Case Study: Risk Management In-House Training Services Strengthening Enterprise-Wide Risk Awareness and Control

Background on Case Study Risk Management In-House

The mid-to-large organisation was in a controlled and competitive environment that was becoming more exposed to financial, operational, regulatory, and strategic risks. Expansion and digitalisation of processes in the business, increased regulatory demands necessitated a more systematic and active risk management approach in the entire organisation by the management.

Although the organisation already had risk policies and internal controls, the knowledge on risk management was skewed among different departments. The practices of risk identification and mitigation were usually considered compliance-related exercises, not as a part of the management process. Consequently, these risk discussions were not uniform and risk management responsibilities were not uniformly assigned to teams.

The senior management realised that proper risk management had to do with more than policies and frameworks. The staff members at various levels had to be provided with a practical knowledge of risk concepts, tools, and responsibilities. In order to establish an internal capacity and high-risk culture, the organisation turned to our Risk Management In-House Training Services.

Issues and Challenges

The organisation had a number of challenges that underscored the need to have organised risk management training.

Poor risk awareness between business units was one of the key challenges. Whereas, one of the teams engaged in actively identifying and managing a risk, the other teams perceived risk management as a formal reporting activity that constrained its overall effectiveness in making daily decisions.

The other problem was a lack of knowledge in the concept of enterprise risk management (ERM). Only a large number of employees were not familiar with risk taxonomy, risk appetite, and risk assessment methodologies which complicated the prioritisation of risks in a consistent manner.

There were also regulatory and compliance risks that were on the rise. The organisation had to make the staff comprehend regulatory requirements, what was in place internally as well as possible impacts of failure to comply especially concerning operational and governance risks.

Another area of concern was operational risks that are process-related, systems-related and third-party-related. Risk occurrences were being managed in a reactive manner as opposed to being controlled in a well organized manner and observed.

Lastly, accountability and risk ownership were aimed to be tightened by the management. The employees should have had an understanding of the roles in identifying, escalating and managing risks in the areas they are in charge of.

Objectives

The major aim of the engagement was to enhance the enterprise-wide risk management capacity by tailoring risk management in-house training.

In particular, the organisation was to:

• Develop a shared knowledge of risk management terms and definitions.
• Enhance risk identification, risk assessment and risk mitigation.
• Incorporate risk management into business and operations decision-making.
• Enhance the knowledge of regulatory and compliance risks.
• Develop good and regular risk culture within the organisation.

The training programme had to be feasible, require no specialism and have to be compliant with the current risk framework and governance of the organisation.

How We Helped

Our in-house risk management training was structured and collaborative to address the risks profile, the industry environment, and internal process of the organisation.

Our interaction started with risk training needs assessment. Senior management, risk, compliance, and internal audit teams were closely involved in our work to comprehend the risk framework of the organisation, areas of most critical risks, and the existing issues.

On this analysis, we put together tailored training modules on key areas of risk management. These were the risk fundamentals, enterprise risk management principles, risk taxonomy, risk appetite, and the roles and responsibilities of various stakeholders.

Other useful risk assessment methods that we discussed in this course are risk identification methods, the likelihood and impact analysis, risk scoring, and control evaluation. Compliance and regulatory risks were also realized in order to be in line with the governance and regulatory expectations.

One of the aspects was operational risk management. The operational risk training sessions were focused on discussing the typical cases of operational risks, internal control, management of incidents and escalation process with examples that were applicable to the operations of the organisation.

It was highly emphasized on application. Training involved interactive discussions, scenario-based exercises and group activities that helped trainees to give the risk concepts to their own processes and duties.

The programme was designed in such a way that it included the participants representing different functions, such as operations, finance, risk, compliance, and senior management. This guaranteed wide involvement and the creation of uniform risk awareness throughout the organisation.

The delivery of training was convenient and was done using both on-site workshops and the virtual session where necessary. Facilitators promoted free dialogue to solve practical problems and make the concepts of risk management clear.

As a reinforcement measure, we also made available the practical materials and references, which included risk assessment templates, risk registers, and control checklists, so that the participants can use the learning outside of the training sessions.

During the engagement, we collaborated closely with the participants adjusting discussions to their respective roles and discussing organisation-specific risk concerns.

Value Delivered

The case study illustrates how professional Risk Management In-House Training Services may reinforce risk awareness on an enterprise-wide basis and assist in the governance.

The engagement aided in the integration of risk management into the day-to-day operations of the organisation, enhanced consistency in risk identification and risk assessment, and increased accountability throughout the organisation through tailored and practical training.

The resultant risk management in-house training system offered a platform of future capability growth and enhanced internal controls as well as a more robust organisational risk culture.