Norman Marks on Governance, Risk Management, and Internal Audit

You have a problem.

You are running for an elected office in a highly competitive race. After one of your excellent speeches, you are surrounded by reporters shouting questions at you.

You need to capitalize on the points you made in the speech by answering a few questions. Feeding the press and the media (especially the national TV stations) is an important and very valuable use of your time.

But you have a plane to catch to your next campaign stop, and your aides are already calling for your attention.

Maybe you can spend a few minutes and answer three or four questions.

How do you choose which questions from which reporters to answer?

It’s not an easy answer, You don’t want to automatically answer the first questions from the first shouting voices, because they may not be the topics you want to emphasize and may not be from the outlets you want to reach.

Fortunately, your team has prepped you. You know where your time will be best spent, where you will gain most value.

You know which point to feature and which reporter to call on.

You can make informed and intelligent choices.

X

Now let’s switch to a different scenario.

X

You are the CEO of a growing company and chairing a meeting to decide the allocations in the capital budget for the next period.

Instead of reporters clamoring for your attention, you have department heads pleading for your money!

“I need $10 million to fund a new marketing campaign. There’s an opportunity in the market we have to seize straight away. We expect it will drive up to ten times that amount in added revenue.”

“We need $20 million to upgrade our financial systems. They are old and are not providing the information we need to run the business effectively. The vendor is going to stop supporting them this year, so it is essential to move to the latest versions.”

“Our cyber defenses are weak, and the risk of a significant breach is far too high. We estimate it will take $12 million to acquire and install the necessary technology.”

“There’s an opportunity to acquire TBD Tech for $20 million. It will fill in a gap in our product line and they have some great people. We talked about this at the last board meeting, and it will enable us to continue with our strategic plan.”

More people are pressing their claims, but the CFO reminds you that based on cash flow and other projections, the capital budget will be limited to $50 million.

You will have to decide who gets how much of that scarce budget.

Fortunately, you have a risk function that has worked with each department head on their numbers.

While your competitors have been given risk registers and heat maps by their CRO, yours has worked with both operating and financial management to assess how each proposal will contribute to the achievement of the company’s targets for the year: things like revenue, market share, profits, share price, customer satisfaction, sustainability measures, and so on.

You can see whether it makes more business sense to invest in the marketing program or in ensuring compliance with proposed anti-money laundering regulations. You can decide between cyber risk and an acquisition.

X

Does your CRO and their team help you make these decisions, ensuring you have the necessary reliable information?

Or does the CRO tell you which risks, in their estimation, are more significant using some dollar quantification?

Are they helping you avoid icebergs or travel to your destination?

X

I welcome your thoughts.