Page 63 - iiA

Taskforce have harped upon and intend to deliver • Culture of ‘fail fast’ : Need for organisations
to the industry, regulators and external agencies
through the Model Risk Code include:
• Perceiving Risk Management as a organisations to promote creativity, and
‘competitive advantage’, not compliance :
Need for appreciation for risk management
as being able to offer novel opportunities and
create a significant competitive advantage if
dealt appropriately, else may also lead to an
existential crisis.
• Risk Management as an ‘enabler’, rather
than a ‘detractor’ : The analogy one may use
is about brakes in a car, you can drive as fast
as you want because you know there is a brake
that can slow down your speed when required.
A good and well-governed risk management
framework is also meant to allow businesses
to take faster, bolder, risk-informed decisions,
knowing very well that if things go off the track,
the risk management framework will quickly
pick it up and enable course correction.
• Busting the myth of Internal audit being
entasked to play the role of Risk Management
function: Internal audit is an independent
third line of defense, i.e. more of a monitoring
function, whereas, Risk management needs to
be owned and managed by the business - first
and second lines of defense. While internal
audit provides an independent assurance,
Risk Management is a partnering role with
the Strategy or equivalent function in terms of
future proofing the organisation.
• Tone from the Board: How it needs to lead by
committing requisite resources for enhancing
risk management processes including people,
technology, external partners, time, attention,
training, and communication. Also, how it
needs to set expectations, and define the scope
and frequency of risk reports it expects to
receive from executive management including
heat maps to reflect significant risk factors.
• Building KRAs around Risk Management:
Need for embedding risk considerations in
strategic and business decision making into
the DNA of the organisation. Embedding risk
considerations and defining responsibilities
for various parts of the risk management
process to be made part of the KRA definition.
INTERNAL AUDIT TODAY
to promote a culture of ‘fail fast’ and celebrate
such early- stage failures. Early-stage failures
have a lower impact which in turn allows
innovation, and a culture that offers a chance
for course correction.
• Using the ‘What if’ approach: Consideration
and evaluation of scenarios beyond the
Business-as- Usual activities by using the
‘what-if’ approach to scenario building which
will allow managers to brainstorm and prepare
for specific downside events and plan for the
unexpected.
• Stakeholder engagement: How critical it is
to engage and communicate with internal
and external stakeholders, i.e., employees,
customers, vendors, third parties, lenders,
regulators, shareholders, and the community)
to appropriately address the various risks
emanating from them.
• Ability to foresee risks / disruptions: How
organisations need to get better at scanning
internal and external environment to identify
noise, signals which could eventually hit as
real risks.
• Addressing ‘early warning signals’: Realising
that small failures or seemingly insignificant
individual risk events that are causing losses
may be ‘early warning signals’ that, if not
detected and addressed in time, may lead to
catastrophic failures.
• Need for enhancing the Risk organisation
structure:
1. Merit in widening the applicability of a
60