09 Jan Risk: A Primer for Innovation
Risk management tends to get a bad rap. It is often associated with regulatory compliance, red tape, and legal restrictions and viewed as a required step that slows progress and inhibits creativity.
Unlike risk, innovation tends to be associated with words like “modern,” “digital,” “progressive,” and “creative.” Based on these perceptions alone, it is easy to see why innovation draws more attention and excitement than risk management. It would also be easy to overlook the complementary aspects of risk and innovation.
Where People Get It Wrong
I spent the last two years establishing and implementing risk programs alongside the authors of the updated 2017 COSO Enterprise Risk Management (ERM) Framework. The framework advocates for risk programs that are:
– Integrated with strategic planning, performance management, and execution.
– Designed for holistic communication, sharing information from the top-down, bottom-up, and across the organization.
– Employee-centric and focused on building and maintaining a culture of risk awareness and transparency.
Programs with these attributes tend to unlock the potential for innovation by fostering an organization that is systematically aware of the risks it faces, understands the strategies to mitigate these risks over time, and is empowered to be agile in pursuit of greater performance. Contrary to traditional perspectives, these risk programs do not actually cultivate a more conservative, risk-averse, static business. Put simply: They harness risk as a competitive advantage to empower and fuel innovation.
Here’s a great example. I recently participated in an Innovation Launchpad that Navigate facilitated with a regional credit union. The credit union was seeking to enable more innovation to remain relevant with a changing consumer base and increase its future performance and sustainability. What you may find unique is that this workshop was initiated by the organization’s Chief Risk Officer (CRO).
The CRO and the executive team shared the perspective that risk and innovation need to be looked at with a broader lens. Innovation can be a mitigation against strategic, customer loyalty, brand reputation, and revenue-generation risks. But innovation also introduces risk to an organization. New ideas, processes, or technologies create uncertainty and performance variability, which should be understood and accepted or managed. This organization certainly had a nuanced understanding and position on risk and performance.
Through supporting this effort, I recognized numerous similarities and complements between transformative risk and innovation efforts, some of which are outlined below.
|Executive Alignment & Sponsorship||With any transformative or enterprise-wide initiative, executive leadership needs to be aligned about the purpose, objectives, and guiding principles for the effort. In both cases, senior leadership needs to answer the question, “What does this mean for our organization?”
The scope should also be defined. Either initiative could focus solely within a single business unit or function or could span the entire enterprise.
Finally, it is critical for senior leadership to establish “tone-at-the-top,” which will increase buy-in and participation throughout the organization, as well as support change management.
Training, Communication, & Change Management
|What risks are relevant?|
Will it backfire if I raise a risk?
How can I participate?
Why is this important?
Risk assessments are sometimes viewed as unnecessary steps that slow down a process. In other cases, employees are aware of risks, but they don’t feel comfortable communicating and escalating them to leadership. Assessments can also feel like “gotcha” exercises that are meant to identify and punish wrongdoing.
|What exactly is innovation?
Will this put me out of a job?
How can I participate?
Why is this important?
Innovation can be exciting, frightening, and confusing to employees. It can present opportunities to leverage new ideas and technologies, but it also creates change, and that can generate concern over shifting roles and responsibilities.
|In both cases, it is important to for employees and management to understand the value proposition of the effort – why should they participate? Then, training and communication will support participation and manage change as new processes and decisions are implemented.|
|Process||New processes will need to be established to support either initiative, including the collection of data, analysis, and reporting. These processes should be integrated with existing business processes and operational cycles where possible. Where they do need to be entirely new processes, they will require training and communication upon roll out.|
|Technology||Technology can be the subject of risk assessments, such as cybersecurity. It is important when assessing technical risks to determine the impact to the business and communicate risks in layman’s terms, so they can be incorporated in broader business decisions.||Innovation tends to focus on tech-related products and services, such as apps, websites, and devices. However, innovation does not need to be tech-focused. Innovation can occur in any function and can involve people, processes, or customer interactions.|
|In both cases, an internal technology may support the collection, aggregation, analysis, and reporting of data, such as (a) identified risks, or (b) innovative ideas and suggestions. But, technology should not necessarily drive the design, lest it constrain adaptability to business needs early in the process.|
|Governance||Both initiatives require some form of governance to support the process. The formation of a risk committee or an innovation council will help review aggregated information and develop recommendations for executive leadership. In turn, leadership will need to review recommendations and make decisions about (a) Which risks to accept, pursue, or mitigate or (b) Which innovative concepts to pursue and implement. An integrated committee would have purview over both risks and innovation, offering a balanced perspective on growth, performance, and risk.|
Ultimately, it is important for either a risk management or innovation initiative to be tailored to the individual needs, objectives, and culture of an organization. Executive leaders should begin by determining what value they are hoping to generate and right-size the program scope accordingly. Either initiative can be an enterprise-wide transformation or a pilot within a specific group or function.
In combination, an organization with strong risk management and innovation efforts can balance driving progress, creativity, and technological advances while navigating between strategic, reputational, financial, regulatory, and operational risks. These efforts can help you build for the future, be resilient towards uncertainty, preserve your core business, and generate lasting value. Contact me at [email protected]tecorp.com or 610-724-0338 to discuss the role of risk management as you seek innovation in 2019.