Centre for Risk Management and Sustainability – How to measure CRO Effectiveness
This morning I had the great privilege to speak to around 110 risk leaders from Indonesia and further afield. The topic of discussion was how to measure CRO effectiveness.
Often these discussions move quickly into risks standards, maturity models, best practice sharing and more things to do, but David Koenig (founder of DCRO) and I took a moment to step right back to a history of what it is that risk management is trying to achieve, and therefore whether risk management is effective in achieving those things.
David took us to the big picture and then I went into CRO and risk team design and in particular what it is that risk teams must be great at, supported by recent data.
It was a wide-ranging discussion that was far too rich and too broad to do justice to here, but I thought I’d share a few thoughts.
Asking the right questions… what does effective mean?
In Australia, the annual requirement is to review whether risk management is effective ie. is it getting the job done. Regular readers will be familiar with my views on this.
In considering this question there is a strong framing around material risk ie. things that could move your share price by more than 5%. If you’re getting more mature, and better every year but not hitting this goal, you’re probably missing the mark ie. mature but not necessarily effective.
This then begs the questions of:
- what it is that modern risk functions should do,
- what should be in the position description of a modern CRO
- what sort of team they should design, build, hire and buy.
I provided a summary of the study that TDA did late last year to help answer these questions. A very condensed version is included in the video below, summarising a far lengthier discussion.
Getting the right answers
In that study, we looked at around 20 mature risk teams and asked them to self-assess what they thought was important and how they were performing at these attributes.
The results would be surprising to many outsiders, but possibly not to insiders.
The headline is that many CRO teams are busy but not hitting the mark on some of the most important aspects. This then begs the question about their remit, focus, performance and whether they’re on track. We then unpack this with a way forward.
TDA works with 10-20 risk teams every year and there are about 20 in this set of results.
No two risk teams are alike. All are different. And with good reason.
There is no one size-fits all approach.
You need to be clear on which building blocks are most important and then excel at these.
You also need to be clear when you recruit a new CRO.
In our experience many cannot do this with the level of nuance required, which is why we seek to address this gap in the market.
You need a good framework, self-reflection, alignment and a critical eye on performance, which is what our report attempts to do.
We’ve been glad to help many through this work including some of Australia’s biggest organisations and now further afield.
Presentation summary and an offer to help
There was a lot in today’s discussion – too much to do justice, but I’ve done a quick piece to camera to summarise the discussion. It runs at around 5 minutes.
At the end there’s an offer to think deeply about what it is that you want from the risk organisation that you lead or sponsor, and how it fits with what’s really important to your organisation.
To help with this I’ve opened the study back up. It’s A$95 to do the survey and get the summary report, or A$495 for a personalised summary and a 45 minute chat with me over Zoom to take you through it.
From there if you need help then we’re up to speed and ready to go, without all that messing around working out what to put in the brief.
A risk maturity assessment can easily run in excess of $20k, so you can see the extraordinary value that’s in it.
This is part our mission to help as many organisations as we can to master their craft, in a way that is faster, more engaging, and a lot cheaper than traditional methods.
If you want to run in place then it’s not for you. You can stop reading now.
But if you want to do something relevant, important, purposeful and right, then you’re exactly the right profile.
Watch today’s summary video first.
Today’s event was a free event and the summary video is free also.
I’ve recorded a summary of today’s event which summarises today’s event. I hope you find it useful.
Have a watch first. Watch it a few times if you like. And then when you’re ready, click the link below to get started and help get the focus, clarity and impact that your organisations need from you.
Stay safe, take care, and thanks for all of the important work that you do.
Enrolment details here.