1. Moving from Risk Assessments to Action
Enterprise Risk Management Workshop
September 20, 2010
Canadian Healthcare Risk Management Network
Diana:
Leslie Thompson
President
LESRISK
Diana Del Bel Belluz
President
Risk Wise Inc.
Not to be reproduced without permission.

2. Not to be reproduced without permission.
Agenda
2:00
Overview, Goals, and Introductions
2:10
PART 1:
Why a framework isn’t enough.
2:20
Why you can’t implement ERM with a memo.
2:30
PART 2:
Catalysts for inspiring appropriate risk management action
2:45
Group discussion
3:15
PART 3:
Applying change design to ERM Implementation
3:30
Group exercise
3:55
Closing Thoughts
We have three goals for our session which are reflected in the three parts of the workshop:
First, we want you to understand why so many organizations struggle with bringing their ERM framework to life, and we’ll cover that in Part 1
Since a major part of the challenge is making systematic and proactive risk management part of the organization’s culture, in PART 2, I’ll give a quick overview of 4 catalysts for engendering a risk culture. Then we’ll devote about 30 minutes to structured group discussion about how you can actually apply the catalysts in your own situation.
Because bringing ERM to life represents organizational change, in PART 3, Leslie will share some tools for organizational and culture change. That will be followed by another hands-on group exercise and discussion session where you’ll have an opportunity to share your expertise.
Finally, we’ll take a few minutes at the end to share with you our closing thoughts and advice for you as you move forward on your ERM journey.
Not to be reproduced without permission. 2

3. Not to be reproduced without permission.
Agenda
2:00
Overview, Goals, and Introductions
2:10
PART 1:
Why a framework isn’t enough.
2:20
Why you can’t implement ERM with a memo.
2:30
PART 2:
Catalysts for inspiring appropriate risk management action
2:45
Group discussion
3:15
PART 3:
Applying change design to ERM Implementation
3:30
Group exercise
3:55
Closing Thoughts
Not to be reproduced without permission. 3

4. Typical Risk Decision-making Model
Source: ISO 31000
Don’t reinvent the wheel. Instead, go to the literature and learn from others that have done the pioneering work. But you can’t copy outright. You will need to customize your framework and risk tools to suit your organization’s business context.
When I work with clients, one of the first things I do is customize some simple risk assessment tools to fit the organization’s situation, in terms of the nature and magnitude of the risks that they face.
I also give them a simple tool to assess the effectiveness of their current risk management strategies. The risk management effectiveness map enables them to graphically see which of their risks are under- or over-managed. This tool is extremely helpful when you need to decide how to optimally allocate scarce management resources.
James Haney developed an ERM Implementation Roadmap under a Canadian Health Services Research Foundation EXTRA fellowship. You can learn more about his Roadmap at The Conference Board of Canada’s Healthcare Enterprise Risk Management Conference on May 24-25, 2010 in Toronto.
Not to be reproduced without permission.

5. Main challenges of a ‘Risk Decision Model’ approach to ERM …
The model leads to a focus on individual enterprise risks in isolation that precludes a portfolio view of risk.
The model focuses on risk reduction, which drives risk aversion rather than reinforcing appropriate risk- taking behaviour.
The model fails to recognize that implementing ERM is an exercise in organizational development, making it difficult for ERM to gain traction.
ESA’s model follows the ‘classic’ risk management decision-making process model. There are three main challenges with the classic approach:
The model leads to a focus on individual enterprise risks in isolation, not as a portfolio. Plotting each individual risk to create the organization’s risk map can attain a partial enterprise perspective. However, the classic model does not support the kind of portfolio analysis required to: (a) understand how interdependent risk factors can collectively impact the organization’s ability to achieve its goals; and (b) optimize the organization’s overall risk position.
The model focuses on risk reduction, which drives risk aversion rather than reinforcing appropriate risk-taking behaviour. While traditional risk management decision models do mention the need to take risk to achieve objectives, they tend to focus exclusively on risk reduction. This is evidenced by the emphasis on risk ‘control’ with scant attention to the possibility that an organization might have to take more risk to achieve its objectives and to ensure its viability over the longer term. A risk reduction mindset discourages taking the calculated and controlled risks that are necessary to exploit opportunities. The tendency to risk aversion occurs whenever you divorce the risk from the benefit/opportunity.
The model fails to recognize that implementing ERM is an exercise in organizational development. More recent risk management guidance (e.g., ISO 31000) has repositioned the risk management process (i.e., the classic risk decision model) within a broader framework for implementation and on-going development of the ERM framework (see Figure 2). ISO’s ‘Risk Management Framework Development Process’ is essentially an organizational change management model. This approach supports continuous improvement of the framework through intentional and systematic organizational learning.
Not to be reproduced without permission. 5

6. Not to be reproduced without permission.
ISO (but only to the Risk Decision Model) introduces the concept of Continual Improvement
Not to be reproduced without permission.

7. “Experience is inevitable. Learning is not.” - Paul J. H. Shoemaker
Successful ERM requires:
An organizational Learning Framework to guide
Systematic development of ERM capabilities, i.e., change management approach
Not to be reproduced without permission. 7

8. Not to be reproduced without permission.
The Risk Wise ERM Implementation Process (geared to organizational learning)
1. Define ERM context and criteria
2. Assess risk and implications for performance
4. Close the ‘Learning Loop’
3. Integrate ERM into business practices
Not to be reproduced without permission.

9. ERM Best Practices: A Capabilities & Performance Perspective
Structural capital (structures & processes)
Establishing structures that clarify accountabilities
Building consideration of risk-taking and risk management into business processes
Developing and implementing control strategies for significant enterprise risks
Human capital (knowledge, skills and culture)
Developing ERM know-how
Cultivating an ERM mindset
Risk Intelligence capital (information flow)
Supplying risk information that is relevant & timely
Applying risk information (risk awareness and effectiveness) to:
Engage in candid discussions about risks (priorities)
Engage the board as well as staff to align resources (risk and resource optimization and organizational learning)
Risk Intelligence is about establishing your information flow so that it acts like the central nervous system of your organization.
It is about loops that feed-back and feed-forward to:
drive appropriate risk taking behaviour in the pursuit of organizational (and individual) goals and objectives
constantly optimize risk and resources, and
support continuous improvement and organizational learning.
I have developed a complete ERM Capabilities Assessment instrument that details what best practices (or the ideal state) are for each of these three types of ERM capital at each of the 4 steps in the ERM Implementation Cycle.
I have applied this instrument as a comprehensive independent assessment in which I compare a client’s current state of ERM to best practices. They like it because they can quickly see both theirERM strengths and weaknesses.
Over the summer I facilitated a workshop for York Central Hospital in which they used the instrument to conduct a self-assessment of their current state in about an hour. Based on the self-assessment of their current capabilities, they were able to very quickly identify priorities for ERM implementation and the important next steps on their ERM journey.
Not to be reproduced without permission.

10. The ERM Journey takes time…
Hypothetical of Evolution of ERM
Learn & Adapt
YEAR 1 - Design and introduce ERM framework. Qualitative assessment of ‘strategic’ risks. Articulate risk appetite.
YEAR 2 – Identify key enterprise risks; Name risk “owners”. Assess adequacy of risk controls (with regard to risk tolerance).
YEARS 3-5 – Integrate ERM with business processes (e.g., planning, performance management, reporting).
YEAR 6 – Extend scope to include ‘operational’ risks.
YEAR 7 – Introduce quantitative assessment of enterprise risks.
Learn & Adapt
Learn & Adapt
Learn & Adapt
Learn & Adapt 10

11. Not to be reproduced without permission.
Agenda
2:00
Overview, Goals, and Introductions
2:10
PART 1:
Why a framework isn’t enough.
2:20
Why you can’t implement ERM with a memo.
2:30
PART 2:
Catalysts for inspiring appropriate risk management action
2:45
Group discussion
3:15
PART 3:
Applying change design to ERM Implementation
3:30
Group exercise
3:55
Closing Thoughts
Ask the question:
Why can’t your implement ERM with a memo?
Not to be reproduced without permission. 11

12. Why you can’t implement ERM with a memo
It’s about people:
How work is done
What the “workers/people” believe and feel about their efficiency and effectiveness
What the people of the organization believe about making decisions under conditions of uncertainty
Organizational incongruencies:
Example: how people are rewarded
Example: Who leads? How do they lead?
Doesn’t Build Risk Aware Judgement:
Balancing risk intelligence with effective risk decisions
Other reasons?
Not to be reproduced without permission.

13. Effectiveness of Risk Decisions Quality of Information
Balancing risk the quality of risk information and the effectiveness of risk decisions with the objectives for your ERM program- where do you want to be?
high ?
Risk - Aware
Judgment
Effectiveness of Risk Decisions
If you focussed only on great information – compliance & control objective?
Low quality of info and low effectiveness of risk decisions = risk ignorance
Are you really optimizing risk and resources in the top right quadrant?
How do you build a risk aware culture?
Risk Intelligence ?
low
high
Quality of Information
Not to be reproduced without permission.
MENTION Conference Board Article

14. Not to be reproduced without permission.
The change management process: a tool for successful ERM implementation
Building the
Foundation for
Commitment
Keeping It
Going
Check
Point
Check
Point
There are other models: Kotter, Nadler, Burke-Litwin, Lewin etc.
The stage determines the intervention
The order of interventions counts---a lot
Check-ins count---a lot
Getting
Agreement and
Setting Direction
Making
Changes
Check
Point
Change Management Action
Building the
Foundation for
Commitment
Source: Dr. Harvey Kolodny,
Rotman School of Management
Understand the need for change
Enlist a core change team
Not to be reproduced without permission.
Getting Agreement
& Setting Direction
Develop vision and strategy
Create a sense of urgency
Communicate the Vision
Making Changes
Act: Implement the vision
Keeping it going
Consolidate the Change
Align and build congruence
Segway: This is a model. Diana will tell you about some of the catalysts that can be helpful to the implementation of ERM at these four stages

15. Not to be reproduced without permission.
Agenda
2:00
Overview, Goals, and Introductions
2:10
PART 1:
Why a framework isn’t enough.
2:20
Why you can’t implement ERM with a memo.
2:30
PART 2:
Catalysts* for inspiring appropriate risk management action
2:45
Group discussion
3:15
PART 3:
Applying change design to ERM Implementation
3:30
Group exercise
3:55
Closing Thoughts
* See Nov-Dec 2008 issue of Risk Management Made Simple Advisory for article: “4 Catalysts to Embed Risk Management Culture”
Not to be reproduced without permission. 15

16. Not to be reproduced without permission.
CATALYST #1: Establish Clarity Around Objectives, Strategies, Roles and Responsibilities
Having a strategic goal and measurable objectives is fundamental to enterprise risk management.
Be explicit about what needs to be accomplished, how, by when, and who is responsible for what.
What are the things that need to be in place for success?
What are the milestones that would let us know when we’ve achieved success?
What is the strategic path to get to each milestone?
ASK YOURSELF: Does my organization have clear strategic objectives with explicit measurable milestones?
Not to be reproduced without permission.

17. CATALYST #2: Articulate Risk Appetite & Tolerance
Risk appetite and tolerance set important goal posts for appropriate risk taking.
Determine criteria for decision-making before embarking on the process of assessing and weighing decision alternatives.
ASK YOURSELF: Has my organization articulated its risk appetite and tolerance?
Determine criteria for decision-making before embarking on the process of assessing and weighing decision alternatives.
Articulating risk appetite and tolerance sets the goal posts for risk-informed decision-making. Without decision criteria, it is easy to start with the conclusion and then look for the facts to support it.
ASK YOURSELF: Has my organization articulated its risk appetite and tolerance?
Not to be reproduced without permission.

18. Risk Appetite vs. Risk Tolerance
Executives don't end up in the news or in jail merely because they took a risk. They end up there for not managing their business risks properly.
We expect our leaders to take appropriate decisions that balance upside and downside elements of risk:
upside risk (benefit/opportunity) ≥ risk (threat) + cost
Risk Appetite: the size of 'bet' the organization is willing to take to achieve it's objectives. It needs to be commensurate with goals and capabilities.
A clear Risk Appetite is necessary to determine appropriate goals and strategic direction.
Risk Tolerance: the margin by which the organization is willing to accept either over- or under-shooting its objectives.
A clear Risk Tolerance is critical for resource allocation decisions
Not to be reproduced without permission.

19. An example - the Zone of Risk Tolerance
Upper Bound
(e.g. 90% of customers satisfied with service quality)
100%
90%
Objective
(e.g. 85% of customers satisfied with service quality)
Zone of
Risk Tolerance for
‘customer satisfaction with service quality’
80%
70%
Lower Bound
(e.g. 75% of customers satisfied with service quality)
60%
50%
A firm may have a strategic goal to have an average customer satisfaction rating of 85% (its Risk Appetite).
Operationally, it is prepared to accept ratings in the range of 75% to 90% (its limits of Risk Tolerance)
40%
30%
20%
10% 0%

20. Not to be reproduced without permission.
Why are some executives reluctant to articulate their risk appetite & tolerance? *
They mistakenly believe that if they don't formally commit to a tolerable level of risk then they can't be held accountable for setting it incorrectly.
They don't know how to go about articulating risk appetite and tolerance.
They mistakenly believe that if they don't formally commit to a tolerable level of risk then they can't be held accountable for setting it incorrectly.
Whether or not senior executives express their risk tolerances explicitly, they implicitly dictate the organization's risk tolerance and risk culture through the decisions they take and through the business practices they enable and over which they preside.
If they leave it to employees to figure out for themselves what is expected of them, senior managers leave themselves wide open to risk exposure from poor decisions and inadequate business practices, leading ultimately to failed strategies, poor performance, and a complete lack of accountability.
They don't know how to go about it.
Risk management is typically done on an ad hoc basis, relying on everyone in the organization to intuitively know what is or is not acceptable
Without exposure to formal risk management techniques, executives do not get an opportunity to develop the skills and tools they need to explicitly and confidently articulate the organization's risk tolerance.
Here are some tricks for engaging executives in the risk tolerance discussion.
First, help them understand that they cannot dodge their responsibility to define the organization's risk tolerance. That is the first step to convincing them that they are far better off taking a leadership role than passively leaving it up to individuals across the organization to decide for themselves.
Secondly, give them the tools and information they need to see and understand the organization's de facto risk tolerance as it is expressed in the organization's recent decisions and current practices.
* See March 2008 issue of Risk Management Made Simple Advisory for article: “The Tricks to Tolerance”
Not to be reproduced without permission.

21. CATALYST #3: Use Risk Intelligence to Drive Excellent Performance
If we define risk as events or conditions that create uncertainty around the achievement of objectives, then clearly, risk and performance are linked.
“If you can anticipate [trends] in the business world you are ahead of the crowd … you can have more time to think and you can innovate.”
Risk and performance are linked.
Develop an understanding of the relationship between the drivers of your performance and your risk. It enables you to anticipate the future and gives you more time to think, plan and innovate *.
Ultimately, you’ll experience fewer downside risk events and be able to exploit more upside risks.
ASK YOURSELF: Has my organization linked its risk and performance indicators?
To systematically manage performance requires developing an understanding of the relationship between the drivers of performance and risk, including the development of measures to track risk factors and quantify their impact on performance.
For example, in a health care facility wanting to reduce wait-times, performance drivers could include:
number of qualified professionals;
number of tests conducted in a timely;
operating room capacity; etc.
You need to understand how risk events in your internal or external environment can affect those performance drivers. Returning to the example, if the organization develops a reputation for being a lousy place to work or if other provinces scoop up new graduates, it could become very difficult to attract new staff, which would ultimately affect wait times. By understanding that link you’ll be able to develop and monitor risk indicators (e.g., employee satisfaction and hiring in other jurisdictions), and if they get too high, you have time to develop a strategy to address the potential drop in qualified professionals before it affects wait times.
When you know what exactly is driving performance, and how potential risk events (e.g., changes in your business environment) could impact performance, you’ll know how best to establish trigger points for action.
ASK YOURSELF: Has my organization linked its risk and performance indicators?
See Risk Management Made Simple Advisory ‘New Subscriber Bonus’ for how to map the link between drivers of risk & performance.
See June 2008 issue of Risk Management Made Simple Advisory for article: “The Anticipation Advantage”
Not to be reproduced without permission.

22. CATALYST #4: Foster Dissent and Inquiry (part 1)
Executive decisions “are made well only if based on the clash of conflicting views, the dialogue between different points of view, the choice between different judgments.”
Peter Drucker
‘Decision-makers need to foster conflict and dissent to ensure that the course of action selected enables the organization to achieve its performance objectives in a way that optimizes resources and balances risk better than all other plausible alternatives.’
Michael Roberto
‘Great companies continually refine the path to greatness by confronting the brutal facts of reality.’
Jim Collins
The kind of decisions the executive has to make “are made well only if based on the clash of conflicting views, the dialogue between different points of view, the choice between different judgments.” Peter Drucker
‘Decision-makers need to foster conflict and dissent to ensure that the course of action selected enables the organization to achieve its performance objectives in a way that optimizes resources and balances risk better than all other plausible alternatives.’ (Michael Roberto)
‘Great companies continually refine the path to greatness by confronting the brutal facts of reality,’ Jim Collins.
For a risk assessment process to be effective, it must bring to the surface all critical information for the decision at hand. This can’t be achieved if the organization has a culture of silence in which people are afraid to speak the truth.
For a risk assessment process to be effective, it must bring to the surface all critical information for the decision at hand. This can’t be achieved if the organization has a culture of silence in which people are afraid to speak the truth. …
Not to be reproduced without permission.

23. CATALYST #4: Foster Dissent and Inquiry (part 2)
One of the biggest contributions you can make is to question how well your organization’s risk estimates reflect its particular reality.
Is your risk estimate accurate?
Is your risk estimate based on high-quality information?
Is your risk estimate relevant?
Is your risk estimation process objective?
Is the risk estimation model built on solid assumptions?
Initial assessments of risks may have to be based on opinion. However, transition as quickly as possible to evidence-based measures. It is only way to distinguish between valid and invalid assumptions and guard against willful blindness.
ASK YOURSELF: Does my organization foster dissent and inquiry in its strategic decision-making? Can the truth be heard?
One of the biggest contributions you can make is to question how well your organization’s risk estimates reflect its particular reality. This includes:
distinguishing between the beliefs, opinions, and facts that go into any estimate of risk
ensuring that your risk estimates represent an accurate and meaningful picture of your risks.
fostering a culture of inquiry in which frank and open discussion occurs about those beliefs, opinions, and facts.
Initial assessments of risks may have to be based on opinion. However, transition as quickly as possible to evidence-based measures. It is only way to distinguish between valid and invalid assumptions and guard against willful blindness.
ASK YOURSELF: Does my organization foster dissent and inquiry in its strategic decision-making? Can the truth be heard?
Not to be reproduced without permission.

24. Not to be reproduced without permission.
Group Discussion
Break into groups of 3. Each group to focus on 1 catalyst
Task 1: Each individual takes 1 minute to jot down their answer to the question: “Have you applied this catalyst in your organization? (No / Partially / Fully)”
Task 2: In your group, take 3 minutes each to discuss:
If your answer is “No” or “Partially”:
Tell the group the main barrier/challenge that is preventing you from fully applying the catalyst.
Ask the other members of your break-out group for advice on how you might overcome your main challenge.
If your answer is “Fully”:
Share with the group your lessons learned and pointers based on your experience.
Be prepared to share key insights with the other break- out groups.
Not to be reproduced without permission.

25. Not to be reproduced without permission.
Pick your catalyst…
CATALYST #1: Establish Clarity Around Objectives, Strategies, Roles and Responsibilities
CATALYST #2: Articulate Risk Appetite & Tolerance
CATALYST #3: Use Risk Intelligence to Drive Excellent Performance
CATALYST #4: Foster Dissent and Inquiry
Not to be reproduced without permission.

26. Not to be reproduced without permission.
Agenda
2:00
Overview, Goals, and Introductions
2:10
PART 1:
Why a framework isn’t enough.
2:20
Why you can’t implement ERM with a memo.
2:30
PART 2:
Catalysts for inspiring appropriate risk management action
2:45
Group discussion
3:15
PART 3:
Applying change design to ERM Implementation
3:30
Group exercise
3:55
Closing Thoughts
Not to be reproduced without permission. 26

27. Where is your organization in the change management process?
Building the
Foundation for
Commitment
Keeping It
Going
Check
Point
Check
Point
Getting
Agreement and
Setting Direction
Making
Changes
Check
Point
Source: Dr. Harvey Kolodny,
Rotman School of Management
Not to be reproduced without permission.

28. ERM Implementation – designing the change
Change Management Action
Intervention
Building the
Foundation for
Commitment
Understand the need for change
Enlist a core change team
Develop vision and strategy
Getting Agreement
& Setting Direction
Create a sense of urgency ?
Communicate the Vision
Making Changes
Act: Implement the vision
Consolidate the Change
Keeping it going
Align and build congruence .
Not to be reproduced without permission.

29. Stage 1: How do you build support for ERM?
LEARN as much as you can about both the benefits of ERM and how other groups have implemented it
Evaluate your organization’s capacity and capabilities
Diagnose organizational support and incongruencies
Secure leadership support:
Identify allies, influencers and resisters
Engage an executive ERM champion
Engage board or trustee support for the strategic benefits of ERM
Develop an ERM function or task force
Involve all organizational silos in the development of your own ERM framework, and definitions
Promote a common language
Establish feedback loops and check-in
Leslie Thompson, 2010
Establish feedback loops to evaluate ERM performance and drive desired risk-taking behaviour
Also useful if you are at another stage. Renewing.
Not to be reproduced without permission. 29

30. Not to be reproduced without permission.
Small Group Exercise
Each participant group chooses a spokesperson.
Task 1: In your groups review the change design map and develop a list of change interventions consistent with the objectives of the change management stage assigned to your group:
Stage 1: Building a foundation for commitment, or
Stage 2: Getting agreement and setting direction, or
Stage 3: Making changes, or
Stage 4: Keeping the changes going
Task 2: Discuss at what stage your organization is in ERM implementation and whether any of the suggested interventions might work for you
We will pool our suggestions after 10 minutes and discuss task 2.
Leslie Thompson, 2010
What stage are you at?
Are there any interventions you have heard about today that would be useful to your own implementation of ERM
Not to be reproduced without permission. 30

31. ERM Implementation – designing the change
Some Interventions
Building a Foundation for Commitment
Learn about ERM
Learn about ERM in your organization
Evaluated ERM capacity & capability
Develop an ERM task force
Secure leadership support
Understand the need for change
Enlist a core change team
Customize the ERM process
Define terms and risk categories
Communicate. Leaders show support
Framework development
Training
Develop vision and strategy
Getting Agreement
& Setting Direction
Create a sense of urgency
Communicate the Vision
Identify and assess risks for each dept.
Aggregate enterprise risks
Develop a risk map
Develop a risk appetite statement
Review alternative risk management strategies and take action
Making Changes
Act: Implement the vision
Integrate with planning, budgeting, performance measurement
Build infrastructure support: IT, organizational architecture
Refine assessment methodologies
Share best practices. Celebrate
Keeping it going
Consolidate the Change
Align and build congruence
Not to be reproduced without permission. 31

32. Not to be reproduced without permission.
Agenda
2:00
Overview, Goals, and Introductions
2:10
PART 1:
Why a framework isn’t enough.
2:20
Why you can’t implement ERM with a memo.
2:30
PART 2:
Catalysts for inspiring appropriate risk management action
2:45
Group discussion
3:15
PART 3:
Applying change design to ERM Implementation
3:30
Group exercise
3:55
Closing Thoughts
Not to be reproduced without permission. 32

33. Questions and Conclusions
Diana Del Bel Belluz M.A.Sc., P.Eng.
Risk Wise Inc.
(416)
The three key messages we’ld like you to take away are:
Although risk decision framework helps you establish “Structural” ERM Capital, it isn’t enough. You also need to focus on building “Human” Capital (knowledge, skills, and culture) and “Risk Intelligence” Capital (information flow that act like the ‘central nervous system’ of your organization)
To engender a risk culture, you need to implement a few key catalysts. The best catalysts are feedback loops that drive behaviour; that’s why “Risk Intelligence” capital and feedback and feed-forward loops are so important.
Before implementing any catalyst, you need to think about what are the potential challenges and barriers so that you can design effective strategies for shifting culture.
INSERT COMMENT ABOUT OUR EXPERIENCE helping clients to overcome common challenges listed in the EXERCISE.
To effectively bring ERM to life and sustain it requires an organizational change approach and tools for change management.
An important and often neglected step in the change process is “Getting Agreement and Setting Direction”.
INSERT COMMMENT ABOUT EXERCISES.
Leslie Thompson MBA, MFA, FSCI, CMC, ICD.D
LESRISK
(416)
Not to be reproduced without permission.