Corporate Research Forum Managing the people dimension of risk Wednesday 8 th September 2010

1. Corporate Research Forum Managing the people dimension of risk Wednesday 8th September 2010

2. Agenda 09.30 Introduction 09.40 Initial discussion at tables 10.00Overview of research 10.40 Tea & coffee break 11.00 Panel of HR and risk practitioners 11.40 Group discussion 12.30 Lunch 13.10 Feedback from groups and plenary discussion 14.00 Panel of Experts 14.50 Summing up 15.00 CLOSE

3. Report highlights • Risk management – and HR’s ‘golden opportunity’ • Core issues in managing ‘people risk’ • Priorities for action

4. The context • RM approach hitherto seen to have ‘failed’ • “ERM has operated as a boundary preserving model of risk management subject to the ‘logic of the audit trail’, rather than a boundary challenging practice which confronts and addresses the complex realities of interconnectedness.” Professor Michael Power. • Reliance on financial modelling & quant. analysis • Corporate governance prescribing better people practices, especially at the top • Processes: reward, development, induction, performance review, feedback mechanisms • Increasing focus on ‘culture’, risk mindset

5. Correcting perspectives • Governance • Not just about board-level rules and regulations • How to exercise ‘control’ when organisations and operating environments are increasingly fluid • Risk management • More than mitigation and stopping ‘bad things’ • ‘Balance’ - taking worthwhile and avoiding poor risks • ‘Operational’ risk • a catch-all for risks other than ‘market’ and ‘credit’ • people risk included but undefined – can be fundamental, not just about ‘operations’

6. People and risk

7. HR’s opportunity – and challenge • Behaviour and culture – surely HR’s expert area? • ‘Whole-system’ understanding required – i.e. OD • HR processes are culture shaping levers But • Scepticism about HR’s pro-activity and clout • Influence at the top? And on mgt teams generally? • Knowledge of & interest in risk management? • Skills in evaluation, analysis, devising solutions? • Effectiveness in facilitating scenario planning? • Too weighed down with process and fire-fighting? • Relationship with Risk management function? The ‘best’ drive the agenda – what about the rest?

8. Risk culture refracts messages

9. Risk culture + or - • Negative • Misalignment • Blind spots • Incubation of crises • Recklessness • Suppressing feedback, sharing, learning • Suffocating initiative • Groupthink • Pressure & stress effects • Over-powerful leaders • Can be toxic to performance and reputation Positive • Serves as a barometer • Reinforces messages • Guide for judgement • Reduces error, permits learning • Promotes consistency and allows flexibility • Alert to ‘weak signals’ • Allows reflection Boosts performance, confidence, engagement

10. 3 lines of defence? • Front-line and middle management • Are they well briefed? Are they listened to? • Lots of ‘control functions’ • More than ‘policing’ required; achieving ‘balance’? • How independent and holistic is the 3rd line? • HR as a control function • Risk-HR relationship – eg who leads on what? • Risk of the Risk Manager • What is HR doing re this?

11. People risk challenges at the top • Mistrust of unchecked top executives • Board attitude is key - need to: • be reflexive • engage with complexity • be willing to challenge and be challenged • avoid knee-jerk reactions – ‘pendulum effect’ • Self-awareness and role-modelling good leadership • Face up to, and learn from, mistakes • Who holds up the mirror? • Risk, HR, all functions? Does that work?! • Ensure good oversight of people strategy and risk • HRD ‘clout’? • People insight and capabilities on the board?

12. Risk identification • Should be part of business strategy process • including strategic people planning • Effectiveness of horizon-scanning and scenario planning • Really understanding the business • eg organisational reviews • robustness of risk register information • Stress-testing and learning loop • Highlight & challenge embedded assumptions, blind spots

13. Risk measurement • Collective approach • legacy of different functions ‘counting’ in different ways, with different rigour • inhibits looking across the org, spotting poss. chain reaction • can undermine a risk register unless there is good ‘education’ about risk and healthy challenge/debate • understanding the people risk component in every area - avoid seeing this as an HR ‘silo’ • Keeping it fresh • Seeing the wood for the trees, spotting weak signals, analysing near misses • Keeping people challenges in the spotlight at the top • HR metrics capabilities – QUAL AND QUANT NEEDED

14. HR processes - how rigorous • Some HRDs argue that implementing HR practices well addresses much people risk True? Only up to a point • Not all people risk factors governed by ‘recognised’ people processes • How business-aligned are all HR processes? • How robust are the processes? • How much do line managers buy in, and display people skills?

15. What does ‘good’ look like? • Clear governance structure & behaviour, aligned with business aims • Robust people processes – supporting ‘balance’ and biz goals; line manager buy-in; adherence; re-freshed • Dynamic – challenge assumptions, think unthinkable, constant learning • Triangulation – use multiple perspectives, data sources • Transparency, honest debate, role-modelled at ‘top’ • Consistent approach from individual to team to Org – yet variegated according to needs (flexibility) • HR helps to set the agenda and ‘educate’

16. 10 priorities for HR • Expert partner in building risk culture, mindset • Embedding values/behaviours to influence decisions • Linking behaviour and organisation performance • Aligning reward and recognition • Mastery in providing people risk information • Guiding board oversight of people strategy • Assessing and developing leaders • Expertise in organisation design • Partnership with Risk • Developing HR’s risk capabilities, esp OD

17. Other priorities • CEOs to address reputational issues, and • set clear and appropriate ‘risk tone’ • act as role model re risk, inc team leadership • create environment that allows reflection and good judgement, and demonstrate ‘listening’ • Boards – acquire good ‘people’ expertise to improve oversight of organisational behaviour • Risk – develop more rounded capabilities in depth, and partner with HR re people issues • Regulators – ensure any interventions re risk culture are fit-for-purpose and skilled

18. Panel discussion

19. Group discussion - process • 45 minutes discussion at tables • 8 questions shared out between tables • Choose a ‘rapporteur’ at each table • Record answers & contributions on sheets provided • Include - examples of good practice, things you’d do differently, what helps and hinders • 50 minutes plenary 19

20. Issues to debate • Risky behaviour at the top – HR’s role? 2 Scenario planning - what should you do? 3 Control vs empowerment • HR process rigour • Risk capability within HR – how to develop • Risk culture and mindset – HR’s role • Errors – what’s allowable or not? Learning? 8 HR’s part in risk management – what helps and hinders? 20

21. Discussion topic 1 Risky behaviour in management teams – from overly bold strategy to poor ethics and personal behaviour • What can and should HR do? • Where’s the balance between fear of ‘put down’ or even job loss and your duty to stakeholders and ‘professional principles’? • What are the consequences of staying silent? • What should be done in the first place to avoid this scenario?

22. Discussion topic 2 Scenario planning In today’s complex environment, what should – or do you – do to…. • ensure that HR is helping the organisation prepare for the unexpected, and • as a result both spot opportunities and mitigate possible problems?

23. Discussion topic 3 Control vs empowerment • How do you ensure that you have clear operational control of risk at all levels, including external contractors,… • …while at the same time not stifling initiative and undermining engagement through restrictions and lack of trust? • How do you allow discretionary decisions, but ensure that risk is minimised?

24. Discussion topic 4 HR process rigour • What are you doing to ensure your existing people processes provide the means to manage risk effectively, and do so rigorously and reliably? • What more could HR do, directly or through line managers and organisational leaders?

25. Discussion topic 5 Risk capability • What are you doing (or should you do) to ensure that HR is authoritative in its contribution to the management of enterprise risk? • What capabilities need to be demonstrated by generalists and specialists? • What development processes should be used to facilitate this?

26. Discussion topic 6 Risk culture and mindset • What can and can’t HR do to enhance these? Consider all levels in the organisation and, in indicating activities, how to avoid ‘traditional’ HR orientation towards standardised processes and rules.

27. Discussion topic 7 Error • ‘Everyone makes mistakes’, but what can you and can’t you allow? • How do you minimise error and its negative effects? • How can risk management accommodate – and benefit from – human error?

28. Discussion topic 8 HR’s part in risk management • What helps and hinders HR playing a full part in risk management? • What helps and hinders the working relationship between HR and control functions like Risk? • What part should HR play in facilitating the effectiveness and development of such control functions?

29. Panel discussion

30. Summary

31. CRF’s forthcoming events