The key is on how you apply the enterprise risk management… and the first step is to involve people of all the job positions when you do the information gathering. Don’t do it as an interview, do it as a conversation and let people know that they are the experts in the process, in the area; that you are there to learn.

When you empower people it’s easier that they are more open to explain in detail what is happening. And this will help you to detect more accurately risks and which controls mitigate them. Even though you may have access to the organization chart, policies, and procedures, you need a person who is doing what the documents say. And after you’ve mapped all the process, show them how it flows, where are the risks and controls. You’ll be surprised by their interest! I’ve lived it several times: the staff wants to know if the activities they do or own, have any risk or if there is a key control.

Emerging risks is a tough exercise because we usually can't see what could become a risk. I remember that several years ago, when there was the influenza epidemic, no business included such a catastrophic event in the risk map. When it happened, businesses were closed for several days and that affected sales, causing companies to cut off staff, expenses, benefits. That external risk took companies by surprise and the impact it had was extreme in finance, production, health, and hygiene, etc. Risks can’t be seen, only felt when they are materialized. That's the importance of connecting everyone with risks, so that decision making includes all possible risks that the company may face.

By Mónica Ramírez Chimal - International Speaker & Trainer, Writer, Consultant-Partner at Asserto RSC