Norman Marks on Governance, Risk Management, and Internal Audit

Earlier this week, I enjoyed a conversation with Joshua Rosenberg, Executive Vice President and Chief Risk Officer of the Federal Reserve Bank of New York.

I was great to chat with a gentleman who has a prominent position, and whose thinking on risk management appears to be well aligned with mine (with a few exceptions, like risk appetite and risk registers).

His October speech to the Central Bank of Nigeria’s Second National Risk Management Conference made some excellent points, including:

• …by integrating risk management into plans, decisions, and actions, we can succeed over a wider range of possible futures, not just the future we expect (or hope for).
• … potential misunderstandings that might prevent us from getting the most out of risk management. The first is that risk management is mainly a way to stop bad things from happening. Of course, risk management should help us reduce the frequency and size of negative events and then recover more quickly and effectively when negative events occur. But, risk management, in my view, should also help the right things happen by giving us tools to work more effectively.
• Second, risk management could be misunderstood as primarily the responsibility of risk management specialists. Actually, effective risk management is a way for everyone in an organization to help things go right. From the economic analysts to the cash processing operators to the software engineers, we can make better plans, decisions, and actions when we are prepared for change and have the capacity to adapt to surprises. So, most of the risk management that occurs in an organization will be done by people who don’t have the word “risk” in their job title.
• And third, risk management could be misinterpreted as an attempt to create a contingency plan for every possible thing that could go wrong. It is important to prepare by scanning the horizon, exploring the range of possible futures, and understanding how those futures could help or impair desired outcomes. We do want to invest in effective responses to key scenarios. However, no organization has the resources to prepare for all possibilities. And, no matter how creative we are, we still can’t imagine every one of them anyway. As it is said, “Things that have never happened before happen all the time.” So, effective risk management is more than planning. It is creating the capacity to adapt to and recover from unexpected shocks, which is what we often mean when we talk about resilience.
• To me, successful risk management is as much about culture as it is about structure…. To me, there are four central aspects of culture that support effective risk management: learning, listening, helping, and speaking up. In a learning culture, we think about and plan for what might happen. And, we learn from experience, what went well and what didn’t, so we can improve for next time. In a listening culture, we seek advice, appreciate a fresh perspective, and are open to new ideas and feedback so we can improve. In a helping culture, we work together across the organization, building on each other’s strengths, and helping when we have an opportunity. And, in a speaking up culture, we let our colleagues know when we see a problem or after something goes wrong so that we can get started fixing it. Risk management is a creative, social process. It is a way of thinking, doing, and interacting. To bring it to life, we need to work together across the organization, staying continuously curious about the changing risk landscape and possible futures.
• A foundational component of resilience is that an organization can operate as a coordinated system in order to successfully adapt to changes in the environment.
• Here’s the realism: while we might prefer never to be surprised, we will be. The optimism is: effective risk management can help us be less surprised and respond better when we are. And, a strong risk management ecosystem will be self-sustaining because it generates demonstrable value – that is, practical and timely solutions to material problems – to help our organizations succeed in all environments.

In his role, Josh is naturally focused on the downside of risk, rather than the need to take the right level of the right risks so you can seize opportunities and achieve objectives.

Setting that aside, he has a practical approach to risk management that sees huge value in helping his organization and its leaders succeed – and not just manage and mitigate risks.

I welcome your comments.