Risk managers must become ‘sophisticated communicators’

A top risk professional will know their organisation’s annual report and accounts like the back of their hand. They make it a firm goal to get close to the strategic objectives and stakeholder requirements of their business. This strategy makes it more likely that they will have the ear of the board and be a valued contributor at the most senior levels.

Sadly, I know of some risk managers who do not read reports or accounts, so they are not going to be aligned with the strategies of their organisations and how they are publicly articulated. This all suggests that risk managers need to ask themselves if they are sophisticated enough communicators to be heard and engaged by the board. 

To be a truly sophisticated communicator, you need to keep three issues front of mind. Firstly, my experience of boards and executive directors is that they have very short attention spans. So, unless you have said something to grab their attention in the first minute or half-page, you might well have lost them already.

Secondly, there is always the temptation for risk managers to use senior audiences to prove their skills at risk management. Actually, the board is trying to run a business. So, unless you are talking the language of the business, then you could easily be perceived as raising something complicated to do with compliance and being more of a brake than an accelerator when it comes to the strategic objectives of the business

The third issue arises when risk dialogue is centred on operational, rather than strategic, risk. While operational risk is clearly important, it tends to focus on potential failure and assumes that the business model is valid and static. Of real strategic value to a board is a risk manager’s capability for ‘horizon scanning’. So, providing facts, data and analysis to answer the big question, “what are the big threats and opportunities for our business?”.

Unrivalled access
Being a sophisticated communicator is more about listening than talking. Risk managers often have unrivalled access to all corners of their business, so it is how they use this freedom that really counts. One of the challenges that risk managers can face is the mistaken belief they still have to prove their value as a subject matter expert and, at its extreme, some end up sounding like a risk management textbook. And that’s hard to listen to!

From a strategic perspective, risk managers are an invaluable set of eyes and ears to senior leaders. If your sole aim is to keep the risk register up to date, then you are unnecessarily blinkering your view and potential value. The risk register is still important, but the board is really asking “in one sentence, what do I need to know?”.

There must be a balance between theoretical and technical competence of managing and measuring risk, and using this knowledge and information to influence strategic decision making. The risk manager’s toolbox is probably something to keep in the risk department. What you are really trying to do is turn what you learn into a relevant and strategic conversation with stakeholders involved in the business.

The acid test for any risk manager is to be able answer the “so what?” question. In other words, what is actually in it for the board? Success in this area reinforces the risk manager as someone who is driving the success and resilience of the organisation. If a risk manager fails to consider or address this then they may be pigeonholed, along with their function, as an important but rather technical resource, misunderstood and confused with other governance functions such as compliance and audit.

Become obsessed
So, how can you become a more sophisticated communicator? Firstly, learn everything there is to learn about the company you work for. Become absolutely obsessed with understanding what each function does and how it does it. Understand what the organisation is trying to do and then think deeply about the relevant opportunities and risks.

Risk managers are in a unique position that allows them to travel around the whole organisation and trading environment, but they must remind themselves that they are not just testing the strength of processes and procedures or providing a pre-audit service. Risk managers must perform more of a support function for the business and continually horizon scan on its behalf.

When your mind-set changes from “what’s the worst that can happen?” to “how can we improve this result?”, risk and opportunity become two sides of the same coin. And, consequently, you increase your strategic value and relevance to your business and its leadership.