent abuse – policies, procedures, related training, recruitment practices, and Code of Conduct.

2. Develop Implementation plans for critical organisational frameworks

• • Do you have clearly defined plans to establish the priorities for policy and procedure?
  • Implementation and focus the organisation on what matters most?
  • Are you reporting periodically to the Board on the progress of implementation plans?
  • Is management held to account to ensure delivery?

3. Engage regularly with your third-party provider

• • Do you ensure your policies and procedures are regularly updated (by you) and reflect current practices at your organisation?
  • Do you ensure that you have the capacity to make edits or modifications to your policies and procedures independently when you need to? (as opposed to relying on the provider to make changes or edits)

Key point summary

• • Third-party providers can offer vital support to organisations with templated policies,
  • procedures and frameworks.
  • Policies and procedures are only useful when they are effectively implemented.
  • Organisations are responsible for ensuring that policies and procedures accurately reflect practice.
  • Failure to implement critical organisational frameworks can give rise to risk for organisations, and individual liability for executives and board directors.

 

The Risk Solutions team from Ansvar will be in attendance at the ACCPA 2023 National Conference 25-27 October at the Adelaide Convention Centre. Be sure to stop by booth #107 to speak to the team.

 

---

 

Source: Are you templating or tailoring your organisational frameworks, policies and procedures? – Inside Ageing

 

Written by:

Stephen Ratcliffe, Senior Risk Consultant – ERM

To be successful in business means to have a purposeful and confident attitude to the future – whether that be to continue to serve vulnerable people, to remain insurable and to be resilient. But this doesn’t just happen automatically.

The key is to take a consistent and effective way to managing risk across the whole business – that’s what is known as Enterprise Risk Management (ERM).

Over the last 18 months, Ansvar has conducted Risk Health Checks and deeper dive Risk Maturity Quality Reviews for our clients across Australia. These equip boards, CEOs and senior managers with information on the effectiveness and capability of their risk frameworks, the suitability of their current approach, and opportunities for improvement.

Regardless of the type of sector you’re in, our reviews routinely found that audits against governance standards under the respective legislative frameworks were not picking up key gaps in enterprise risk management.  Relying upon being accredited can create a false sense of security and may place clients at governance and insurability risk if relied upon for assurance.

Through our work with clients, we have identified six common gaps in risk management frameworks. By focusing on these areas of concern, clients can make a significant difference to their operational performance.

 

Gap 1:  Risk frameworks not aligned to strategy

At its heart, ERM is about helping you achieve your objectives. Your framework should be assisting you to identify key risks to your strategy and the actions required to manage them. By managing these risks, you are more likely to improve performance, reduce harms and focus on what really matters to the community you serve.

 

Gap 2: Risk register is full of issues rather than emerging risks and opportunities

Too often we encounter risk registers that are in fact a list of issues or known problems. Addressing current business problems is still necessary but you might miss emerging risks or opportunities coming over the horizon. Nobody likes being caught off-guard and unprepared. Does your risk register help you make decisions about the future? It should.

 

Gap 3: Risks controls not adequately analysed 

Risk is dynamic and can change over time. It is important to periodically assess how well your risk controls work and to identify the ‘key controls’ (the ones that make the most difference) as these require higher priority focus. As people, processes and systems change, some controls may no longer be effective. For example, in home-based services, using a traditional system you may not know if a staff member attended their job until you receive a complaint, but by incorporating real-time software into your systems, you can be notified immediately if a staff member doesn’t sign in.

 

Gap 4: Overlooking the big risks

There are five big risks that should be on the radar of all clients:

• workforce (access to, attraction, retention, capability)
• governance (including care governance, where relevant)
• safeguarding to prevent abuse
• changing consumer-focused models of care
• financial sustainability

 

Gap 5:  Lack of clarity with board structures and roles in ERM

Having a clear structure to govern the risk framework and having the appropriate capabilities and level of curiosity to monitor risks are critical facets of a successful business. Board committee and sub-committee charters are often too vague when it comes to clear roles and accountabilities with risk management and too focused on leaving it to ‘the Audit and Risk Committee’.

 

Gap 6:  Risk culture is left off the agenda

Humans manage risk, yet so much of the risk consideration focuses on processes, spreadsheets and heat maps. The risk framework must support a positive risk culture, whereby awareness, attitudes and accountabilities regarding risk management are aligned. When is the last time you assessed your organisation’s culture for its influence on ERM?

 

 

---

Written by:

Stephen Ratcliffe, Senior Risk Consultant – ERM

Case based scenarios for Boards and Executives:

Could this happen to your organisation?

 

A Case Study:  Third party risk using labour hire companies

A disability services organisation (DSO) was supporting a participant with autism, including a history of violent behaviour with known triggers. The participant resides in a property which is designed to manage participants with potential violent behaviours. There is a safe room with a duress alarms setup at the property. The participant had a detailed care plan for care workers to prevent triggering the participant’s behaviour.

Casual workers were sent to the care home from a labour hire company.  The DSO was responsible for training and staff allocation to homes under the labour hire agreement.  Procedures were not followed, resulting in an escalation of the participant’s behaviour and a serious physical assault of a care worker, who was unable to reach the safe room.

 

Critical considerations:

• Do your high risk clients have detailed care plans designed to manage the participant’s specific medical or behavioural requirements?
• How do you ensure that the care plan is followed and understood?
• Has the physical environment been assessed as suitable for that client, based on their requirements?
• Are your emergency/duress alarms easily locatable and regularly tested?
• How do you ensure the appropriate staffing skill mix when allocating rosters to high-risk homes?
• Have staff received site-specific orientation training for high risk homes?
• How do you reinforce good practice?
• Are there clear procedures on how to respond if a client’s behaviours or medical condition deteriorates?
• What are the supervision arrangements of contractors?
• Does your labour hire agreement define responsibilities for all of the above?

 

Note.  While this case study describes participant violence, these questions apply to other scenarios (eg. clients with high medical needs, clients putting things in their mouth and choking, inappropriate sexual behaviours towards other participants or staff).

 

---

This scenario is fictitious. The scenario may represent circumstances experienced by disability service organisations, participants or care workers. Any similarity to actual events or persons, is purely coincidental.

 

Written by:

Stephen Ratcliffe, Senior Risk Consultant – ERM

Are current approaches to risk up to the task? A leading specialist provider of insurance and risk management solutions explains why organisations may be asking themselves the wrong questions

 

Tasmania is holding a commission of inquiry into child sexual abuse at its institutions. The hearings conclude in August and are the latest investigation in Australia of the sexual abuse of children, the aged or other vulnerable people. The last decade has seen three Commonwealth Royal Commissions, numerous parliamentary inquiries and increasing numbers of court cases.

“The findings have been explosive in terms of human rights violations,” said Hetty Johnston, founder of Bravehearts Foundation and a leading child protection advocate. “These are the reasons that Australian governments, state and federal, are responding so forcefully and rapidly with increased legislation, regulation and oversight,” she said in an Ansvar Insurance news release.

Source:
Risk management to stop sexual abuse at institutions | Insurance Business Australia (insurancebusinessmag.com)

Australians want our aged care sector to thrive. A sustainable, effective, professional, well-run industry means older Australians benefit from quality care – something we may all need, someday.

To be successful in business means to have a purposeful and confident attitude to the future, in order to continue to serve the vulnerable, to remain insurable and to be resilient. But this doesn’t just happen automatically.

The key is to take a consistent and effective way to managing risk across the whole business – that’s what is known as Enterprise Risk Management (ERM).

Over the last 18 months, Ansvar has conducted Risk Health Checks and deeper dive Risk Maturity Quality Reviews for aged care providers across Australia. These equip boards, CEOs and senior managers with information on the effectiveness and capability of their risk frameworks, the suitability of their current approach, and opportunities for improvement.

Our reviews routinely find Standard 8 audit assessments are not picking up key gaps in enterprise risk management, which can place providers at governance and insurability risk if relied upon for assurance.

Through our work with aged care providers, we have identified six common gaps in risk management frameworks. By focusing on these areas of concern, providers can make a significant difference to their operational performance.

 

Gap 1:  Risk frameworks not aligned to strategy

At its heart, ERM is about helping you achieve your objectives. Your framework should be assisting you to identify key risks to your strategy and the actions required to manage them. By managing these risks, you are more likely to improve performance, reduce harms and focus on what really matters to the community you serve.

 

Gap 2: Risk register is full of issues rather than emerging risks and opportunities

Too often we encounter risk registers that are in fact a list of issues or known problems. Addressing current business problems is still necessary but you might miss emerging risks or opportunities coming over the horizon. Nobody likes being caught off-guard and unprepared. Does your risk register help you make decisions about the future? It should.

 

Gap 3: Risks controls not adequately analysed 

Risk is dynamic and can change over time. It is important to periodically assess how well your risk controls work and to identify the ‘key controls’ (the ones that make the most difference) as these require higher priority focus. As people, processes and systems change, some controls may no longer be effective. For example, in home care, using a traditional system you may not know if a staff member attended their job, until you receive a complaint, but by incorporating real-time software into your systems, you can be notified immediately if a staff member doesn’t sign in.

 

Gap 4: Overlooking the big risks

There are five big risks that should be on the radar of all aged care providers:

• workforce
• governance, including clinical governance
• safeguarding from abuse
• consumer-focused models of care
• financial sustainability.

 

Gap 5:  Lack of clarity with board structures and roles in ERM

Having a clear structure to govern the risk framework and having the appropriate capabilities and level of curiosity to monitor risks are critical facets of a successful business. Board committee and sub-committee charters are often too vague when it comes to clear roles and accountabilities with risk management and too focused on leaving it to ‘the Audit and Risk Committee’.

 

Gap 6:  Risk culture is left off the agenda

Humans manage risk, yet so much of the risk consideration focuses on processes, spreadsheets and heat maps. The risk framework must support a positive risk culture, whereby awareness, attitudes and accountabilities regarding risk management are aligned. When is the last time you assessed your organisation’s culture for its influence on ERM?

 

---

 

Stephen Ratcliffe, Senior Enterprise Risk Management Consultant at Ansvar Insurance