Do you really value your risk management?
We talk a lot about understanding our risk sources; looking at the whole context of our business; setting our risk appetite; scaling our responses and repeating the process at regular intervals as we monitor the consequences of our actions. These things are absolutely fundamental.
Values = culture
But this is to concentrate exclusively on process and procedure, on structure and accountability. Behind those necessary elements is another dimension. This has just as much bearing on your risk profile, but is so often treated in a separate ‘box’. This is the ‘values’ side of risk management. This is about the culture of the business, campus, site or company. Not the performance culture or the winning culture, but the value set that underpins everything you do and marks your leadership group. Those who put all the pieces together and work on this aspect of their business will understand. If you have not done these things, then likely you will be scratching your head and wondering why you keep on having to start at square one and can never make those quantum leaps.
Building from the bottom up
We are all familiar with the development of strategic plans and business plans. It is a slow and often tortuous process. The end product, the plan, is never earth-shattering and we frequently depart from it. But the journey travelled to arrive at those plans teaches us so much. It causes us to think through a variety of problems and contingencies. It enables us to choose best options, yet put in place a number of reserve positions, if some of the critical pieces fall in different places. The process is all about thinking through and weighing these various options, so the chance of surprise is significantly reduced.
Codes of conduct
Employers who wish to nail their ‘cultural’ colours to the mast must develop a code of conduct. Codes of conduct, like corporate values, work as long as everyone has had some input to their development. If you hand them down like Moses with his tablets of stone, then don’t expect a high level of compliance. You may have a direct line to your Maker, but the rest of us are just human. We want to work these issues out together and set the bar collectively, where we think the best interests of the company and ourselves are properly served. No input from the workforce equals minimal engagement from the workforce. These documents must be developed collectively. Of course you can use the models others have developed as starting points – but if they are not collectively owned, adherence quickly falls away.
It’s what you do not what you say
Equally, management must exhibit the values enshrined in the Code of Conduct and the operating standards to which you want the business to perform. In real life, you walk the talk or they talk about you! Whether the business, company, site or campus is large or small, everyone relies on others for related and subsidiary functions. People are very quick to spot the divergence between ‘preaching’ and the expenses claims of managers that are processed by accounts!
Boundaries are required
Another requirement is a policy on the receipt of gifts and standards of entertainment. Yes, you have to decide what the dollar value of a token gift is and provide clear guidelines for everything above that: whether gifts are declined or handed in. As soon as they are received personally, then the ability of that person to make impartial and objective decisions may be seen as compromised. Gifts can be obvious or subtle. Obvious gifts may be valuable and useful items that the individual can prize, regularly use or show off for boasting rights. Subtle gifts tend to be gifts in kind: corporate box entry at sporting venues; travel upgrades; discount accommodation; fine dining entertaining. The purpose of bestowing these gifts is always the same: to influence, to enlist and to reduce detachment. If that’s the case – and it has always been the case – it is fairly important that you have an absolutely clear policy in place. It is just as vital that you have a strategy to minimise fraud and clearly promulgated policy in relation to fraud that everyone sees and signs.
And for those who never learn
For those who cannot understand the need for boundaries or refuse to heed them, you need a clear whistle-blower policy. Internal audit can do a marvellous job in ensuring compliance with guidelines and policies, but internal audit is necessarily conducted on a rolling program basis across many budget areas and cost centres. If you really believe in the values you have collectively set for your business, you cannot fail to put in place a whistle-blower policy. Otherwise, how can someone who believes in and works to those standards report what they believe is an outrageous departure from them? A whistle-blower arrangement expresses confidence in your staff; affirms publicly your commitment to those values; and demonstrates that you want to grow the business in every sense.
Managers, faced with potential embarrassment, may choose to gloss over wrongdoing. In extreme cases, they may even quietly let the wrong-doer go. But nothing is every truly quiet in any workplace, site, campus or business. What is everyone else to think? What matters more? The 99.9% working hard to realise the strategic goals; complying with your values and standards; and growing the business OR the 0.1% who are simply seeking personal advantage at the expense of the business?
A parallel approach is to set up an Internal Ombudsmanor hot line. An Internal Ombudsman is not normally a middle manager, respected for his/her integrity and who is guaranteed access to any decision-maker in the enterprise. Such a person is able to request a review of a decision, pursue issues of alleged bias or discrimination and inquire about allegations of impropriety. The authority of such a position rests in a protocol agreed between the CEO and the union or staff association. The integrity of the position rests in the choice of person who fills it on a part-time basis. The protection against abuse of the position rests in the limit of the term a person may spend in the position – normally around two years.
Learning and rewards
To embed values further, think of facilitated workshops, where staff can engage in the resolution of typical dilemmas and challenges they face. This role-playing, monitoring and review allow practical learning in a non-threatening environment. They require more effort to organise than pep talks, but are highly recommended. They require people to think and talk about these matters and by engaging in that conversation, everyone learns.
The last point is to remember who we praise and why. We don’t think twice at praising those who win new contracts, hit their targets consistently or develop new areas of business. But let’s not forget to praise and reward those who demonstrate integrity in their work for us and reports to us. They reward the business – we should reward them.