Agility FinanceTech: Smarter Infrastructure & Technology Management for the New FS Organization. Sponsored by IBM.

Posted by Brian Barnier, ValueBridge Advisors

“Our execs say our reports ‘make my head hurt.’” “Business line leaders think my reports sound like Charlie Brown’s teacher ‘wa-wawa-wa-wa.’” “How do I better engage ‘the business?’” Through live workshops and webinars, I received hundreds of questions this year. In operational risk reporting, four challenges emerged as big obstacles to providing insight for action. Let’s take a look at what traps pose dangers and tips to get out of them.

Part I of this article discussed two challenges that deal with getting the “right information.” Here in Part II, we’ll look at two challenges to reporting the “right way.”

Right Way

The first challenge ops risk leaders report here is in trying to see patterns in the data. Context is crucial to see patterns. With a clearer context, insightful analysis becomes easier because relationships become apparent—like stepping back to look at a mosaic. Jay Pardee, director of the Office of Aviation Safety Analytical Services at the FAA, described how the Commercial Aviation Safety Team “fused together multiple sources of data to look at the frequency of the underlying causal problems to give us hard data on the nature of the problem and enable safety enhancements.”
Without the right information, ops risk managers hear questions from corporate and business line leaders such as “what do I do with all this data?” or “How will this make a difference to my revenue or capital calculation?”
Typical Trap: Poor data wastes resources. The scarier trap is following the wrong problem. Here, we can learn from past problems in diagnostics (whether people, cars, airplanes or anything) that addressing the wrong symptom (and supposed cause) can have disastrous results.
Tip: Work the problem from two directions at once. First, start by asking “why?” and clearly understand root causes that kick off chains of events. Second, start with business objectives (revenue, customer satisfaction, cost) and work backward from there. Where you meet in the middle makes clearer the causes to watch and builds the business case for improvements.
Bonus Tip: Resist the temptation to do this with a few SMEs. This is an opportunity for a well-structured workshop that brings together cross-functional people, builds insight into business performance (not just compliance) and creates consensus on immediate (and “doable”) improvements.

The second challenge here is format. Ops risk managers are challenged by executives who complain reports “hurt my head” or ask “what do I need to do?” This is not unique to ops risk.
Typical trap: It’s easy to hear the siren’s call to respond with a little “eye candy” with pretty graphics or drill down tools. Yet, these can create almost as much trouble when business executives push beyond the first pretty pages and try to drill down on information that isn’t there or ask about relationships created by graphics that don’t exist in real life (is an operational problem actually being caused by a certain region or by something that is being supplied to that region from elsewhere?).
Tip: Skillful managers can take such inquiries and turn them around into reasons to justify further improvement (You want more root cause data? Sure boss, here’s the price tag). Yet, this approach can be a bit dangerous, especially in tough times. For many it is safer and easier to start by putting the foundation in place though the cross-functional workshops. Get agreement on the problem and the solution, then implement (in pieces if needed). Incremental implementation might mean gradually increasing depth of analysis. However, better results usually come from narrowing scope and going deep. Then you can show dramatic benefit, if only for one business line or product area. That business leader becomes a cheerleader for you.

Final Tip for Traction: Make your learning needs explicit. Through a little discussion, many organizations quickly make a list of knowledge gaps that limit progress. They know what they need, but just don’t focus on it enough to put those success enablers in place. So take time to clearly evaluate your maturity on the points above, list the gaps to close and close them. Until you make a trip to the home improvement store for the right tools and materials, that new patio won’t be built.

For more on:
* Operational Risk, consider attending the Risk Management Association's Global Conference on Operational Risk in Boston March 16-18.
* IT Operational Risk, consider attending ISACA's North America CACS Conference in Chicago April 17-22.
* My quick takes on operational risk hot topics.

About the Author: Brian Barnier is a principal at ValueBridge Advisors. He has worked in both business line and IT roles. He researches, teaches and writes on business-IT effectiveness. Brian served on the international task force that created Risk IT and chaired ISACA’s IT Governance, Risk and Compliance Conference. He contributed to the Wiley & Sons book, Risk Management in Finance. He is an OCEG Fellow. Contact him at brian@valuebridgeadvisors.com.