Innovative Approaches to Fraud Risk Management

The Javelin Strategy & Research Identity Theft Report 2013 states that 5.16% of US customers suffered from identity theft amounting to US$20.9 billion. Moreover, Tablet users had the highest probability of fraud at 9.6%. Victims of data breach had a 22.5% likelihood to becoming fraud victims. Hence, it is clear that while organizations are deploying more processes, technology and resources to prevent fraud, the fraudsters are having a ball. One thing fraudsters do, is to think outside the box. So we have to take a leaf out of their book and be innovative in our approach to prevent and detect fraud. Below are some ideas on the same. Share with me your thoughts on what you think about them.

 1)    Voice Print Analysis

Presently, in most of the banks, a call center agent asks a set of questions to verify the identity of customer for telephone banking. Internal employees, external fraudsters and organized crime groups can easily steal information about date of birth, place of birth, address, secret questions, and card number.

Now voice-printing software is available for authentication of voice. The system automatically verifies the caller voice with the customer’s sample voice to identify fraudulent callers and protect the account.

Secondly, maintain voice records of earlier fraudsters. When system detects a fraudulent caller, it automatically checks against the previous fraudulent call records. Hence, the system will flag if a fraudster has previously conducted a telephone banking fraud. With this, it will be easy to nab the fraudster, if the police had caught him/her in a previous case.

A new voice identity technology is available  that captures the tone of the voice and the type of communication. The software can monitor quality of calls and customer satisfaction from call center agents’ conversations with customers. This will cut manual quality control checks significantly and result in savings in quality control department costs.

2)    Track through Photographs and Location Mapping

Besides having voice-printing software, use a system similar to WhatsApp to identify of customers. WhatsApp sends text messages, images, video recordings, audio recordings, and the location. If banks invest in a similar application and allow customers to download the application on their mobile phones and tablets, the number of telephone and internet frauds will reduce.

If a fraudulent caller is flagged, then the call center agent can request the customer to send a selfie or video. If it is the wrong person, usually the caller will cut the conversation and drop the attempt to commit a fraud.

If the caller is able to circumvent this control, the application will also track the location. Applications track the frequent places a customer visits or calls from. If the caller is from an unusual place, then s/he can be tracked immediately. For example, if a British customer is tracked to a place in India, the call centre agent can ask the caller to verify their location.

3. Track Spending Behavior

Sometimes high value fraudulent payments are processed resulting in huge losses. A study done by Vivek K. Singh*, Laura Freeman*, Bruno Lepri, Alex (Sandy) Pentland for “Classifying Spending Behaviour using Socio-Mobile Data” determined the spending behavior of customers from the social interaction patterns on mobile phones. For example, it showed that more social couple and couples with diverse business interests tend to spend more.

Using big data, insights on spending behavior of customers can be analysed based on personality traits. Tracking social patterns and payment patterns can flag out anomalies when the payment is not in line with the spending pattern. Moreover, a location map can identify the location of beneficiaries of previous payments . Hence, fraudulent payments can be identified at the time of processing itself.

Another advantage from this technology can be for processing retail loan applications. If prospective customers are willing to give the data of mobile phone transactions, then at the time of processing the application itself, the bank can identify which customers are likely to overspend and default in future. The bank can ask for additional securities and guarantees.

Moreover, if the application is installed in the loan customer’s mobile after loan disbursement, the moment s/he is about to overspend which might result in default of EMI, the bank can send the customer an alert to pay the EMI first.

 4. Fraud Risk Conversations

According to psychological studies on emotional intelligence, Negative Emotional Attractor’s activate defense systems and build resistance to change. On the other hand, Positive Emotional Attractors (PEA) activates parasympathetic nervous system and makes a person more conducive to listen and change behavior. An effective team has a 3:1 ratio of PEA:NEA. Another study shows that improving peer-to-peer conversation increases productivity of the team by 30 to 40%.

However, risk management reports are mainly critical hence activate NEA. Moreover, the communication, training material, and code of conduct are all geared towards creating fear and guilt. Hence, it is not surprising that attempts to educate business teams on fraud risks fail.

Fraud risk managers can build a positive interaction model using technology platform. A study conducted by Erez Shmueli_, Vivek Kumar Singh_, Bruno Lepri and Alex ”Sandy” Pentland on “Sensing, Understanding, and Shaping Social Behavior” enables tracking of human behavior through big data analytics. The analytic helps in understanding the behavior, the tone of the conversation and the trust relationships between people.

Using this technology, an organization can use a social networking platform to communicate fraud risks through blogs, videos, and stories. The write-ups and stories should be from the business teams. From the comments section, the application can identify the key influencers and trust holders to bring about change. Thus, change the conversation to change the behavior.

 Closing Thoughts

 The days of holding a gun to rob a bank are nearly over. Fraudsters use social engineering to obtain sensitive information to conduct account takeover frauds remotely. Hence, organizations need to use socio-physics, social networks, and technology to beat the fraudsters in their own game. Being a leader in adopting the latest technology to prevent and detect frauds has an additional advantage, the fraudsters have not discovered the antidote to it. Hence, fraud risk managers have the right weapons to fight. The right tools can make a hell of a difference.

References:

  1.  Javelin Strategy & Research Identity Theft Report 2013
  2. Classifying Spending Behavior using Socio-Mobile Data - Vivek K. Singh*, Laura Freeman*, Bruno Lepri, Alex (Sandy) Pentland
  3.  Sensing, Understanding, and Shaping Social Behaviour – Erez Shmueli_, Vivek Kumar Singh_, Bruno Lepri and Alex ”Sandy” Pentland

 

 

News Broadcasters Contribution to National Intelligence

Six unknown people are shrieking while discussing the latest news in your living room. To make matters worse, they are cutting others mid-sentence, and rebuking and rebuffing each other with absolute disregard for conversation proprietaries. The other invitees are unfazed with the shrill level and plunge straight into the debate. After a tough day in office, you have had enough. You finally pick up the remote and flick to an international news channel where there is a more civilized discussion going on.

Watch this sample of Indian Hindi  news channels discussion. The 1000 tonnes of gold dream of a sadhu was supposed to reduce the national deficit and change the destiny of India. Unfortunately, I couldn’t find an English news channel video on this topic.

The news broadcasters sensationalize the most trivial news by making it debate issue. The motley crowd gathers for their 15-minute fame. That they are being screamed at and insulted on a national broadcast does not deter them. Research shows that monkeys never call simultaneously. Each waits at least for five seconds after the caller has finished before responding. News broadcasters by no leap of imagination can be called polite conversationalist. They turn each intellectual discourse into an arena for combat. The discerning audience switches channels. Hence, I felt the need to discuss a few points.

Can public sue news broadcasters for wasting time? For instance, the swami’s dream of 1000 tonnes gold story circulated for two weeks. It died a tragic death when archaeologists reported that after digging they found a little bit of iron and broken glass bangles. Was anyone expecting anything else? Now let us assume ten Indian news channels gave one-hour airtime to this story. Approximately, ten million viewers followed the update. Hence, ten million productive hours were wasted. It approximately comes to 3470 person-years of labor squandered. Imagine the national financial loss resulting due to nonsensical stories.

Can public be inoculated from imbibing stupidity? Words seduce and rape, inspire and degrade, unite and alienate; hence, their power is infinite. The ambiance of news broadcast grates on the nerves. The invited experts are clueless on the impression of their words on their audience. The most loud-mouthed and aggressive person’s ill-informed diatribe is heard.

Media’s role is to shape public opinion by educating and enlightening audiences. They can develop an exquisite and warm relationship with them. Media easily transcends racial, cultural, and geographical boundaries and has a central role in building the knowledge level of the country. With the present level of news broadcast, government should develop a measurement scale to determine the decrease in level of intelligence and knowledge of audiences by watching the news channels.

Can news channels dedicate a few hours to positive stories? The news channels extol the gory, grotesque, and inane to get TRP ratings. The nasty stories permeate audience thinking and they turn apathetic towards distress and pain of others. The problems appear all pervasive where a single individual’s effort will not make a difference.

Shouldn’t news channels deliver enchanting, inspiring, and empowering stories for two hours every day? Tell stories about courage, compassion, altruism, brilliance, and determination. Stories encapsulating the essence of humanity.

Closing Thoughts

It is not what you know; it is how you think that makes a difference in the world. As Gandhi ji said – “Carefully watch your thoughts, for they become your words. Manage and watch your words, for they will become your actions. Consider and judge your actions, for they have become your habits. Acknowledge and watch your habits, for they shall become your values. Understand and embrace your values, for they become your destiny.” News channels influence our thinking. They form the values of the nation. The irrelevant and frivolous news affects the destiny of the nation. Hence, audiences need to hold media moguls accountable to broadcast a higher standard of news. Shouldn’t this come under corproate social responsibility of media houses?

Role of Cheering Crowd in Unethical Activities

crowd

A circus joker does crazy acts with the crowd laughing and cheering him on. When a person breaks the social norms on the streets, the public considers him crazy. If he is sane and rational he will get back to normal socially acceptable behavior in no time. The response of the crowd gives feedback on the appropriateness of the act.

Similarly, when a person behaves unethically or inappropriately, the encouragement and support he receives from the crowd determines how far he will go. The crowd’s reaction decides the extent of the crime, however, the crowd is never held responsible, and the individual is.

Notice the current trend. Pop divas dance nude in videos. It is naked dance of vulgarity and obscenity, passed off as art. Obviously, singers don’t sound melodious with their clothes on! Audiences react in three ways. Some relish it and indulge their baser instincts. Most have become desensitized to it and stopped questioning it. Lastly, a few consider it vulgar and avoid it. If the last category diminishes, soon only the so-called unsophisticated will sing and dance clothed. So how does one affix responsibility of the crowd?

Let us consider another example. A man is standing on the top of a cliff, planning to jump into a river flowing 100 feet below. There is a group spurring him on, saying – “Bravo man, do it.” Two of his friends hold on two his sleeve and say – “Man, don’t do it, not worth the risk.” The man thinks his two friends were spoil sports, while others were actually his friends. He never thought that there might be people in the supporting group, wishing him dead or laughing at him. The man in the heightened state of excitement, with adrenaline flowing high leaps into the river and dies. Now will the legal system define this as murder?

It applies in the business scenario too. CEOs get top billings for churning out high growth numbers. The media praises them sky-high without delving deeply into the methods used to achieve the numbers. The employees, investors and public drive the CEOs to take bigger and bigger risks, bend more rules, be more inhuman. The CEOs see the crowds rooting for another and want the same accolade. Cheating, breaking the law, doing unethical activities seem a small price to pay to get public honour and acknowledgement. . No one stops him, tells him that he is doing something wrong; he only sees ardent admiration. Then the bubble bursts, the CEO is caught and the public vanishes overnight. The employees, media, public, and investors escape with no responsibility for motivating a person to behave unethically. The CEO spends time in prison. Should the legal system prosecute the crowd?

The power of the crowd is incredible. The support of the crowd decides the course of history, good and bad, be it Indian independence struggle or the holocaust.  The decision of the crowd is based on culture and values of the society or organization. The crowd without good cultural and ethical values will probably support wrong things. As Confucius says: –

“Guide them with policies and align them with punishments and the people will evade them and have no shame. Guide them with virtue (de) and align them with culture and the people will have a sense of shame and fulfill their roles.”

From industrial age, organizations focus on the western concept of putting processes and procedures in place. The mechanism for compliance is reward and punishment systems. Just a few organizations have invested in building a good organization culture on ethical values. It holds true for families. Parents manipulate a child’s behavior through reward and punishment, without teaching core values. Without the education to build the moral compass within the organization and in the society, people cannot be expected to support the right causes and actions. Hence, one can opine that the crowd is blameless because they know no better.

This argument can be further propagated by the current state of social values. Every person is striving to be recognized, by whatever means possible. Paris Hilton gets more coverage in media than all sages in India. The problem is that people cannot recognize true merit in others and are obsessed about others acknowledging their merit. It is a situation of ‘garbage in, garbage out’ in human thoughts. Hence, education becomes the key to change the voice of the crowd.

Closing Thoughts

Replace obedience as a virtue with critical thinking in raising children, establishing cultural values in society and organizations. Obedience hampers the ability to differentiate between right and wrong. It develops traits to go along with the crowd rather than stand apart and hold ground. Critical thinking must become a mandatory course in schools, colleges, and organizations. Focus on it, and the crowd will start making better decisions in all aspects of life.

Cultural Complexities and Conflicts

Two weeks back I had given my laptop for repair. The computer guy first said that he would repair it in a day for Rs 1500. Then he called up and said it will take two days. Then he called up and said it will take Rs 2500. I asked him to return the laptop without repairing and ended up paying Rs 350 as service charges as he had identified the problem. Last week I asked a person to recharge my TV subscription and I am still waiting for the same. Why am I ranting on the blog?

Reason is these things happen in India. Based on these experiences the foreigners visiting India formulate an opinion on India. Secondly, the foreigners either formulate opinions on Indians from media reports or base it on their experiences of Indians living abroad. Media thrives on negative information and hardly report on positive aspects. Indians living abroad are just a small slice of the country and they do not completely represent the culture at home.

Some westerners visit India to understand it better as it is a growing economic power. However, whenever I have read their views, I feel they have a superficial picture and do not really understand the cultural complexities of India. They attempt to dissect each part independently and try to fix the jigsaw puzzle. However, Indian culture is akin to a seven-layered cake. The multitudes of flavours need to be tasted as a whole.

In India, there is a saying. To understand the water flowing in Ganga check the origin from Gangotri. To understand the culture of the country and the behaviour of the people, one needs to see the history of at least 100 years. I know in this age we believe world is changing so fast that people change quickly. However, I was reading Gandhi ji’s autobiographies and was surprised that most of the causes of conflict and misunderstandings between western people and Indians remain the same. For example, I understand what is being said by a westerner but sometimes I don’t get the logic behind the behaviour. From an Indian context, it just doesn’t make sense.

1)     The Western Civilization

The difference lies in the approach to life. The western civilization conquered the world in past centuries with the primary motive of getting richer. Though they entered as traders in countries, they soon became rulers. Establishing supremacy by war, brute force, aggression and breaking the spirit of locals were considered good tactics. The morality of their decisions and the suffering caused to human race wasn’t an aspect that got importance. The enemy had to be destroyed by whatever means possible.

So even today, the western corporates mostly have an aggressive organization culture with profit motive. Money is still the primary driver for most activities. The star performers are aggressive men who achieve their positions by cutthroat completion in the dog eat dog world. Ethical competition was until the last few decades an alien concept. Deception, cunning, and breaking the rules are valued traits for winning the game. There are few women at the top, as feminine traits were never respected. They are considered too soft.

2)     The Indian Civilization

In contrast, the Indian civilization since ancient times valued simplicity and the focus was on progress of the soul. In young age, a person was required to set up family, have a career and earn sufficient amount to keep the family in comfort. In old age, an Indian gave up all attachments and desires to focus on purifying the soul. Hence, during their lifetime Indians were required to develop virtues of truthfulness, simplicity, humility, patience, perseverance, frugality, and  other worldliness.

Cunning, aggression and deception were looked down. As Gandhi said – “a thing secured by a particular weapon can be retained only by that weapon” hence enemies weren’t destroyed but converted to friends wherever possible. That is why Indians used non-violence in the struggle for independence. Even when wars were fought, rules were to be followed and the person breaking the rules was considered unprincipled and cowardly. Breaching trust was shameful, contrary to the western opinion where the person whose trust is broken is considered a fool for trusting.

In respect of leadership also, since centuries India has propagated servant leadership and not that of arrogance and supremacy.

3)     The Global Organization

With globalization, one can see these two divergent approaches to life in close quarters interacting daily. I have heard many of my western colleagues comment about a mild-mannered Indian – “X is not aggressive enough, will he get the job done?” Whereas the Indian colleagues say – “What is wrong with this person, why do we need to fight? We can cooperate and get the work done peacefully.”  Team workers are always more valued than star performers. Cooperation is encouraged than competitive behaviour.

Each group doesn’t get the motives and thought process behind the other group’s behaviour. Westerners can’t figure out how Indians succeed in business with all these traits and attributes. They predict failure, and see success in the long run. Quite a few Indians considered unemployable by western standards (unassertive, weak, too humble, or polite) have successful careers in India.

While both groups now attempt to understand the behaviour of other, it is quite impossible to change it in a short time. A person brings to an organization the culture s/he has been raised in. The personal values and attributes can’t disappear on joining and neither can they be left at home during office hours. Respecting the person’s culture and giving space is the best approach.

Closing thoughts

The oriental nations – India and China – are the biggest emerging markets. The western world can’t ignore it and neither can they change it. Hence, they have to understand it and learn to survive in the oriental culture. It is among the biggest opportunities today to bring peace and prosperity in the world. In my view, to reduce the cultural risks and related conflicts more Indians should educate the western population about their historical and social culture. This will give deeper understanding and remove prejudices. The 21st century is bringing change; it is up to us on how we manage it.

Malala Yousafzai – The Youngest World Leader

A kid can take on terrorists of the world. This isn’t a joke. Malala Yousafzai, the 16-year-old education activist from Pakistan did just that. Last year Taliban shot her in the head and killed most of her friends. She recovered after a brain surgery and gave a speech at  the United Nations. She can teach  adults about leadership. . She has shown courage under fire. She has become an inspiration for young children and women to fight for equal rights. She is battling adversity non-violently with determination and persistence for the grater good of humanity.  She has become the voice of the young, has put their cause above her safety and life. Now this is a leader worth following. Below is the speech she gave at United Nations.

We need more youngsters to lead the world. Their idealistic thought process, commitment and courage can change the world. Unfortunately, age has only taught us to be so-called practical realist where the focus is on earning money, building a career and looking after our immediate family. We consider ourselves mature when we are able to put our own selfish interests first and foremost at the cost of harming the world. The old cannot change since the thought process and habits are ingrained in them. They have become jaded and cynical as life has dealt them with many wounds. They didn’t have the courage and character to stop being victims.

The young can build a better world for themselves without relying on the older generation. Take the torch in your own hands to  lead the world. Become an inspiration.

India’s Failures In Disaster Management

Floods in North India have left over 70,000 people stranded and 550 dead. Loss to property will run in billions. The on-going rescue efforts are yielding results but very slowly.  The uncoordinated recovery response and efforts indicate lack of disaster management capabilities of the state.

India as a country does not have a properly implemented disaster management system. The Comptroller and Auditor General of India recent report - “Performance Audit Report on Disaster Management of India” highlights glaring deficiencies. Below are some of the key observations from the report. It is sufficient to make Indian citizens sleepless at night.

1.      An Introduction

India with its geo-climatic conditions, high density of population, socio-economic disparities,  politics and troubled relationship with neighboring countries, has high risk of natural and man-made disasters. In respect to natural disasters, it is vulnerable to forest fires, floods, droughts, earthquakes, tsunamis and cyclones. Man-made disaster risks are (1)war, bombing, terrorist attacks, and riots, (2) chemical, biological, radiological, and nuclear crises, (3) hijacks, train accidents, airplane crashes and shipwrecks, etc.

Government passed the Disaster Management (DM) Act in 2005. According to the act, National Disaster Management Authority (NDMA) was formed under the Prime Minister and the National Executive Committee (NEC) developed National Policy of Disaster Management, which was approved in 2009.

2.      Failure in Formation of Disaster Recovery Plan

Until mid-2012, the National Executive Committee (NEC) had not prepared India’s National Plan for Disaster Management. Surprisingly, though India has faced a major disaster each year since development of DM Act, NEC has not met after May 2008. The Working Group it formed in 2007 never met after that.

Then the buck was passed to Ministry of Home Affairs (MHA) to prepare a National Response Plan (NRP). It directed National Institute of Disaster Management (NIDM) to prepare the NRP. NIDM submitted a draft plan in April 2012, which was circulated by MHA to other departments.

The other two components of the National Plan for Disaster Management are National Mitigation Plan and National Capacity Building Plan. While the latter is still under preparation, some departments have submitted the mitigation plans.

Things are equally bad at State level. Just 14 states have submitted their State Disaster Management Plan.  The lackadaisical attitude shows government’s complete disregard towards national and human safety.

3.      Performance of National Disaster Management Authority

The CAG report states that – “So far, no major project taken by NDMA has seen completion. It was noticed that NDMA selected projects without proper groundwork, and as a result either the projects were abundant midway or were incomplete after a considerable period of time.”

The projects included earthquake vulnerability risk assessment, micro zonation of major cities, landslide risk assessment, national flood risk mitigation, national school safety program, mobile radiation detection system, national disaster communication system, etc. The natures of the projects indicate their criticality and importance for disaster management. Even the hazard maps for earthquakes, landslides, cyclone, tsunami and floods are incomplete or unavailable. Without these maps, the government is not even in a position to identify the high-risk areas.

The main reasons for delays in disaster management project planning are lack of committed groups, failure in communicating and coordinating with various ministries, shortage of staff and insufficient knowledge and expertise in these fields. Though funds were approved and allocated for various phases, things just haven’t got beyond conceptualization stage.

4.      Mis-utilization of Funds

Government constituted National Disaster Response Fund and State Disaster Response Fund to deal with the disasters. The government approved Rs 33,580.93 crores for State Disaster Response Funds for a period of five years – 2010-2015. The report indicates that Ministry of Home Affairs is not receiving appropriate information from states on utilization of funds. Audit findings reveal that some states have misutilized funds for expenditures that were not sanctioned for disaster management. There was in a few cases significant delay in releasing funds. Additionally, some States didn’t invest the funds thereby incurring huge interest losses. This shows financial indiscipline in states management of funds.

Secondly, a separate National Disaster Mitigation Fund was to be constituted for reconstruction and restoration activities after the disaster. However, this has not been done till date. The States were required to form State Disaster Mitigation Fund and District Disaster Mitigation Fund. Quite a few states haven’t created the funds. Uttarakhand, the state reeling from floods, has just a State Disaster Mitigation Fund.

The situation is so bad, that the National Disaster Response Reserve of Rs 250 crores to buy relief material (blankets, tents, etc.) was not operational until audit time.

5.      Disaster Management Communication

Department of Space commenced a Disaster Management Support programme in March 2003. The main seven projects started between 2003 to 2007 are incomplete till 2012. These are namely – National Disaster Management Informatics System, National Disaster Communication Network, Doppler Weather Radars, Satellite Based Network for Disaster Communication, Disaster Management Synthetic Aperture Radar, Airborne laser Terrain Mapping and Digital camera System and National Disaster for Emergency Management. Presently, if a disaster strikes and regular communication networks go down, there are no contingency methods available for communication to a disaster-hit area.

6.      National Disaster Response Force (NDRF)

Ten Central Armed Police Forces battalions were formed of 1149 posts each. 27% of the posts were vacant in May 2012. The NDRF personnel don’t have sufficient training, facilities, equipment, and residential accommodation. With these constraints, it is difficult to imagine that they can effectively manage disasters.

Till recently, they didn’t even have deployment guidelines. In a few instances, they were deployed during elections. In one instance, they reached the disaster site without food, water, or tents for themselves. The local authorities had to give the same.

Up to June 2012, just seven states have constituted State Disaster Response Force. Even the local Regional Response Centres are ill equipped.

The impact can be seen at the local fire services level also. As per the Thirteenth Finance Commission, deficiencies in fire services are alarming. 97.54% of the country doesn’t have fire stations, 96.28% doesn’t have fire-fighting personnel, and 80.04% doesn’t have fire fighting and rescue vehicles. Shortage of trained manpower, vehicles, and equipment plague the existing fire service centers.

Locally, the states do have not mobile hospitals and trained trauma management doctors. There are no real medical facilities available for Chemical, Biological, Radiological and Nuclear disasters at national level. This is seriously a pathetic state of affairs. Government bodies are showing no concern for human life.

Closing Thoughts

After reading the report, I realized that Indians have just one option at present – pray to God that disaster doesn’t strike in their region. The governments at national, state and district levels have shown a negligent attitude towards disaster management. This is a classic case – funds are available but nothing has been done to implement the plan. Indian citizens can check with the local politicians and government bodies to assess the level of preparedness for disaster management. If required, local bodies can be formed in different constituencies and societies to act as disaster management task force. As it is a question of citizen safety, public activism will help in developing adequate disaster management capabilities.

References:

CAG Report – Performance Audit Report on Disaster Management of India

 

Strategy For Funding Risk Management Departments

Organizations want risk managers to focus on reducing costs of doing business, especially the regulatory costs. However, when risk managers ask for resources and budgets for running the department, they have to compromise. Lack of budget is generally the main cause for not implementing enterprise risk management, doing strategic risk management, building a risk management culture and providing consulting.

Generally, the budgeting process starts in the last quarter of the year. When the budget committee is approving other revenue earning departments budgets, risk management department heads present a cost budget. This does not go down well with the budget approval committee. They cut ten to thirty per cent of the budget despite risk managers giving valid justifications.

After budget approval, risk managers spend the year trying to squeeze in as much as they can. Sometimes it results in limited coverage and high stress levels for risk managers. With the increasing focus on risk management, the heads of risk management departments need to form a strategy to obtain the required funding. Look at the tips below to navigate the tricky budget approval process.

1. Start at beginning of current year

Start preparing for next year at the beginning of the current year. Identify the long-term and short-term projects. Commence influencing the key stakeholders of the long-term projects from the first quarter of the current year. If risk managers are the last one to submit their budget, they are unlikely to get heard.

2. Analyse the reasons for past failures

Assess the reasons for non-approval of the budget in previous years. Was it because the management thinks risk management is unimportant, is concerned about costs or it harms the interests of the key political players in the organization. After determining the reason, formulate strategies to change the mind-set for next year’s project approval.

3. Build relationships with key political players

Chances are that risk managers focus on the budget committee members for approval. Instead, identify the key power holders within the organization. Identify their relationships with the budget committee members. Before influencing the budget committee members, build relationships with key power holders. Get their support for the risk management function by understanding their drivers and motives.

4. Participate in business strategy formation

Involve yourself with the business strategy group. Identify various risks of the changes in business strategy and recommend the mitigation costs for the same. Attempt to incorporate the risk management budget in the strategy implementation costs. Align risk management budget with corporate goals and strategy.

5. Calculate the Return on Investment (ROI) for various projects.

Robert Biskup wrote an excellent article on Corporate Compliance Insights – “Making the Bottom Line Case for Compliance: The ROI of a Robust Compliance Department”. The nine points give superb ways of calculating ROI. Use the methods to negotiate with the business teams as the department can give a clear demonstration of cost savings or profit earnings. Do ROI calculations for previous years’ projects to demonstrate the value that risk management departments brought to the table.

6. Make business teams bear the cost of the project

For the projects, identify the stakeholders in the business teams. Categorize the projects as critical, necessary and optional from risk management perspective. Sometimes, risk managers spend time doing optional projects at the expense of critical projects, as they cannot refuse powerful business heads. In such cases, present the advantages of getting the assignment done. If possible, check whether business team will merge the cost of desirable projects in its budget next year rather than have it in risk management budget.

7. Build flexibility in budgets

The budgets go haywire when unexpected risks arise or regulations change. Suddenly risk management departments are in fire fighting mode and regular work is ignored. That is bad for business, since other critical risks remain un-monitored. Hence, estimate different cost budgets with probability of various risks and disasters occurring. Present these as contingency budgets to the management and take advance approval for the same. Risk mitigation efforts are delayed when risk managers take approval after a disaster has occurred. Revise the budgets quarterly as the business budget changes.

Closing thoughts

 Generally, risk managers have a financial background so they are outstanding at preparing the budgets. However, problem occurs when they do not have the negotiation skills and political strategy in place. Last quarter efforts do not work because everyone is on the same bandwagon. Gain a head start by starting in the first quarter itself. Be the first one to get the required approvals, so that the function gets what it wants.

Related article: Political Strategy for Risk Management

 

Political Strategy For Risk Management

A recent report published on Harvard Law School blog stated that in 81.2% of manufacturing and 73.6% of the non-financial sector companies have not appointed Chief Risk Officers (CRO). Interestingly, 83.3% of the financial services organizations have appointed a CRO with direct reporting to the CEO. This indicates, that unless mandatory, the risk managers do not have high visibility. Though their role is important in all sectors, they are unable to leverage themselves among the senior management. This issue is not new, and most complain at not getting a seat at the table.

 1.     Develop Political Skills

We need to look this issue from another lens. We need to develop a political strategy for the risk management department. Reason being, technical expertise on a subject takes one up only to the senior middle-management level. At senior management level organization politics dominates decision-making. Hence, risk managers need to develop political skills and astuteness to survive and thrive at that level.

However, the challenge is that though risk management job requires high political skills, very few work at developing them. According to an organizational study, ~ 65-80% employees avoid politics, ~15-25% indulge in negative politics and ~5-10% participate in positive politics.  Risk managers need to develop skills in positive politics to influence senior management.

The positive politics players have win-win, ethical, organization focus, enlightened self-interest, collaborative and best interests of the business mindset. Indulging in negative politics will be harmful as the group has  win-lose, non-ethical, upward focus, self-interest, competitive and personal gain mind-set. Viewing politics as dirty and avoiding it, isn’t an option. Politics prevails in organization DNA and one has to choose how to play it.

 2.     Implement a Political Strategy

Another aspect to look into is that risk managers have to influence the organization to build a risk culture. The concerns of the junior managers differ from those of middle managers and senior managers. Moreover, different business units have clashing interests and priorities. Stumbling from one person to the other and trying to influence them on a random basis will not benefit the organization or the department. Therefore, to influence each sub-group positively, risk management departments need a political strategy.

After developing the political strategy, risk managers need to implement and run with it consistently over time to reap success. It will involve getting supporters, appointing campaign managers, forming coalitions and doing some secret handshakes. Risk managers of course have to walk a fine line of maintaining independence and objectivity while implementing the political strategy.

 Closing Thoughts

Success in organizations depends on how well a person manages their own expectations by understanding the political game. Corporate world is a jungle. One cannot expect that people will make rational and logical decisions in the best interest of the organization. Risk managers will remain on the side lines unless they learn to trapeze the political web. The good news is one can learn political skills.

References:

  1. Risks in the Boardroom – Harvard Law School
  2. Investigations in Organizational Politics

Risk Managers – Tone Down That Report!

This week three renowned figures – Angelina Jolie, Larry Page and Christine Quinn – disclosed their medical problems to the world. They discussed battle with breast cancer, paralysis of vocal cords, and struggles with bulimia and alcoholism. Jolie, a woman famous for her beauty bared her mastectomy details. They talked about fear of death and handicap, and frailty of human character. They risked high-profile careers by being candid. One word describes their actions – Courage.

However, the corporate world wants to hide behind lies and window dress their weaknesses. The corporate leaders sometimes threaten risk managers and auditors to tone down their reports. The messengers of bad news get shot. Risk managers face bullying, retaliation and threat to their jobs for showing courage to speak the truth. If they refuse to bow down to pressure, the business teams label them as politically dumb or difficult to deal with. Question is – should risk managers tone down their reports to please the business teams?

I want to discuss a couple of scenarios here and you decide the course of action.

Scenario 1- Don’t report correct facts to avoid giving bad news

Let us say, you are a CXO of an organization. You have a heart problem and visit a doctor who is a good friend of yours.

The doctor realizes your heart condition is bad. You require a heart surgery for four bypasses. The doctor doesn’t want to deliver the bad news to you, because he doesn’t wish to hurt your feelings.

The doctor tells you  – “You just have too much stress. You need a vacation to relax and have some fun.” He prescribes you some vitamins and discharges you.

You follow your doctor’s advice, take a vacation. You swim and jog for a couple of days and have a heart attack. You arrive at the hospital with a survival chance of 5%.

Did the doctor do the right thing by not telling you the truth?

Scenario 2 : Don’t report correctly to protect a friend

A civil engineer responsible for doing quality and inspection checks of a bridge notices that sub-standard quality of material is used. There is a high risk of bridge collapsing. However, he issues a clean report to his seniors because the engineer-in-charge of the bridge is a friend of his.

An organisation’s senior managers drive daily across the bridge to reach their office. One day all of them are on the bridge and it collapses. All die.

Would the families of the senior managers be happy with the quality control engineer’s for not disclosing the risks?

My guess is most of the corporate readers would have answered no. You would have preferred the truth when it is a question of your own life being at risk.

Corporate Scenario

So why don’t corporate citizens hesitate when they put other people’s life at risk. See the Bangladesh factory fire, Japan’s nuclear disaster or US banks home foreclosure and mortgage mess. Employees, customers and public lives or life savings were put at risk.

Wouldn’t a few honest risk management reports helped in fixing the problem in time to prevent the disasters?

The corporate world maintains double standards on reporting risks. They want full disclosure of the risks to them but not to others. Before setting these expectations, corporate citizens should answer these questions:

1) Isn’t it a risk manager’s job to identify the health problems of the organization, prescribe a cure, suggest amputation where required and nurse the organization back to health?

2) Is it right to compromise professional ethics and code of conduct to keep a few people happy?

3) Aren’t risk managers responsible for calculating the direct and indirect cost to others for non-disclosure of risks?

4) Shouldn’t risk managers hold their ground and stick to their independent advise as you will benefit from it in the long-run?

Closing Thoughts

Moral courage is one of the most difficult qualities to acquire. Larry Page, as CEO of Google fulfilled his responsibility to the investors by publicly disclosing his medical problems. Now the investors can make an informed decision. One has to admire Page for taking such a difficult call. It takes guts. Disclosing personal weakness makes one feel vulnerable, exposed and fallible. He has shown the path for corporate leaders to follow.

Justin Bieber’s Lesson For Risk Managers

Surfing through Twitter one gets deep insight of human behavior. I am sharing a couple of tweets that got me thinking on our (risk managers) approach. The hat tip goes to Justin Bieber and Mark Robinson for the post.

 1. Get a tribe

 Justin Bieber tweeted the message below and it got 119,562 retweets and 62,959 favorites at the last count.

“Live life full”

— Justin Bieber (@justinbieber) May 10, 2013

Now you might say, what is so original in this message. Nothing remarkable, except that Bieber has 39,087,920 followers.

The message for risk managers is that if we want business team to listen to us, then we need to get a tribe of followers. Sitting in a corner or a cabin, writing reports isn’t going to help us. We need to be on the floor  interacting with the business teams daily.

2. Connect with a popular leader

Then Mark Robinson tweeted this message:

“Justin Bieber got 100,000 retweets for tweeting “Live life full”. That’s just 3 random words. I’m going to try now.

Nipple squirrel ham”

— Mark Robinson (@robboma3) May 11, 2013

The message was retweeted 26,972 times and favorited 4379 times. Mark has 23,694 followers. While Bieber’s message was tweeted by just 0.3% of his followers, Mark’s message was tweeted more than the number of his followers. Isn’t that fascinating.

This is a trick which risk managers need to learn. Even the most mundane message of a popular leader will be followed more ardently than their sanest advise. People don’t follow bosses, they follow leaders whom they like. Hence, risk managers need to identify the popular figures in office, ask them to give their message or link up their own version to the popular person’s message. Risk management advise is going to spread faster then, rather than with all the technical stuff.

I am dedicating Justin’s song to all of you. We need to believe it too – “I got that power”.