As the developed world pulls itself away from the abyss of the global financial crisis, many around the globe are breathing a sigh of relief. Having dodged a major bullet, organizations are now returning to business as usual. But if the crisis was a wake-up-call for the world, did business leaders and internal auditors pay attention or just hit the snooze alarm? What’s the next “black swan,” or significant unforeseen risk, and what should internal auditors be doing about it?

In this free feature from IIA’s global magazine, Todd summarises several key areas should be on all company watch lists for 2010 and beyond.

http://www.theiia.org/intAuditor/free-feature/2010/february/a-look-ahead-top-risks-for-2010/

This video has been provided by the IIA as part of their outreach program.

Risk and Responsibility (AHAUCHI Conference, September 2009)

[Streaming video: YouTube - 3 parts, 22 minutes total]

Presented as part of a three day strategy and leadership conference on the future of residential colleges, Todd Davies provides insights into the nexus between governance, leadership and risk, and provides a whole systems perspective into regulatory reform, avoiding the next GFC and the future of leadership on these dimensions.

A Leader’s Responsibility: Governance, Risk and Resilience (AHAUCHI Pre-conference, August 2009) [Streaming and downloadable audio: Resilientfutures.org - 1 part, 26 minutes total] As part of the lead up to the AHAUCHI sessions, Todd discusses the new context for the governance and risk responsibilities of leaders, especially directors and managers; the breakdown of conventional methods of risk and governance management in dealing with these conditions; the consequences of such a breakdown; new processes for more realistic governance, risk and resilience.

The Real Risks of Business as Usual  (Resilient Futures Forum event – “Planning for Growth: Water? Climate Change? Economic Shocks?, August 2008)

[Streaming and downloadable video: Resilientfutures.org - 1 part, 15 minutes total]

This is essential viewing for anyone in a governance, leadership, assurance or strategy role in a large organisation – corporate or government. This presentation is particularly timely given current conditions, increasing market turbulence, and the move by stock exchanges and regulators around the world who are beginning to expect CEOs and Boards to have a strong understanding of ‘material business risk’, and hence strategic risk.

There is also a lot of great material on the resilientfutures.org website and their Youtube channel.  If you are interested in understanding the future, complexity and the challenges and opportunities arising from this, these sites are well worth a look. Enjoy. TDA

Thanks to the the team from Resilient Futures and AHAUCHI who have been kind enough to record some of their work and make it available to the public free of charge.

As part of their ongoing roles, Directors and CEOs need to have a deep understanding of the strategic risks and opportunties facing their organisations.  Increasingly they are looking to their internal audit team for a view on whether their company’s risk management systems are adequate, and complete which needs an understanding of strategic risk as well as traditional areas of compliance, reporting and operations.

Strategic risk management is an area which is vital to the long term prosperity and performance of any organisation, yet it is an area which is not well understood or applied.  While auditors and managers are often comfortable with operational, reporting and compliance risk, it is often strategic risk that leads to material and irreversible business disruption. Internal audit teams are now expected to have an understanding of strategic risk and evaluate their organisation’s capabilities in this area as emphasised in Principle 7 of the ASX Corporate Governance Principles & Recommendations.

As part of the Institute of Internal Auditors ongoing work to enhance the capabilities of their members they have engaged TDA to facilitate a series of half-day public courses on strategic risk.   The course covers strategic risk as a distinct segment on the COSO framework, sources of strategic risk, strategic risk capability and a range of concepts to help understand and assess strategic risk.

Developed for Chief Audit Executives, by the end of this course, participants should be able to:

• Differentiate strategic risk from other risk types in the overall risk universe
• Recognise how strategic risk manifests itself
• Assess their organisation’s ability to identify, assess and manage strategic risk
• Identify areas of strategic risk vulnerability in their organisation
• Interact confidently with those responsible for leadership in this area.

Dates for the rest of the year are:

Melbourne: Thursday, September 10 2009

Perth: Friday, September 25 2009

Sydney: Friday, November 6 2009

For more information go to the Education & Events section of www.iia.org.au or call the IIA on (02) 9267 9155.

If you are not an internal auditor and would like a briefing session for your organisation, please contact us at info[at]todddavies.com.au or contact Todd on (0) 422 000 913.

The length and extent of debate was extensive ranging from the structure of the financial system, through to regulatory structuring, regulatory arbitrage, global regulatory frameworks, rules vs principles vs supervision and enforcement, Australia’s twin peaks and quadruple peaks model, ESG and a range of other useful debate, as well as the old chestnuts of shareholder input into executive remuneration.

I was encouraged by comments early in the meeting by Jules Muis, former Vice President and Controller of the World Bank saying that there are really only two key issues which need attention – strategic risk and systemic risk, and if we can get accountability for assessing and managing these at different scales, then we will be set for success in the future.

Lindsay Tanner, Federal Minister for Finance explained that conditions had changed and global markets can only be regulated through global coordination, while Anne Simpson, from CalPERS representing one of the largest pension funds in the world told us simply, that “we needed more joined up thinking”, eluding to the need for a wholistic, multi-faceted approach to systems thinking.

Al Gore reminded us that “we often confuse the unprecedented with the unlikely”, and Professor Mervyn King SC reminded us that “companies do not operate in a vacuum.”

Despite this sage counsel that we need an approach which allows us to think properly about strategic and systemic risk, and predict the “unprecedented but increasingly likely”, unfortunately these threads were not actively picked up, perhaps because this is an area which is not yet well understood.

In the area of risk management, boards are concerned about false comfort in risk systems – whereby companies hire a small army of risk experts who go away and implement risk frameworks such as COSO ERM, A/NZS 4360 or ISO 31000, and assure them that everything is okay, that their risk systems are sound, and the board and management can sign off.

The problem of course is that while routine bottom-up approaches to compliance, operational and reporting risk are good at managing the bread and butter of businesses, it’s rarely these areas which cause the material problems. Despite strategic risk and systemic risk now starting to be recognised globally by policy setters as the daddy of them all, people don’t have the capabilities in place to understand what these are, let alone manage them. Intuitively, boards know this.

The result is that a significant proportion of companies which experienced significant value destruction and earnings surprises in the last 18 months came out with the standard rhetoric “no one could have seen this coming”, leading to an inference that either the risk systems are not as we’ve been told (deceptive conduct) or the boards were incompetent (negligence).

I’ve been giving briefings and training on these areas internationally, including in public fora around Australia and the United States in order to help companies govern responsibly. In my mind, strategic and systemic risk are the elephants in the room which are still being overlooked and not understood.

I asserted in a public session at the meeting in front of some of Australia’s leading directors and experts that it might take someone to launch a class action in a move to get traction on this issue. After the session, one of the leading shareholder class action lawyers from New York suggested to me that being his expert witness could be very lucrative in the short term as long as I had no intention of ever being employed again, and perhaps I should stick to helping companies rather than suing them.

In Australia, internal auditors are being asked to give advice to boards on whether their company’s risk management framework is effective, and whether the risk profiles prepared by management give a true and complete picture. The advice I’m giving my clients is that if the organisation doesn’t have good capabilities around strategic and systemic risk, then the answer has got to be no, and therefore their public statements on this issue have to be qualified.

In an effort to raise awareness of strategic risk internationally, I’ve been speaking in public fora around Australia and the United States as well as through the Resilient Futures Network (RFN). The good news is that I’ve been getting traction with industry associations, community groups, pension funds, boards and large companies… and we’re beginning to prove that strategic risk doesn’t have to be difficult as long as you’ve got a good model and a diversity of perspectives (thanks to the RFN for their involvement with that).

If you’re an internal auditor trying to get your head around this, the Institute of Internal Auditors in Australia is running half-day training workshops on this topic nationally, which means you can get your head around this and bank some CPE credits at the same time. If they aren’t running near you, or if you want to run a session in-house, get a group together and The IIA will be happy to organise these.

If you’re a non-executive director and want to find out about the strategic risks which aren’t on your radar and should be, I’d be happy to give you a briefing. Please feel free to watch this primer and get in touch.

Todd

Todd Davies & Associates
Specialists in strategy, governance and step change

Web: www.todddavies.com.au
Email: todd@todddavies.com.au
Tel: +61 (0) 422 000 913

If you’re a finance or divisional leader, chances are that you’re asking your people to look for cost savings.  Perhaps you’ve already issued or been issued with a mandate to find some aggressive cost savings.  Perhaps you’re at the point where the low hanging fruit is gone and you’re now considering the hard decisions including downsizing and deferring important expenditure. Perhaps the pressure on your CFO and by your CFO is increasing?

The good news is that if you’ve got a large ERP System (SAP, Oracle, Mincom, etc), there is a very good chance that you’re sitting on funds that you’re entitled to.

Find Money FAST is a product which trawls through your data to see if there is money going out the door that shouldn’t be.  Also known as revenue leakage or cost leakage, Find Money FAST can be set up to trawl your systems on a one off or ongoing basis to claw back these funds, finding things like:

• Duplicate payments
• Entitled discounts for paying on time
• Discounts given away which shouldn’t be
• Fraudulent payments

These manifest themselves in different ways.  Often there are a high volume of small transactions which add up to a significant amount.  Sometimes the individual transactions are significant in themselves.

You may think that you have these covered through internal controls, but as the Find Money FAST team always says “controls are good, but the truth is in the transaction.”  Unless you are trawling 100% of your data, you never know if you’ve leaving money on the table.

Some Facts and Figures

• Most companies report a relatively low duplicates payment frequency: between 0.1 and 0.5% of total payments made. [IOMA 2007] But even at this low frequency, duplicate transactions can add up to a loss of $100,000 to $500,000 for every $100 million in payments made.
• Nearly 40% of companies report T&E error rates in excess of 5% of T&E expenditures. [IOMA 2007]
• Just 44% of companies with over 1,000 employees pay most of their invoices within specified discount terms. More than half of companies with over 1000 employees are not taking full advantage of available vendor discount terms. [IOMA 2007].
  Missing a 1% discount on a quarter of your payments can add up to $250,000 cash lost, for every $100 million in payments. On the other hand, paying invoices too quickly places needless pressure on cash resources, and adds to the cost of financing working capital.
• 4.6% of invoices contain errors and 44% of companies pay without original invoices [IOMA 2007]
• The median loss to companies from an employee-vendor conflict of interest scheme is $75,000. [The Association for Certified Fraud Examiners]
• 44% of companies that use purchasing cards report that purchase volume is at least 5% of corporate spend. [IOMA 2007].” 35% of purchasing card fraud is detected through internal and external auditing. You need to audit on an ongoing basis to detect fraud and misuse and nip it in the bud.” [IOMA 2007]
• The average auto write-off tolerance (the difference between payment amount and invoice amount that is accepted without further review) for large companies is $92 per invoice. [IOMA 2008]

Why Find Money FAST?

The Find Money FAST team has over 500 analytics which can be set up quickly to cover all different possibilities. While a lot of these are not new ideas, the Find Money FAST team:

• Knows where to look
• Has nearly 500 different transaction tests and hypotheses ready to go
• Has negligible start-up time
• Has a track record of results
• Can trawl 100% of your data without causing business disruption

In short, if there’s money to be found in your AP, AR, GL, HR/Payroll, GST, IT & Telecommunications, AML or Inventory, they’ll help you find it fast, now, and also on an ongoing basis.

For further information, or an obligation-free consultation, please don’t hesitate to contact Todd Davies on 0422 000 913 or info@todddavies.com.au.

To see the rebuttal, have a look at page 3 of the July edition of Risk Management Magazine here.  And to see the original article which caused the contraversy, click here for page 3 fo the June edition.  (Now locked down, here’s the web version).

For more information on how strategy, risk, governance and assurance come together, please click here.

I’m really pleased to announce that the Resilient Futures website went live today.

Resilient Futures was formed in April 2008 as a result of a number of practitioners in various fields believing that the current thinking in their respective professions was inadequate in dealing with the problems of tomorrow, and that resilience thinking and the concepts underpinning it provide much needed clarity in a rapidly changing interconnected world.

The Resilient Futures partnership consists of a divergent practitioners in strategy, risk, urban planning, leadership development and networked systems.  There is a range of innovative but practial thinking coming out of this one and I encourage you to have a look around, read a few articles, download a whitepaper or two, and subscribe to the RSS feed.

I particularly encourage you to have a look at my recent article Are you being a reckless leader without realising it? which gives a feel for where some of the thinking is heading, or our offering on emerging risk analysis here.

Resilient Futures can be found at www.resilientfutures.org.

Due to popular demand TDA is now offering advice in this area.

For more information, click here.