Posted initially on LinkedIn: Claudia Craia
May 2024. The risk committee of a financial company.
We are waiting for the members of the risk committee to enter the call.
CEO, CFO, Marketing, Legal, Sales, all management team and the Head of Internal Audit.
3:02 p.m. 3:05 p.m. Then 03:09 p.m.
I was still quite calm. Technology had played with my nerves in the past, I am used to it.
I don’t think I was happier to see the face of the Head of Audit than when he finally appeared, a sign that we could start. 3:10 p.m.
It was ok, I still had 50 minutes. I could do it.
But I hear the Head of Audit saying, almost apologetically:
“Claudia, we have to finish at half past. We have 20 minutes.”
Note. I know the management and risk team very well. And I am very familiar with the risk profile of the business.
Me: Okay. Hold my beer! (just in my mind!)
I did a 20-minute sprint through a 12-page report, full of risk information.
💡 Why has your risk profile increased?
💡 Each risk owner to explain the increase and what they do about it.
💡 What is your progress on the annual risk management plan?
💡 What are the risks outside of appetite? Why? What are you doing about them? When will they be within appetite?
💡 What are the control environments to be addressed?
💡 Which are the tolerated risks?
20 minutes. All focused on actions, progress, and decisions. No irrelevant points, no endless discussions about the position on the heatmap.
Because when I have to choose what to discuss in the risk committee, I will always choose ACTIONS.
Risk management is a business discipline like any other. Its’ ultimate goal is to achieve the success of a company.
And all risk management processes and methodologies must lead to ACTION.
