Strategy For Funding Risk Management Departments

Organizations want risk managers to focus on reducing costs of doing business, especially the regulatory costs. However, when risk managers ask for resources and budgets for running the department, they have to compromise. Lack of budget is generally the main cause for not implementing enterprise risk management, doing strategic risk management, building a risk management culture and providing consulting.

Generally, the budgeting process starts in the last quarter of the year. When the budget committee is approving other revenue earning departments budgets, risk management department heads present a cost budget. This does not go down well with the budget approval committee. They cut ten to thirty per cent of the budget despite risk managers giving valid justifications.

After budget approval, risk managers spend the year trying to squeeze in as much as they can. Sometimes it results in limited coverage and high stress levels for risk managers. With the increasing focus on risk management, the heads of risk management departments need to form a strategy to obtain the required funding. Look at the tips below to navigate the tricky budget approval process.

1. Start at beginning of current year

Start preparing for next year at the beginning of the current year. Identify the long-term and short-term projects. Commence influencing the key stakeholders of the long-term projects from the first quarter of the current year. If risk managers are the last one to submit their budget, they are unlikely to get heard.

2. Analyse the reasons for past failures

Assess the reasons for non-approval of the budget in previous years. Was it because the management thinks risk management is unimportant, is concerned about costs or it harms the interests of the key political players in the organization. After determining the reason, formulate strategies to change the mind-set for next year’s project approval.

3. Build relationships with key political players

Chances are that risk managers focus on the budget committee members for approval. Instead, identify the key power holders within the organization. Identify their relationships with the budget committee members. Before influencing the budget committee members, build relationships with key power holders. Get their support for the risk management function by understanding their drivers and motives.

4. Participate in business strategy formation

Involve yourself with the business strategy group. Identify various risks of the changes in business strategy and recommend the mitigation costs for the same. Attempt to incorporate the risk management budget in the strategy implementation costs. Align risk management budget with corporate goals and strategy.

5. Calculate the Return on Investment (ROI) for various projects.

Robert Biskup wrote an excellent article on Corporate Compliance Insights – “Making the Bottom Line Case for Compliance: The ROI of a Robust Compliance Department”. The nine points give superb ways of calculating ROI. Use the methods to negotiate with the business teams as the department can give a clear demonstration of cost savings or profit earnings. Do ROI calculations for previous years’ projects to demonstrate the value that risk management departments brought to the table.

6. Make business teams bear the cost of the project

For the projects, identify the stakeholders in the business teams. Categorize the projects as critical, necessary and optional from risk management perspective. Sometimes, risk managers spend time doing optional projects at the expense of critical projects, as they cannot refuse powerful business heads. In such cases, present the advantages of getting the assignment done. If possible, check whether business team will merge the cost of desirable projects in its budget next year rather than have it in risk management budget.

7. Build flexibility in budgets

The budgets go haywire when unexpected risks arise or regulations change. Suddenly risk management departments are in fire fighting mode and regular work is ignored. That is bad for business, since other critical risks remain un-monitored. Hence, estimate different cost budgets with probability of various risks and disasters occurring. Present these as contingency budgets to the management and take advance approval for the same. Risk mitigation efforts are delayed when risk managers take approval after a disaster has occurred. Revise the budgets quarterly as the business budget changes.

Closing thoughts

 Generally, risk managers have a financial background so they are outstanding at preparing the budgets. However, problem occurs when they do not have the negotiation skills and political strategy in place. Last quarter efforts do not work because everyone is on the same bandwagon. Gain a head start by starting in the first quarter itself. Be the first one to get the required approvals, so that the function gets what it wants.

Related article: Political Strategy for Risk Management

 

Political Strategy For Risk Management

A recent report published on Harvard Law School blog stated that in 81.2% of manufacturing and 73.6% of the non-financial sector companies have not appointed Chief Risk Officers (CRO). Interestingly, 83.3% of the financial services organizations have appointed a CRO with direct reporting to the CEO. This indicates, that unless mandatory, the risk managers do not have high visibility. Though their role is important in all sectors, they are unable to leverage themselves among the senior management. This issue is not new, and most complain at not getting a seat at the table.

 1.     Develop Political Skills

We need to look this issue from another lens. We need to develop a political strategy for the risk management department. Reason being, technical expertise on a subject takes one up only to the senior middle-management level. At senior management level organization politics dominates decision-making. Hence, risk managers need to develop political skills and astuteness to survive and thrive at that level.

However, the challenge is that though risk management job requires high political skills, very few work at developing them. According to an organizational study, ~ 65-80% employees avoid politics, ~15-25% indulge in negative politics and ~5-10% participate in positive politics.  Risk managers need to develop skills in positive politics to influence senior management.

The positive politics players have win-win, ethical, organization focus, enlightened self-interest, collaborative and best interests of the business mindset. Indulging in negative politics will be harmful as the group has  win-lose, non-ethical, upward focus, self-interest, competitive and personal gain mind-set. Viewing politics as dirty and avoiding it, isn’t an option. Politics prevails in organization DNA and one has to choose how to play it.

 2.     Implement a Political Strategy

Another aspect to look into is that risk managers have to influence the organization to build a risk culture. The concerns of the junior managers differ from those of middle managers and senior managers. Moreover, different business units have clashing interests and priorities. Stumbling from one person to the other and trying to influence them on a random basis will not benefit the organization or the department. Therefore, to influence each sub-group positively, risk management departments need a political strategy.

After developing the political strategy, risk managers need to implement and run with it consistently over time to reap success. It will involve getting supporters, appointing campaign managers, forming coalitions and doing some secret handshakes. Risk managers of course have to walk a fine line of maintaining independence and objectivity while implementing the political strategy.

 Closing Thoughts

Success in organizations depends on how well a person manages their own expectations by understanding the political game. Corporate world is a jungle. One cannot expect that people will make rational and logical decisions in the best interest of the organization. Risk managers will remain on the side lines unless they learn to trapeze the political web. The good news is one can learn political skills.

References:

  1. Risks in the Boardroom – Harvard Law School
  2. Investigations in Organizational Politics

Risk Managers – Tone Down That Report!

This week three renowned figures – Angelina Jolie, Larry Page and Christine Quinn – disclosed their medical problems to the world. They discussed battle with breast cancer, paralysis of vocal cords, and struggles with bulimia and alcoholism. Jolie, a woman famous for her beauty bared her mastectomy details. They talked about fear of death and handicap, and frailty of human character. They risked high-profile careers by being candid. One word describes their actions – Courage.

However, the corporate world wants to hide behind lies and window dress their weaknesses. The corporate leaders sometimes threaten risk managers and auditors to tone down their reports. The messengers of bad news get shot. Risk managers face bullying, retaliation and threat to their jobs for showing courage to speak the truth. If they refuse to bow down to pressure, the business teams label them as politically dumb or difficult to deal with. Question is – should risk managers tone down their reports to please the business teams?

I want to discuss a couple of scenarios here and you decide the course of action.

Scenario 1- Don’t report correct facts to avoid giving bad news

Let us say, you are a CXO of an organization. You have a heart problem and visit a doctor who is a good friend of yours.

The doctor realizes your heart condition is bad. You require a heart surgery for four bypasses. The doctor doesn’t want to deliver the bad news to you, because he doesn’t wish to hurt your feelings.

The doctor tells you  – “You just have too much stress. You need a vacation to relax and have some fun.” He prescribes you some vitamins and discharges you.

You follow your doctor’s advice, take a vacation. You swim and jog for a couple of days and have a heart attack. You arrive at the hospital with a survival chance of 5%.

Did the doctor do the right thing by not telling you the truth?

Scenario 2 : Don’t report correctly to protect a friend

A civil engineer responsible for doing quality and inspection checks of a bridge notices that sub-standard quality of material is used. There is a high risk of bridge collapsing. However, he issues a clean report to his seniors because the engineer-in-charge of the bridge is a friend of his.

An organisation’s senior managers drive daily across the bridge to reach their office. One day all of them are on the bridge and it collapses. All die.

Would the families of the senior managers be happy with the quality control engineer’s for not disclosing the risks?

My guess is most of the corporate readers would have answered no. You would have preferred the truth when it is a question of your own life being at risk.

Corporate Scenario

So why don’t corporate citizens hesitate when they put other people’s life at risk. See the Bangladesh factory fire, Japan’s nuclear disaster or US banks home foreclosure and mortgage mess. Employees, customers and public lives or life savings were put at risk.

Wouldn’t a few honest risk management reports helped in fixing the problem in time to prevent the disasters?

The corporate world maintains double standards on reporting risks. They want full disclosure of the risks to them but not to others. Before setting these expectations, corporate citizens should answer these questions:

1) Isn’t it a risk manager’s job to identify the health problems of the organization, prescribe a cure, suggest amputation where required and nurse the organization back to health?

2) Is it right to compromise professional ethics and code of conduct to keep a few people happy?

3) Aren’t risk managers responsible for calculating the direct and indirect cost to others for non-disclosure of risks?

4) Shouldn’t risk managers hold their ground and stick to their independent advise as you will benefit from it in the long-run?

Closing Thoughts

Moral courage is one of the most difficult qualities to acquire. Larry Page, as CEO of Google fulfilled his responsibility to the investors by publicly disclosing his medical problems. Now the investors can make an informed decision. One has to admire Page for taking such a difficult call. It takes guts. Disclosing personal weakness makes one feel vulnerable, exposed and fallible. He has shown the path for corporate leaders to follow.

Justin Bieber’s Lesson For Risk Managers

Surfing through Twitter one gets deep insight of human behavior. I am sharing a couple of tweets that got me thinking on our (risk managers) approach. The hat tip goes to Justin Bieber and Mark Robinson for the post.

 1. Get a tribe

 Justin Bieber tweeted the message below and it got 119,562 retweets and 62,959 favorites at the last count.

“Live life full”

— Justin Bieber (@justinbieber) May 10, 2013

Now you might say, what is so original in this message. Nothing remarkable, except that Bieber has 39,087,920 followers.

The message for risk managers is that if we want business team to listen to us, then we need to get a tribe of followers. Sitting in a corner or a cabin, writing reports isn’t going to help us. We need to be on the floor  interacting with the business teams daily.

2. Connect with a popular leader

Then Mark Robinson tweeted this message:

“Justin Bieber got 100,000 retweets for tweeting “Live life full”. That’s just 3 random words. I’m going to try now.

Nipple squirrel ham”

— Mark Robinson (@robboma3) May 11, 2013

The message was retweeted 26,972 times and favorited 4379 times. Mark has 23,694 followers. While Bieber’s message was tweeted by just 0.3% of his followers, Mark’s message was tweeted more than the number of his followers. Isn’t that fascinating.

This is a trick which risk managers need to learn. Even the most mundane message of a popular leader will be followed more ardently than their sanest advise. People don’t follow bosses, they follow leaders whom they like. Hence, risk managers need to identify the popular figures in office, ask them to give their message or link up their own version to the popular person’s message. Risk management advise is going to spread faster then, rather than with all the technical stuff.

I am dedicating Justin’s song to all of you. We need to believe it too – “I got that power”.

Human Rights Risk Management Process

Bangladesh Building Collapse

The fire in a nine-story factory building in Bangladesh killed 400 people. More than 600 people remain unaccounted for. It housed five garment factories that supplied to international brands – J.C. Penny, The Children’s Place, Dress Barn, Primark, Wal-Mart etc. The workers were asked to come to work even when cracks appeared in the building the previous day.

Bangladesh is the second largest exporter of clothes and the workers get the lowest compensations. Just around USD 37-40 per month. The question arises why are the multinational organizations not following the UN Guiding Principles for Human Rights protection. The reason is simple; they want to show higher and higher profits to the investors.

In Delhi, in Munirka one will find numerous small factories full of workers making export garments. A friend of mine also ran one. I had bought a few shirts from her at cost price ranging from Rs 300-500 (USD 6-10). In one international visit, I found the same shirts selling in range of USD 15-30. The fivefold increase in price was because of the brand tag attached to the shirt.

The multinational buyers push the prices down and some supplier gives a rock bottom price. The others are forced to match that price to get the business. End result is that basic facilities are not provided to the workers and they work at really low wages. Unknown workers are paying with their lives in developing countries to satisfy the growth targets set by CEOs to earn their bonuses and keep investors happy.  It is the dark side of capitalism which organizations want to hide.

In most companies, human rights risk management is not a focus area. The 2013 Global Risk Management Survey conducted by RIMS identified seven risks related to human resources among the top fifty risks. Though worker injury and harassment were included there was no specific emphasis on human rights risk management.

The risk management team can conduct annually or bi-annually a human rights risk management assessment. It requires attention not only from human resources perspective but from operational, financial, legal and reputational risks perspective. Any breach can result in huge losses.

Here are some of the steps mentioned in the UN Guiding Principles on Human Rights and guide “Investing the Right Way” issued by Institute of Human Rights and Business.

1.     Review the Human Rights Policy Statement

Human rights risk management is emerging as an important issue, especially with multinationals entering emerging markets and developing countries. They are expected to protect and respect rights of workers, communities and society. Investors can play a crucial role by influencing companies to promote human rights relating to gender equality, child labor, rights of indigenous people, land acquisition, mineral processing etc.

Hence, companies need to publish Human Rights Policy Statement on their websites. The UN Guiding Principle 16 states –

 “As the basis for embedding their responsibility to respect human rights, business enterprises should express their commitment to meet this responsibility through a statement of policy that:

(a) Is approved at the most senior level of the business enterprise;

(b) Is informed by relevant internal and/or external expertise;

(c) Stipulates the enterprise’s human rights expectations of personnel, business partners and other parties directly linked to its operations, products or services;

(d) Is publicly available and communicated internally and externally to all personnel, business partners and other relevant parties;

(e) Is reflected in operational policies and procedures necessary to embed it throughout the business enterprise.”

As a first step risk managers need to check whether the organization has a human rights policy statement and the above mentioned steps have been adhered to.

2.     Human Rights Impact Assessment

The second aspect of UN Guiding Principles is for companies to establish human rights due diligence processes. Guiding Principle 17 states:

 “In order to identify, prevent, mitigate and account for how they address their adverse human rights impacts, business enterprises should carry out human rights due diligence. The process should include assessing actual and potential human rights impacts, integrating and acting upon the findings, tracking responses, and communicating how impacts are addressed. Human rights due diligence:

(a) Should cover adverse human rights impacts that the business enterprise may cause or contribute to through its own activities, or which may be directly linked to its operations, products or services by its business relationships;

(b) Will vary in complexity with the size of the business enterprise, the risk of severe human rights impacts, and the nature and context of its operations;

(c) Should be on going, recognizing that the human rights risks may change over time as the business enterprise’s operations and operating context evolves.”

Human rights risk management is complex and challenging. If ignored, they can increase political risks and deteriorate relationships of the organization with the government. For example, Tata Motors wished to establish Nano manufacturing plant in Singur, West Bengal. The government allocated agriculture land using 1894 land acquisition rule, meant for public improvement projects, to take over 997 acres farmland. The farmers protested with help of activists and the then opposition leader Mamta Banerjee. Tata Motors moved out of West Bengal and established the factory in Gujarat. Multinationals looking for large tracts of land to establish factories are facing similar challenges in India.

Another aspect to look into is that scrap, waste disposal, sewage, environment pollution etc. from factories can impact food, water and health of local communities.

Decision needs to be taken whether investments should be made in countries or states with poor human rights record. In India, the Naxalite area is extremely conflict prone and business operations can have severe human rights impact.

Risk managers should evaluate the strategy and operations of the company from human rights, environmental, social and governance factors. The companies can face operational risks (project delays or cancellation), legal and regulatory risks (lawsuits and fines) and reputational risks (negative press coverage and brand damage). The impact assessment should be done from investors, customers, employees, society and supplier perspective. Identify business owners for the risks and devise appropriate risk mitigation plans to address adverse impact.

3.   Grievance Mechanisms

UN Guiding Principles state that victims of corporate related human rights abuse should have access to judicial or non-judicial remedies. Companies should provide some remedies themselves and cooperate in the remediation process.

UN Guiding Principle 29 states –

“To make it possible for grievances to be addressed early and remediated directly, business enterprises should establish or participate in effective operational-level grievance mechanisms for individuals and communities who may be adversely impacted.”

However, this isn’t followed by the companies in true spirit. “A Vigieo analysis of human rights records of 1500 companies listed in North America, Europe and Asia revealed that, in the previous three years, almost one in five had faced at least one allegation that it had abused or failed to respect human rights.”

Ideally the investors in the company should ensure that grievance mechanisms exist and address human rights issues. The transparency and disclosure of the same in annual reports would highlight the financial, legal and reputational risks. However, the investors don’t seem to be bothered by it.

See the case of Apple. It reported  Gross Profit Margin – 42.5%, Net Profit Margin – 26.7%, Revenue Per Employee – $ 2,149,835 and Net Revenue Per Employee – $ 573,255. It has 43000 employees in US and 20,000 outside US. However, Apple contractors hire an additional 700,000 people to engineer, build and assemble iPads, iPhones and Apple’s other products.

An Apple supplier in Taiwan, Foxconn was recently in the news for its workers attempting suicide. As per reportsWorkers are required to stand at fast-moving assembly lines for eight hours without a break and without talking. Workers, sharing sleeping accommodations with nine other workmates, often do not know each other’s names. They do not have much time to get to know each other. The basic starting pay of 900 RMB($130) a month – barely enough to live on – can be augmented to a more respectable 2,000RMB ($295) only by working 30 hours overtime a week.”

See the difference the company earns per employee and the payment made to the supplier’s employees. Apple shows profits at the expense of lives of Taiwanese workers.  The workers don’t have much of a grievance mechanism in China as the government stated that the suicides are within the normal suicide rate. Can Apple investors sacrifice some profit margin for safety and security of the contractual workers?

Another old example is the class action suit since 2001 on Wal-Mart Stores that involved 1.5 million current and former Wal-Mart female employees. It is the largest workplace bias case in US history.

 4.    Human Rights Reporting

 The biggest challenge is that most of the human rights abuses are not reported. The victims of human rights exploitation hold little power in comparison to the exploiters. They can hardly take up the might of powerful businesses when they are struggling to get basic food and shelter. Secondly, in the developing and emerging countries, corruption levels are generally high. Hence, media, law enforcement agencies etc. are bribed by the power players to silence the victims. However, with internet and social media, things are gradually changing. People have a voice and collectively they can fight.

UN Guiding Principle 21 lays out the requirement for companies to communicate human rights impact externally. It states -

 “In order to account for how they address their human rights impacts, business enterprises should be prepared to communicate this externally, particularly when concerns are raised by or on behalf of affected stakeholders. Business enterprises whose operations or operating contexts pose risks of severe human rights impacts should report formally on how they address them. In all instances, communications should:

(a) Be of a form and frequency that reflect an enterprise’s human rights impacts and that are accessible to its intended audiences;

(b) Provide information that is sufficient to evaluate the adequacy of an enterprise’s response to the particular human rights impact involved;

(c) In turn not pose risks to affected stakeholders, personnel or to legitimate requirements of commercial confidentiality.”

 As per the UN principles, the reports must cover appropriate qualitative and quantitative indicators, feedback from internal and external sources including affected stakeholders.

Risk managers can evaluate the reports and the reporting process to ensure that all risks are properly addressed. They should evaluate whether cautionary steps are taken and nothing is being done to exacerbate the situation. They should highlight severe or irreversible risks to the management to ensure appropriate decisions are taken.

Closing Thoughts

 Inequalities in income are the main cause of human rights abuse. The rich want to get richer at the expense of blood and sweat of the poor, and sometimes life. The diamond manufacturers and sellers took the right step to publish that they do not source blood diamonds. Since 2003, the Kimberley Process Certification Scheme (KPCS), supported by national and international legislation, has sought to certify the legitimate origin of uncut diamonds. Trade organizations – International Diamond Manufacturers Association (IDMA) and the World Federation of Diamond Bourses (WFDB) – representing virtually all significant processors and traders – have established a regimen of self-regulation.

Other industries, be it technology, electronics or textile manufacturers,  need to come out with similar steps to stop human rights abuse. The risk managers have a vital role to play in it. If we do not do anything, we are cheating this and the next generation of their right to live happily.

References:

  1.  Investing the Right Way – A Guide for Investors on Business and Human Rights – By Institute of Human Rights and Business
  2. Singur farmland-  Tata Motors conflict
  3. Apple financial ratios
  4. Foxconn Case Study
  5. Diamond industry sales clauses
  6. 2013 RIMS Global Risk Management Survey

 

Role of Positivity in Risk Management Communication

locking horns

Can something as simple as appreciation make business teams more willing to accept a risk manager’s viewpoint?

———————————————————————————————–

The Conflict

Proverbially risk managers are locking horns with business managers. Of course business managers out number risk managers, hence more often than not risk managers are licking wounds and complaining that business managers don’t listen to them. Business managers claim that they are running the show, so an interfering risk manager who is perpetually criticizing their hard work  should be shown the door.

Then risk manages lament that it is their job to high light risks which means negatives, so why go after them for being messengers of bad news. The conflict brews and sometimes reaches boiling point. No one wishes to see eye to eye because they wish to get eye for an eye. End result, the business suffers in this battle.

What is the cause of the stormy relationship? Criticism and negative feedback! No one likes it, so why blame the business managers.

What if risk managers change the approach? With the criticism they give a lot of positive reinforcement? Will the behavior of business managers change?

Research on Role of Positivity in Performance

Marcial Losada and Emily Heaphy conducted a research titled – “The Role of Positivity and Connectivity in the Performance of Business Teams – A Nonlinear Dynamics Model”. They studied the dynamics of team interaction in relation to approving and disapproving verbal feedback statements. Researchers coded the verbal communication among team members along three bipolar dimensions, positivity/negativity, inquiry/advocacy, and other/self. Sixty teams developing annual business strategy were analysed.

The results of the study have extremely important implications  from business performance aspect and for risk managers. The table below defines the ratios of various dimensions.

team ratio1

The positivity/ negativity ratios indicate that high performing teams give 5.6 positive comments to 1 negative comment. In contrast the low performing team give three negative comments to one positive comment. The medium performing teams give approximately two positive comments to one negative comment.

Similarly, under inquiry/advocacy ratios, the high performance teams are more balanced in their approach towards inquiry and advocacy. The team members question in an exploratory way. On the other hand, low performance teams are highly unbalanced and members advocate their own viewpoint. The medium performance teams are little bit tilted in favor of advocacy.

Again, high performance maintained a balance in discussing internal and external aspects. Whereas, low performance teams focus on internal inquiry. The medium performance are slightly more focused on internal than external aspects.

Thus, the high performance team have higher levels of connectivity, which results in better performance.

Overall, high performing teams show buoyancy throughout the meeting. They appreciate, compliment and encourage their team members. This expands the emotional space for team to function. In contrast, in low performance teams sarcasm and cynicism rules which restricts the emotional space. There is lack of mutual support, enthusiasm and a high degree of distrust.  The medium performance team don’t show distrust or cynicism but neither are they openly supportive and enthusiastic about their team members.

team dynamics

Implications for Risk Managers

The results are very important from a risk manager’s perspective. As the author states – “to do powerful inquiry, we need to put ourselves sympathetically in the place of the person to whom we are asking the question. There has to be as much interest in the question we are asking as in the answer we are receiving. If not, inquiry can be motivated by a desire to show off or to embarrass the other person, in which case it will not create a nexus with that team member.”

Hence, from the time we approach the business team, we need to ensure that we are inquiring about the business. We should not be advocating any quick recommendations based on high-level interactions.

Another point to note is that the questions should cover both the internal and external environment of the business. This would motivate the business team into a more open discussion.

The most important point is about positive feedback. In our verbal communication and written reports we focus on highlighting the negatives.

The research showed that positive comments (that is a terrific idea) create emotional space within the listener, hence the listener is more willing to take the feedback. The emotional space created by positive comments in high performing teams is twice the size of medium performing teams and three times that of low performing teams.

Negative reporting restricts the emotional space of the business team. To build a positive environment for acceptance of our views, recommendations and report, we need to give 6 positive comments for each negative comment.

The researchers have given equations to assess the emotional space based on various dimensions. It might be a good idea to calculate the same before issuing a report.

Closing thoughts

One of the incorrect assumptions that risk managers make is that there is a linear relationship between the observations and recommendations in the report. However, the study showed the impact of non-linear relationships on functioning of teams. Hence, the fault may lie in the straight forward cause and effect attitude taken by risk managers to get buy-in from business managers.

We generally discuss that in reports we should highlight the positives first to balance out the negatives. This research clearly points out the importance of doing so and the reasons why we are failing. We have to change our approach to be effective. We need to be part of the business team, develop a positive feedback system before giving any negative observations

References:

The Role of Positivity and Connectivity in the Performance of Business Teams: A Nonlinear Dynamics Model - Marcial Losada and Emily Heaphy

Risk Management Version 3.0

RM tiger

The business world is changing so rapidly that companies are either not willing to publish growth predictions or they are getting it wrong. In this new world trends can’t be analysed from historical data. The best business analytic teams fail because the new business models have totally different risks. Moreover, now the risks are interconnected and can’t be addressed separately. An operations risk may have a huge impact on financial risks.  The old compasses are useless and most are walking on uncharted territory.

This is the ideal time for risk managers to shed their old avatars and  become new super heroes of business. First they have to get out of their comfort zone of addressing internal risks that are preventable. The compliance and control based approach leaves over 60% of the risks un-addressed. If we consider that Risk Management version 1.0, we need to rapidly move to Risk Management version 3.0.

So what does version 3.0 look like?

1. Focus on Strategic Risk Management

I consider Enterprise Risk Management frameworks approach as Risk Management version 2.0. Though they covered strategic risks the focus was on finance, processes and technology. Hence, in reality it has become a bottom-up approach though the initial purpose was to make it top down. Risk managers are still not involved at strategic level and it is the Chief Strategy Officers who are analyzing strategic risks.

My guess estimate is that we depute less than 10% of resources to strategic risk management. We need to put in processes and resources where approximately 25% of efforts are focused on strategic risk management. Strategy failure probability has increased in present business environment.  For managing strategic risks reduce  probability of occurrence of assumed risks and effectively manage them if they occur.

2. Focus on Human Behavioral Risks

Industrial age focused on mechanization and streamlining of processes. Products were produced on the assumption that human behavior can be straight jacketed. In the age of technology and social media, this assumption has proved false.  Social media and data analysis allows behavioral analysis of each individual.

Secondly, the bigger challenge the world is facing is of changing demographics. In the last few decades, the average age has changed from 60 years to 75-80 years. The older generation lives longer and works longer. The Gen Y is entering the workforce with different expectations. Women have not only broken ground in the corporate world, but have become main decision makers for household purchases. Emerging market customers and employees have different behavior patterns.  The leadership skill sets have changed drastically. Participative and consultative cultures are more successful now.

Therefore, whether an organization wishes to fight  war of talent or entice customers, understanding human behavior has become crucial. Each segment of employee, customer and other stakeholders present different risks which an organization needs to manage successfully. Without addressing these risks at strategic and operational level, an organization is unlikely to succeed.  Risk managers traditionally haven’t focused on people, leadership or culture risks. In this century they need to.

3. Integrate Risk Management Knowledge & Resources

The traditional approach of having different experts of financial, operational and other risks in separate departments and addressing each risk in a linear manner is redundant. Moreover, now businesses are significantly exposed to external risks, which was not the case before. The Vodafone and Nokia tax cases are prime examples of risks occurring due to change in government stance.

Risk Management version 3.0 requires integrated risk management where risk managers with diverse skills can assess inter-related risks – internal and external. Secondly, risk managers have to be available within the business and as a separate department. The risk managers operating as part of the business unit need to identify the business risks and update the risk management department. The department needs to devise holistic solutions.

The risk management tools, technology, processes and resources all need to restructured to operate in an integrated manner at all levels.

Closing Thoughts

I suspect, group think is prevailing among risk managers. No one wishes to be a bull in a china shop and say – “hey this isn’t working.” It is ironic that risk managers are not doing adequate risk management of their own role and function. Old habits die hard and getting out of the comfort zone is scary, but I think we need to do it. Else, business failures are going to increase at a high rate. In the current economic environment, we can’t afford those losses. Think about it and share your views.

Wishing all my readers a very Happy Holi.

Fraud Risk Management in Ancient India

Presently, the Serious Fraud Investigation Office of India lacks sufficient powers to initiate investigations and prosecute. The Central Bureau of Intelligence isn’t independent due to which politicians escape prosecution for corruption and money laundering. Indian police force Economic Crime wing doesn’t have expertise in dealing with electronic and financial frauds. The legal system is pathetic and takes a long time to prosecute white-collar criminals. India has a shortfall of trained fraud investigators as it hardly has any courses for students in this line.

All these aspects may make you think that Indians are new to the concept of fraud risk management. This is far from the truth. Kautilya addressed financial fraud risks in 4th century BC and most of the concepts are still used presently. Let me narrate you some of the concepts he formulated in earlier times.

1.      Formation of a Central Investigation Agency

Kautilya proposed a central investigation agency for a kingdom to do espionage work. A network of spies located in different parts of the kingdom reported information to their handlers. The handlers in turn checked the authenticity of the information from three sources and if correct reported to the agency. The spies did not have direct contact with the agency to conceal true identities..

Spy selection depended on character and social position. Spies were recruited from all sections of society. Spies were positioned in all the departments and commercial ventures of the king to ensure that the head of the departments do not abuse their power or cheat the king. Women were considered particularly useful to penetrate wealthy households to get the inside story. In current India, there is a scarcity of female fraud investigators as it now considered a masculine job. However, in ancient India, women investigators and spies were quite common.

2.      Types of Financial Frauds

Kautilya identified 40 ways of embezzlement. Some of them are mentioned below:

  • Overpricing and under-pricing of goods
  • Incorrect recording of quantity of raw material and other stocks
  • Misappropriation of funds
  • Teaming and lading
  • Misrepresentation of sources of income
  • Incorrect recording of debtors and creditors
  • Incorrect valuing and distribution of gifts
  • Inconsistency in donations and distributions for charity
  • Misappropriating goods during barter exchange
  • Manipulating weights and tools for measurement
  • Misrepresentation of test marks or the standard of fineness (of gold and silver)

It is interesting to note that Kautilya mentioned most of the frauds that occur in accounting and preparation of financial statements. It shows human psychology has remained the same. However, in India the value system has deteriorated that has resulted in increased fraud and corruption. In olden times, the value of honour was held high. For example, the prime thought in Hindi was - “prann jiye pur vachan na jiye.” (meaning – it is better to lose one’s life rather than go back on a verbal promise given)

3.      Mechanism for Investigation and Punishment

The investigation process was quite similar to the current process followed. Information was initially gathered regarding the fraud from informants, spies, whistle blowers and audits. Background information of the suspects was gathered by sending spies to their residence and business premises.

Subsequently, the people involved, the suspects and witnesses were interrogated. Kautilya suggested separately examining ” the treasurer (nidháyaka), the prescriber (nibandhaka), the receiver (pratigráhaka), the payer (dáyaka), the person who caused the payment (dápaka), the ministerial servants of the officer (mantri-vaiyávrityakara)” for financial frauds. If any person lied, s/he received the same punishment as the main culprit.

Another fascinating aspect is that India doesn’t not have any law similar to the whistle blower provisions of Dodd Frank Act. However, Kautilya proposed -  “Any informant (súchaka) who supplies information about embezzlement just under perpetration shall, if he succeeds in proving it, get as reward one-sixth of the amount in question; if he happens to be a government servant (bhritaka), he shall get for the same act one-twelfth of the amount.”

The punishment for fraud depended on the nature and value of fraud. It ranged from nominal fines to death penalty. The victim was compensated for the losses suffered.

Closing Thoughts

The processes proposed by Kautilya for fraud detection were followed even until the Moghul rule. However, these were dismantled during the time of British Rule as the Indian Penal Code was formulated.  The difference between Mogul rule was that Moguls settled in India, marriages took place between Indian royalty and Mogul rulers and the culture got integrated over time.

The British came to rule for economic purposes. They wished to take advantage of India’s natural resources and vibrant economy. They levied their own rules and did not integrate them with the Indian culture. Hence, over time the Indian value system was lost or kept for namesake only. Overtime, as even after independence the British education system was used, a split ethical value system developed between personal values and business ethics. Therefore, corruption increased in the business environment till it became all-pervasive in the society. It is going to take a lot of effort to change the system now. No short-term solutions  will work.

Accounting and Auditing in Ancient India

Professionals want to know the origin of their profession, the work done in olden times and the level of knowledge. I thought of sharing with you the history of Indian accounting and auditing profession. I discovered in Kautilya’s Arthshastra that it existed in ancient India in 4th century BC. Therefore, my guess is that it would have originated at least a few centuries earlier.  The accounting principles and standards used in the present century are similar to those that existed in the 4th century BC. This nugget of information may have surprised you.

Broadly, Kautilya’s Arthshastra covers accounting principles and standards, role and responsibilities of accountants and auditors, the methodology of accounting, auditing and fraud risk management, and the role of ethics in managing financial activities. Let me share some of the concepts with you in the next couple of posts.

1.     Maintenance of Accounts

The accounting financial year was fixed to July-June period and with a full process for closure of accounts and audit of the same. It covered the method of consolidating the accounts from various departments of the government to assess the net income and loss. The accountants were required to furnish the completed annual accounts to the head office mid-July. Delay and/or failure to do so attracted financial penalties.

 2.  Classification of Receipts

 Kautilya states thatreceipts may be (1) current, (2) last balance, and (3) accidental (anyajátah= received from external source).” In it, he differentiates between cash receipts and debtors, current and accrued income, income from other sources, windfall gains, and recovery of bad debts. He recognized the concept of risk and suggested different rate of interests for loans. Foreign trade loan attracted the highest interest, as the returns were uncertain.

3. Classification of Expenditure

Expenditure classification was similar to receipts classification and included the differentiation between capital expenditure and revenue expenses. Kautilya described it as – “Expenditure is of two kinds—daily expenditure and profitable expenditure.” The difference between income and expenditure was termed as “net balance”. He insisted on making long-term investments in construction and other works as these would generate profits over a period. It also entailed keeping track of work in progress.

4. Role and responsibility of accountants

A hierarchical organization structure of senior to junior accountants existed within the king’s treasury function. The accountants maintained books of accounts on an annual basis according to prescribed standards. The same were furnished for audit at year-end. Kautilya suggested good salaries to accountants and auditors as high income would keep them ethical. Accountants would be more prone to commit fraud if they earned very little.

5.     Segregation of Roles of Treasury and Auditor

The fascinating part of Kautilya’s approach was that he recognized conflict of interest between finance and auditing functions. He categorically stated that the head of finance and head of audit should independently and separately report to the king. He recognized the possibility of collision between the two. In India, in the government the Comptroller General of Audit and Ministry of Finance are two separate functions. However, in the corporate world still in quite a few companies chief audit executive are reporting to chief financial officer rather than the chief executive officer.

6.     Building an Ethical Culture

Kautilya believed character reflected personal values of individual and ethical values learning must commence from childhood. Even as an adult ethical conduct was as important as professional skills. He proposed measures to build ethical climate in the kingdom. However, he was practical and recognized the potential of corruption. In accounting, he talked about misstating financial statements due to abuse of power and fraudulent reporting. He devised a system of reward and punishment to ensure compliance to rules and regulations.

7.     Verification and Auditing of Accounts

The concept of continuous monitoring, periodical auditing, verification and vouching existed in ancient times. Checks were done daily and periodically (five nights, pakshás, months, four-months, and the year). The attributes used in the present day for verifying income and payment vouchers were also used in earlier times. Interestingly, each department had spies to provide information and report wrongdoing to the seniors. There was a full process for discovering fraudulent transactions and punishing accountants for misstating financial statements. I shall cover that in the next post.

Closing Thoughts

Kautilya prescribed the accounting theory that included bookkeeping, preparation of financial statements, auditing and fraud risk management. He considered accounting as an integral part of economics. Various kingdoms in India used his work until the 15th century AD i.e. before the colonial rule. I am not aware whether similar level of knowledge existed in other parts of the world before the Christian era. If you do have information, please share it with me. It will be an enthralling journey into the past.

References:

Kautilya’s Arthshastra 

Auditors Criticise Without Value Addition

This is my 251 post and it feels good to have written so many. So I thought of dealing with a difficult and sensitive topic for auditors. The corporate world views auditors with jaundiced eyes and auditorville has a bad reputation. Scott Adams in his book “Thriving on Stupidity in the 21st Century” humorously described auditors in the following paragraph:

“Auditors get more respect and more bribes than accountants. That is because auditors are relatively more dangerous. Auditors are generally plucked from the ranks of accountants who had very bad childhood experiences. The accountants who don’t go on to become serial killers have a good chance of becoming successful auditors.”

The reputation comes from doing post mortems, writing long reports on deficiencies and criticizing the work of business teams. No one likes a critic and especially not those who do not do any value addition. So where are we going wrong?

1.  Criticizing Makes an Auditor Successful

The common perception is that more faults an auditor finds in an audit, the better is the quality of the audit. This is driven by the fact that some audit departments have a key performance indicator on number of observations. If there are no observations or weaknesses, the audit quality was not good. Let me mention an old story here.

A couple was riding a donkey to reach their village.

Two passer-by’s saw them and said – “Poor donkey, has to take the load of two humans.”

The husband heard the comment and got of the donkey. Further, two passer-bys saw them and said-“See, the wife is sitting comfortably on the donkey and the poor husband is walking on the road.” The wife got off the donkey and made her husband sit on it.

After a few kilometers  two spectators said – “See what the world is coming to, no chivalry. Man is riding the donkey and the poor woman is walking.” Now both husband and wife started walking along with the donkey.

Then another set of bystanders said – “See the idiots, both are walking and no one is riding the donkey”

The purpose of audit is to provide assurance on the process, not find faults with it. For instance, last year you conducted an audit of purchasing process and made ten observations. Will the audit of the same process be successful if you made 11 observations or nil observations? If auditee implemented previous year recommendations, then they should not re-appear. If without a change in process, you found new weaknesses, then it means the previous year audit was not done properly. Hence, criticism doesn’t make an audit a success or a failure. The quality of observations holds meaning.

2. My Way or Highway

The other presumption is that audit can be done without much of business knowledge. Just high-level understanding is required. This is really an incorrect view. I recall in my training period I was assigned an internal audit client that flew helicopters. When I was doing bank vouching, I had said to my colleague doing cash vouching  -“Wish we were auditing a car maker, at least I know the cost of a car tyre.” I was checking the appropriateness of expenses including repair and maintenance of helicopters when I hadn’t seen a helicopter from a five feet distance, let alone sit in one. Your guess is as good as mine on the quality of observations and value addition provided.

The big problem comes, when after doing an audit without business knowledge we refuse to listen to the business teams that the observations are irrelevant or incorrect. We don’t appreciate the different perspective of business teams and high-handedly push down our recommendations. Times of India mentioned a nice joke on this last Sunday.

Why did the chicken cross the road?

Plato: For the greater good.

Aristotle: To actualize its potential.

Darwin: It was the next logical step after coming down from the tree.

Neitzsche: Because if you gaze too long across the road, the road gazes back at you.

Buddha: If you ask this question, you deny your own chicken-nature.

Closing Thoughts

In the 21st century, auditors can’t hold a stick to beat the business teams all the time. The role has changed. With it the skill set and approach needs to be changed. If auditors are not able to give a better solution or process change, they should consider whether their criticism makes sense or not. Maybe, business needs to live with the control weaknesses, take the risks because the costs of plugging them are very high. The observation and recommendation should provide value addition, either in the form of assurance or improvement. Else, a lot of expenses are made to cater to auditors’ egoistical viewpoints rather than seeing business viability.

All criticism and feedback on the blog is welcome. Please share your views. A big thank you to my readers for reading my 250 posts.