By Ruby Chen
for the 2024 Risky Women Writing Competition, presented in partnership with Bovill Newgate
Explore the unique challenges faced by unregulated organizations in designing risk management frameworks. It advocates for an integrated, agile approach to risk management that emphasizes real-time visibility, collaboration, and dynamic assessments. By embedding risk management into daily processes and fostering diverse perspectives, organizations can effectively navigate current and emerging risks for long-term success.
In the world of Governance, Risk, and Compliance (GRC), unregulated organisations face unique challenges in designing risk management frameworks. Regulated industries, governed by bodies like the Australian Prudential Regulatory Authority (APRA) and the Australian Securities & Investments Commission (ASIC), follow local regulatory requirements. For unregulated organisations, however, flexibility is necessary, and this requires a more tailored and thoughtful approach to risk management.
As a consultant working on enterprise risk transformation projects across multiple sectors, I’ve seen how unregulated organisations must often rethink traditional frameworks. It’s not just about adhering to a benchmark or global guidelines. These organisations must ask: Why do we manage risk, and how can we make it meaningful?
The answer may lie in adopting an integrated agile risk management approach. In my conversations with Malcolm Eng, TPG Telecom’s Head of Risk, who had previously transitioned from the regulated financial services industry, believes that “Risk management unfolds in every decision and action taken; it isn’t confined to formal systems. Fostering risk awareness where it matters, guides informed choices, leading to better outcomes.” In this article we explore how organisations can integrate risk management into its daily business processes to address current and emerging risks more effectively.
The Case for Dynamic Risk Management
Organisations vary in size, nature, product offerings, and reputation. While ISO31000 offers valuable guidelines, the operationalisation of such guidelines would differ between different organisations. Organisations may benefit from implementing a dynamic, flexible risk management approach that provides more business-specific value.
Risks evolve rapidly, and static frameworks relying on periodic assessments are no longer enough. Organisations may benefit from agile risk management where business decisions have the opportunity to pivot in real-time to enable proactive risk mitigation. We outline three risk management enhancement opportunities below for organisations to consider.
1. Integrated Dynamic Dashboards
The foundation of agile risk management would begin with visibility. Organisations can implement dynamic dashboards that integrate existing enterprise architecture systems, Enterprise Resource Planning (ERP) systems and Governance, Risk and Compliance (GRC) systems. A centralised dashboard would provide real-time analytics on business performance and overlay these with risks across the value chain.
Risk ratings could benefit from being dynamically recalibrated based on incidents, issues, remediation activity and complaints —eliminating the need to wait for periodic assessments. For example, a product manager can instantly see how a customer complaint impacts their product’s risk profile, allowing for immediate action. This real-time monitoring of risk ensures that mitigation efforts remain effective, with teams adjusting controls based on current data.
2. Collaborative Tools for Real-Time Risk-Related Discussions
A common issue in many organisations is the lack of clarity and business understanding of the roles and responsibilities of risk, compliance, legal, audit and other governance functions. Business stakeholders often view these areas as opaque, leading to at times hesitation when addressing risk-related concerns.
By leveraging collaborative tools—such as live chat platforms on internal communication tools like Slack or Yammer—organisations can break down these barriers. Stakeholders can raise queries as they arise, hash tagging key themes, tagging a central team to triage and resolve queries in real time through a fast-ticketing system.
This approach fosters greater transparency and reduces the stigma often associated with sending email queries to a “black box”. The ability also to escalate concerns quickly, without waiting for the next round of formal reviews or committee approvals, enables more efficient risk management. Live, ongoing discussions also ensure that risk documentation is current, and that relevant stakeholders are continuously engaged in the risk management process.
3. Risk Sprints
Traditional risk management frameworks rely on periodic assessments, such as annual or bi-annual Risk and Control Self-Assessments (RCSAs). This static approach doesn’t capture the fluidity of modern business risks, especially in rapidly changing environments.
Agile risk management introduces risk sprints—short, focused sessions similar to project stand-ups. These sprints can be applied to manage both delivery and business-as-usual (BAU) or delivered risks. Teams should be encouraged to identify emerging risks, assess impacts, and adjust mitigation strategies near real time.
For delivery-specific risks, these sprints can be integrated into Risk, Assumptions, Issues, and Decisions (RAID) sessions. This real-time approach keeps all stakeholders informed and ensures understanding of critical risk information, especially if some delivery risks transition into delivered risks.
Another element worth considering is the sprint’s organisational culture. Ensuring there is diverse representation and voices can also make the sprints more effective. Eng says “Women bring a wealth of experiences, unique skills, and fresh viewpoints that can strengthen our ability to anticipate what’s ahead, adapt our strategies, and make better decisions”. Organisations that leverage varied insights are better positioned to navigate complex, fast-evolving risks.
Key Takeaway: Embedding Risk Management
In unregulated organisations, the freedom to design bespoke risk management systems brings both challenges and opportunities. Success lies in moving beyond adopting traditional frameworks but rather embedding an integrated agile risk management approach that is dynamic and flexible.
Real-time dashboards, collaborative tools, and risk sprints enable organisations to create a proactive risk management culture. Rather than treating risk management as a tick box exercise, this approach embeds risk management into daily business processes, adding value and supporting long-term success.
Diversity also plays a key role in the embedment of this approach. Eng also believes that “in today’s ever-changing environment, diversity of thought can transform obstacles into opportunities, differentiating survival from success.” By empowering diverse voices, organisations are better equipped to anticipate risks, adapt strategies, and turn challenges into advantages.