In this episode Jo Shoppee, Head of Operational Risk – Technology at ANZ Bank, shares her unexpected journey into risk management, from a teller at ANZ to technology risk specialist. Jo discusses the challenges of balancing career and family, advocating for part-time roles for senior leaders. She emphasizes the importance of compassion and understanding in risk management, particularly in the three lines of defense model. She notes the shift towards data-driven risk management and the need to stay outcome-focused. She also discusses the top risks in the financial industry, including geopolitical risks, emerging technologies, and energy security.
Jo Shoppee: Jo is a commercially focused risk executive with extensive technology and finance sector experience, deep expertise in technology risk management, and a track record for building effective and trusted relationships. She has a strategic mindset, collaborative style and a passion for leveraging data and modern technologies for better customer, colleague and community experience. Jo is well-versed in balancing the desire for risk-taking in pursuit of strategic results, whist honoring the need for disciplined risk management to safeguard business value. Jo worked extensively across Europe in her time with General Electric, and has recently returned to ANZ, where her technology career first started, where she is the head of operational risk management for the Group Technology Division.
Jane Tumurbaatar: Jane is a Director at Protiviti with over 12 years’ experience in professional services. She has broad expertise across first, second and third lines of defence of risk management in financial services, government, and corporate organisations. Her experience extends to risk transformation, change management and remediation.
SHOW NOTES
02:14 Career Journey
05:05 Challenges and Achievements
08:39 Role of Compassion in Risk Management
11:05 Keeping Up with Technology in Risk Management
14:19 Changes in Risk Management Approaches
21:54 Leadership Style Evolution
33:41 Importance of Diversity in Decision Making
ACTION ITEMS
- Stay abreast of emerging technologies and risks, such as geopolitical risks, emerging technologies (like Gen AI), and energy security.
- Ensure that risk management processes and dashboards are focused on meaningful outcomes and actions, rather than just admiring the problem.
- Encourage young women aspiring to be leaders in risk management or technology to seek out mentors and champions within their organizations to help develop their careers.
- Promote frontline experience and a diverse range of certifications and industry knowledge (such as ISACA courses) for those interested in pursuing a career in risk management.
TRANSCRIPT
Kimberley Cole 0:01
This is Risky Women Radio, a show that connects, celebrates and champions women in risk regulation and compliance. We’re here to share the insights on the biggest issues in our industry and hear inspiring journeys from our global members. Sign up to our newsletter at riskywomen.org. I’m Kimberley Cole, your Chief Risky Woman.
Jane Tumurbaatar 0:22
Hi Jo. Thanks for joining me on the Risky Women podcast.
Jo Shoppee 0:25
Hi Jane. It’s a pleasure to be here.
Jane Tumurbaatar 0:30
Thank you.
Jane Tumurbaatar 0:31
I’ll do a quick intro of you. Obviously you’ve got a very impressive bio. So Jo Shoppee is ahead of non financial risk in technology division in AZ bank risk. Jo is a commercially focused risk executive with extensive technology and finance sector experience, deep expertise in technology, risk management and a track record for building effective and trusted relationships. She’s got a strategic mindset, a collaborative style and passion for leveraging data and modern technologies for better customer, colleague and community experience. Jo is also well versed in balancing the desire for risk taking in pursuit of strategic results whilst honoring the need for disciplined risk management to safeguard business value. Welcome Jo.
Jo Shoppee 1:35
Thanks, Jane. I really appreciate the opportunity to chat with you today.
Jane Tumurbaatar 1:39
Great. I think it would be a good idea to kind of start where your journey began. Obviously, you have a very interesting background, and in risk management, it’s there are fewer women, and also fewer the higher that you go up. So I think it’s quite impressive that you’ve built a very successful career. And I would like to begin with understanding how you got into risk management and what inspired you to choose this path.
Jo Shoppee 2:14
Great, great question. And I think you know when I when I think about my career in risk management, I would I would characterize it as a happy accident. I’d love to say that I chose this career and the path was orderly, and when I look back it’s certainly, it’s logical how I landed where I am today. But if you had of told my 19 year old self, when I first walked into my first branch as a teller at ANZ Bank, that this would be the career path that I’d have, it would have been hard to imagine. So I certainly began my career in the front line prior to telling at the ANZ Bank I was actually in retail, so really developed that kind of customer centricity and that real passion for advocating for the customer early in my career, in the formative years and I, ANZ was also the first opportunity for me to move into technology. So I moved into technology as a user acceptance tester in the in the early 2000s or actually late 90s, and that gave me a real insight into the opportunities for a technology career. And I think early on in my career, it was very much tech focused. So delivery, project management, user acceptance testing, assurance and the like. And it’s probably the early, mid 2000s that my risk career really took off. And that was posts of some of the really corporate, you know, corporate failures of the likes of Enron and WorldCom that led to the reforms around compliance and legislation like Sarbanes, Oxley and Basel II that we really started seeing Operational Risk Management start to be something more than good process management in technology. And so my career started shifting from one of technology focus to a risk focus within technology, and it kind of just ballooned from there. So it’s probably been the last five to eight years that my focus bit has been more broadly risk in technology than technology delivery and operations itself. But yeah, I’d love to say it was, it was an orderly choice, Jane versus probably a happy accident and and one that I’m really thrilled with.
Jane Tumurbaatar 4:39
That’s great. I think I speak to a lot of obviously, I’m in risk management myself, and I speak to a lot of people, and I get a similar response that, you know, the career path chose me, not me, so it’s great. And I didn’t actually realize that you started in ANZ as a teller. So it’s a full circle. Which is very interesting.
Jo Shoppee 5:01
It is, it is.
Jane Tumurbaatar 5:05
I think I want to move on to your challenges and achievements. I would like to know what sort of significant challenges that you faced in your career. And obviously our audience is mostly women. So as a woman, how that might be different for you and how you overcome that challenge?
Jo Shoppee 5:33
Yeah, well, big question, isn’t it? I mean, my mind goes to many places with that question. I think about, you know, earlier in my career, as I was happy in in a beautiful relationship, I’m pleased so I’m still happy in and we were contemplating a family. And that real challenge between the career path I was on at GE at the time with lots of international travel, lots of pressure, and a real passion for the roles that that that I had, and the career that that I was enjoying, and that so to to work through that process of well How do I prioritize this, this other huge part of my life that I really want to invest in. So probably there was a period of about a decade there where I had my my three children, and navigating, you know, I was already a senior leader at that point in my career, and navigating the pressures and challenges of that was probably the, the most significant thing that comes to mind from maybe that question. And I remember I had an amazing head of the people team at the time, and I was seeking his counsel. And I remember seeking his counsel on, what do I do? How do I balance these, you know, these demands in my life. And was really entertaining going part time, which I ended up doing, spoiler alert. And he said to me at the time, you know, if we can’t make this sort of thing happen for senior leaders like you, then what hope do we have to make it happen for our broader workforce? So we then sort of colluded to become really campaigners for making that senior leader role part time, and still enjoying a really fruitful, high exposure career. So I’m pleased to see we were say we were able to do that at the time. That was during my time at GE and I guess what I would say is I turned that from what I saw as a challenge to one that I saw as a crusade, and simply sort of then started to march through that, to open the door for others that that would follow. So it gave me just that extra, you know, that extra kind of incentive to to not be, frankly, broken by a system that that of norms and cultures and unconscious biases that really prevented that that sort of shift, radical shift at the time.
Jane Tumurbaatar 8:08
Yeah, and I think there are still parts of the world or parts of different organizations that women still face these challenges. So I think it’s good to know that there are avenues that you know, people can work through with their senior management or leadership team to make it work. So it’s really great to hear. Do you think being a woman has also benefited you in managing risk?
Jo Shoppee 8:39
Look, I think so I was, you know, as I, as I contemplate that question, I think there’s a range of, I think there’s a range of emotions and a range of, perhaps, strategies that that women have in their communication style, in their interactions, in the way they build relationships, that really brings a different dimension to the workplace generally. And I think that’s certainly true in risk management, if we think about the hardest days in risk management, and particularly in a role like mine at the second line, and probably even more so in in former roles at the first line, and the kinds of the review and challenge and then and the tension that’s built into the system across the three lines of defense. I would say that, you know, being able to negotiate from a place of compassion for each other is really important. I’m not suggesting for a minute that men don’t necessarily have compassion, but I think the social norms that we have in our cultures and in our workplaces is such that there’s a, perhaps a greater opportunity for women to demonstrate and voice that passion, sorry that compassion, and I think that does bring a dimension to conflict or, or, you know, disagreement that really benefits teams and individuals from being able to work through that, that conflict and that and that disagreement.
Jane Tumurbaatar 10:14
Great. And I think I’ve we’ve worked with together before, so I’ve experienced working with you and dealing with challenges together, so I can certainly vouch for what you’re saying. Let’s move the conversation more towards risk management and innovation, particularly, there’s a lot of rapid evolution happening in technology around the world, and it’s been a topic of mind for all the senior executives across different industries. How do you stay ahead of managing those risks or risks related to technology.
Jo Shoppee 11:05
Yeah, staying ahead, right? I think at this point in time, it’s more about trying to just keep up. And yeah, I think, like, sure, there’s a lot of change in technology, and we think about just the advent of Gen AI in recent years, and the race that organizations are, you know, enjoying at the moment, to get there first, or, you know, to introduce innovation through various technologies, cloud and and AI being two probably key top of mind at this point. But when you strip it all away, you know, without diminishing the complexities and the opportunity with those sorts of technologies, risk management, 101, still applies. And so I think it’s important to keep up with the, you know, the developments and the language and the the the types of opportunities that these technologies bring, but it fundamentally doesn’t change what good risk management principles are. And so I find myself when I’m involved in conversations, you know, what are we going to do now? Gen AI, how are we going to cope with that? You know? What does moving to the cloud mean? I find myself coming back to those risk, you know, 101, principles. And I think that brings a sense of calm and a sense of control to the conversation, and it it helps people understand that just because we’re dealing with a new technology or a new risk, it doesn’t mean that we don’t know how to do that because we’ve done it before. So I stay abreast of developing emerging technologies and try and make sure that I know enough to be dangerous in terms of the vernacular and what certain technologies are seeking to do, but I also hold my space in ensuring that the technical experts that I’m dealing with can actually answer questions that help me understand it at a lay person’s level. So while I might be able to talk to them on a technical level, I’m not going to be the technical expert in their field, and I’m also usually relaying information to non technical people. If I think about executives and, you know, risk committees and and board conversations, these are not typically technologists. And so it’s really important for me to play that translator role. And so in order to do that, one of the one of the strategies I employ is to always ensure that I can translate to layperson’s language, and I hold the technicians, the technical experts, accountable for really helping me do that.
Jane Tumurbaatar 13:53
Great. I think it goes to directly to my next question, which is, during your tenure, how have you seen risk management change, or the approach to risk management change? So I think you’ve touched on that already. But do you also envisage any kind of shaping to differ in the future and the industry?
Jo Shoppee 14:19
I’m seeing a lot of change, in fact, right now, in the in the role that I have at ANZ, I saw much, much similarly, this kind of change in my, my former role at Bupa and even at GE before that, and that is this, almost this, I mean, certainly, you know what, we’re bringing in more technology. We’re recognizing the need for data and analytics and insights, and that that necessitates the introduction of more sophisticated methods to manage risk and controls. And so I think we’ve certainly seen that shift from, you know, paper based, spreadsheet based. Into more system based risk management systems. I think as we’ve shifted towards that, I would say the risk is, or the danger is, that we our focus moves to risk process management, rather than risk management, something I’m pondering a lot of at the moment, like, how do we stay outcome focused and not get kind of caught up in the weeds of day to day management of the processes that enable us to digitalize our risk management system and then derive insights and analytics from it. And this might be a familiar phrase to you, Jane, you may have heard it when we were working together. You know, I always say to my teams, you know, the data is the What, the insight is the So What. But what’s the Now What? So, how do we turn the data that we’ve now got into our systems, into insights that are then actionable and meaningful, and what I do experience, I think, as I’ve seen, the shift towards greater leveraging of technology and data in our risk management approaches, is a potential for complacency, that we end up admiring the problem rather than actually getting to the risk outcome. So I think that’s a danger that we probably need to remain vigilant on and make sure that we’re not just sort of sitting there looking at our dashboards and going, Oh, that’s interesting, but rather actually getting to Well, so what, what does actually mean? Is it a useful dashboard? Is it, you know, and what action are we going to take from it? So I find myself repeating in many meetings these days, or what are the outcomes or so, what’s the meaningful action from that? So, yeah, I think we’ve seen that real shift away from, perhaps, if I think about the early 2000s with the introduction of, you know, Basel II and Sarbanes Oxley and then on from there, sort of the reforms post the financial crash, crash of 2009 that it’s a environment is is more data rich. I mean, it’s busier, and so there’s more opportunity for distractions. So I think, you know, remaining vigilant and and coming always back to what outcomes are we seeking? What outcomes are we seeing? And if those, if you know, if our plans or our results are not as expected or as required, what actions are we taking for that? So there’s a lot of noise in the system, I think, today, and we’ve got to remain vigilant that we still drive towards outcomes.
Jane Tumurbaatar 17:41
Yeah, that’s a great point. I’ve also noticed the shift in the industry towards automation and using, obviously AI to help with risk management. And hopefully, we’ll be on this journey quicker than than anticipated, and we can focus on the outcomes, rather than just focusing on the process to get the information out. I want to go back to the point that you made earlier, and I thought it was a very interesting way to put it is you’ve mentioned, we tend to look at and admire the problem rather than getting to resolving, do you want to expand a bit more on that?
Jo Shoppee 18:25
Oh, the hot seat. Yeah, I think, you know, I wonder how many people that might be watching this, this interview think about the number of times they’ve looked at a dashboard that hasn’t really changed, or, you know, a committee report that sort of says risks are, all, you know, stable, and ask themselves, have we become complacent with what we’re measuring? Have we, have we are we are we curious enough about what we’re looking at? And so I think, I think we need to make sure that we, if things are stable, that we don’t satisfy ourselves, that, you know, we can sleep well at night. We actually ask ourselves, are we, are we measuring the right things if we’re seeing things that are stable, and are we able to look at those things in the context of outcomes. And probably one of my bugbears is, you know, if our risks are all stable on the risk profile, why are we seeing outages? What’s causing those outages and and how do we have a feedback loop from the operational performance back to the risk profiles? So I think there’s, you know, there’s, there’s more we can do. And this is where I think, you know, more sophisticated analytics, or greater data literacy, and the use and leverage of new technologies such as Gen AI or just plain old AI and robotic process engineering can really help to inform that. So, so I’ve long been a crusader in operational risk management to learn the lessons from, you know, financial risk management. So think about credit risk or even information security. I think they’re really advanced in how typically, you’ll see security teams modeling threat scenarios and developing heuristics around their their threat landscape. I’d like to see a little more of that in the in the operational risk management side. Certainly around technology management, change management, service management, and even more broadly, across other dimensions, around people, risk and and conduct risk, risk and the like. So I think there’s, there’s much more we can do in operational risk management than we have, and that, you know, looking at the heuristics that might and that the the inputs that might be leading to the sort of outcomes where we’re seeing is kind of a real area of interest of mine kind of tapping into the frustrated data scientist that lives inside me.
Jane Tumurbaatar 21:07
Yeah, certainly. I think I agree with you, obviously certain types of risks are managed well, I think there are a lot of either scrutiny or focus on it, but it’d be great to have the similar level of level of risk management data availability on those risks as well. Just moving on to more around leadership. So obviously, you’ve been leading for many years, and you’ve been a risk leader for many years. How would you describe your leadership style, and more importantly, how do you think it has evolved over the years?
Jo Shoppee 21:54
Leadership style? I think I used to describe myself as a servant leader, but I’m not sure I would use that phrase anymore. You know, as I’ve I used to, I think I used to really identify with that. I think the heart of what I meant by that when I used to use that phrase was that my primary motivation is to create, create an environment where my people can thrive. I think servant leader now is, is, is almost it’s not the right phrase for I think the way that I, that I do, lead today, I think I would describe it more as a compassionate and purposeful leader. So still, at the heart of that is this real motivation to create an environment where my people can thrive and build an environment of trust and psychological safety, and then get out of the way and let them let them fly. And so that’s one. That’s my my people leader side of of my leadership style today, but I’ve become over perhaps more so over the last five years than any other time in my career, very conscious of the need to have kind of an individual presence as well. So where I may have once directed all of my energies into my team in that servant leadership style, I now appreciate that I can actually do a lot more for my team if I have this individual presence and brand awareness of my myself into that kind of peer group and upward management. So I now see the real value of of that, and the need to actually take some time for that and invest in that brand value and that, you know that proximity to power and that, and the reputation that I have with peer groups as an individual, not just as a leader. So that’s probably how it’s it’s changed for me over the years, is just, I wouldn’t say, darling, it’s like when you have an extra child, your heart doesn’t you don’t sort of divide the love up. Your heart gets bigger. So there’s a little bit of that going on, I think, with me, where, once upon a time, I was uncompromising on the investment I would make to my my team, and I now understand that, you know, I need to manage my time in a way that I invest in different strategies that have equally or greater impact on on the environment that I can create for my team.
Kimberley Cole 24:26
This episode is brought to you by Protiviti. Protiviti is a global consulting firm with deep expertise in transformation, risk management, and compliance, partner with Protiviti and face the future with confidence.
Jane Tumurbaatar 24:43
How do you think, you mentioned serving style leadership, how do you think that was shaped because of, maybe potentially, social norms, as opposed to something that you chose as a leadership style intentionally?
Jo Shoppee 25:04
I think certainly I’ve, I’ve benefited, benefited from some extraordinary leaders over the years. And particularly I spent 20 years at GE, and it was, you know, it was a, it was a university for leaders, really. And so I think that’s probably where I formed most of my belief system, I guess, around what a good leader looks like. Prior to that, certainly ANZ, I had, again, a number of extraordinary leaders who championed my development. And I think what I carried through that was, you know, as I was rising through the ranks, and as a kind of an entry level junior, kind of mid level leader through those years, what I saw was this championship of me, and probably the and so that’s where I formed this kind of, this view, this belief system, that servant leadership was the way to go, because I had these extraordinary leaders, and look what they did for my career, and look how they helped shape me, surely, if I modeled that, then I’ll be able to have the same sort of impact for others. What I realize now is I was only seeing the element of leadership that was impacting on me, and so what I wasn’t seeing was the other dimensions to their their successful leadership. And I would say, if I look back, you know, I don’t look back and have regret in life, in many places, and this certainly would would be an area where I don’t sort of look back with regret. But if I was able to tell my younger self something, it would be to get to kind of connect and have a mentor relationships, but I probably didn’t have the kind of relationship that helped me see this mysterious other size, other side to senior leadership in the way that I’ve experienced it over the last five years. So I would probably tell my my younger self, to get a little more curious about what else those leaders were doing in the fullness of their careers and in a typical day in the life of a senior leader. And then perhaps I might have, might have kind of got there faster myself, but yeah, I think about that, those sort of dimensions where we shaped by our own experiences, and we we see others’ you know, behaviors, performance, actions, through our own eyes. And so there was a lot, perhaps I wasn’t seeing, as you know, my younger self, that that I now see. And so it’s added, certainly, additional layers, additional dimensions, and I think increased my effectiveness in creating that environment for for my team to thrive as well.
Jane Tumurbaatar 27:44
Yeah, you’ve made a good point about how the organizations that we work for actually shape who we are as a leader or as a career person. So that was a very nice distinction. I hadn’t actually thought of that before. So it’s a very good point. I think you’ve mentioned before that how your leadership style has impacted your team over the years. Do you have any kind of specific or significant example that you think of how your leadership style has impacted your team or approach to risk management in general?
Jo Shoppee 28:33
Yeah, I think probably the common thread that I would weave through several of my past and even current roles is, is my willingness, maybe ability, to face into long held tensions or long held norms in in the kind of the the subculture of the organization, and seek to really identify what’s at the heart of that and change that. So I think there are always, particularly in the three lines model, and particularly around relationship between first and second line or first line and internal audit, I think there’s lots of room for disagreement. There’s lots of room for tension in those relationships. And so I think I probably bring a curiosity to that, particularly in a new role, and I’ll bring a curiosity to that. And don’t I’m probably, if I think about my two highest values, they’re integrity and inner harmony and so when, and they come out to play when there’s when there’s tension in a system. And I don’t need to necessarily operate in a harmonious environment, to have inner harmony, although it’s much more pleasant to operate and to work in a harmonious environment. But one might wonder why you choose a role in in the three lines of defense, if that’s what you’re seeking. But the inner harmony is is more about, you know, seeking to do the right things in the right way. And so I seek to bring that to that that tension, and look at ways that we can perhaps understand each other more deeply and understand the perspectives that different parties are coming from. So I’m often referred to, kind of as a as a peacemaker, and someone that can kind of come into a situation and compassionately consider both sides. And to some, you know, I’ve been accused over the years of kind of flip flopping from one side to the other, but I think that’s necessary, and it’s not about choosing sides. It’s actually about stepping to one side of the table and having a look at at how it looks from that from that point of view, and then kind of stepping to the other side of the table and having it look at how it looks from that point of view, and looking for common ground and looking for deeper, deeper understanding, or identifying misunderstanding and seeking to bring parties together. So that’s probably, uh, not sure if that answers your question. Jane, that’s probably one thing I would say is a kind of a golden thread through how I how I lead, is to seek to not only double down on, you know, supporting my own team, but actually seeking to understand more deeply another, you know, the other points of view that might be in the room that actually lead to, ultimately, hopefully, greater harmony, but if not harmony, certainly understanding and a deeper respect for the different points of view. Because I think the nature of roles in the three lines is is such that there is natural tension. There’s meant to be, and sometimes, when we’re doing our roles well, it results in disagreement. It results in, you know, potentially noise, or even sometimes complaints about, you know, the stance one party is taking over another. And I think, you know, we’re, we’re mature adults in the working environment, we need to be able to, we need to be able to face into that in productive ways, and also accept that recommendations may not be taken up, or, you know, points of view may not be agreed on. And ultimately, there’s someone that has decision rights and and that we can, we can accept that and kind of get on with things. So, yeah, I think I like to think I bring a maturity to that curiosity, to that and a compassion to that, motivated to understand different points of view, and then, you know, move forward together in the best way possible.
Jane Tumurbaatar 32:52
I think it’s a valuable ability to be actually be able to see from a different perspective. I don’t think many people are able to do that. So it’s it’s a strength, yeah. Moving on to diversity and inclusion, obviously, it’s been a topic on a lot of leaders minds. There’s been a lot of diversity and inclusion, inclusiveness initiatives happening around the world. From your perspective, how do you see diversity within a team affect decision making and decision making in risk management as well?
Jo Shoppee 33:41
I mean, I think we all know by now, or we’ve all heard by now, that that you know, diversity is only good for business, and the more experiences, the more diversity you can have, whether it be you know, gender, sexuality, religion, ethnicity, ability or experience in in, you know, various roles we we bring to the table our lived experience. And so the more breadth of lived experience that we can bring to the table, then the greater the opportunity for innovation and creativity, and indeed, the greater opportunity to identify and deal with unconscious biases, because we all bring those to the table as well. So that’s kind of the, you know, the general stance I take on on diversity and and I wholeheartedly believe in that. And then when I bring that down to kind of when I think about gender diversity in particular, and had some experience with this, obviously being a woman myself in what is a fairly male dominated environment with technology, and also previously in kind of manufacturing and data centers. I had some stints in those as well, and often the only woman in the room. And. And so that coupled within some experience I had at Bupa, leading the tech agenda program for technology, which was the Bupa technology, you know, gender diversity program, what I would what I kind of learned, I think, through that, is it’s one thing to focus on the numbers. It’s another thing to then get to the engagement that’s necessary. So couple of things that I think about around diversity. One is, you know, get focus on the numbers. Get the numbers right. And, you know, I’ve heard people say we shouldn’t, simply shouldn’t be talking about the numbers. But if we’re not talking about the numbers, I hope that’s because we’re at parity, not because we’ve hit some 25% target or 30% target that’s been set. So I get a little bit triggered when I see things like a 30% target of women in technology, for example. And I go, why 30? Why not 50? And I get all of the academic reasons why it’s not 50. You know the notion of women dropping out of STEM subjects, and, you know, not having the the the talent pool to pull from. I am a little bit controversial on that and say, bah humbug. I don’t, I don’t agree. Okay, there might not be a talent pool that allows everybody to go after parity, but if you’re serious about gender, then go after parity. The second thing I would say is the numbers can lie. So you might have the numbers on any given day, but you also need to look at attrition, and are you actually keeping or you, are you keeping the women, or are you recruiting constantly in a churn to replace the women. So check underneath the top line numbers and look at what what the story really is under there. And then my second would be engagement. So you know, most organizations will do some form of a pulse survey, culture survey, engagement survey periodically through the year and looking at the differences in the experiences women may have, or other groups around diversity might have, is also another clue there. So when I think about diversity around the table now, I think about, well, you know, do we have balance in ethnicity and gender and ability and and the like, but then also, do we have parity in participation around the table, so we might have the diversity around the table, but who’s speaking, and invariably, What? What? When you open your your mind to that, and you start becoming conscious of that, what you typically find is there’s a smaller subset of group of people speaking more often. So I think it’s really important to get under the numbers and have a look at, you know, what’s the what’s the culture within the organization and who’s speaking, and what’s engagement like, what’s participation levels like, and what’s retention like.
Jane Tumurbaatar 37:58
I think, in my past, experience Risk Management has been considered very male dominant compliance specifically. Do you think that is still the case, or have we shifted more towards parity at this point?
Jo Shoppee 38:17
I’m certainly seeing a shift. I’m not sure I’m a good measure of that, because I’ve shifted out of this, my first role out of technology for about 25 years. So my role now, I’m certainly seeing I’m rarely the only woman in the room. In fact, I’m benefiting, you know, I’m enjoying being half of the room and sometimes even the majority in the room today as a woman, but I’m conscious that that’s outside of a technology environment. So I think within technology, there’s still, there’s still work to do, still, you know, still work we need to do. But I’ve certainly seen that shift over more so over the last decade than perhaps any other time in my career. I’ve become aware that I now, I notice if I’m the only woman in the room now, whereas once upon a time, I noticed if I wasn’t. So I think that, for me, is kind of an anecdotal indicator that things are changing. But I’m not sure there’s still, certainly pockets, you know, pockets where that wouldn’t be the experience I think, of of women.
Jane Tumurbaatar 39:28
Yeah, yeah. I think I’ve, personally, I’ve been noticing the shift myself as well, even in my team, majority women in risk and compliance team. So an interesting shift that’s been happening over the years. So as a leader, you’re a very experienced leader. What advice do you have for young women who are aspiring to be a leader, specifically in risk management, if they choose to do that or technology?
Jo Shoppee 40:02
Um, what was that sorry, or technology? Yeah, I think we hear a lot get a mentor or get a champion. And I think that, you know, don’t underestimate the benefit, the value of having a really close mentor relationship and also, I’ve come to learn the difference between a mentor and a champion, and don’t necessarily just go for one. I think I would, I would recommend for a young woman seeking leadership in any of those those disciplines, whether it be risk technology, risk information security or technology or elsewhere, the value of having mentors, and women mentors as well as men, but also then, champions are really key to growing your careers. So I think mentors the value for us all to have a mentor, a couple of mentor relationships to explore and develop and and have an outside in curiosity on experiences that we might have. But then I think, separate and additional to that, the I you know, identifying a champion within an organization or a field that you’re interested in growing your career is really key. Not sure that’s specific to women. It’s certainly, I think, true for anyone, but I think being purposeful about it as a woman is probably the key. I think we’ve still got some societal norms at play that probably advantage men in developing some of those relationships in a more informal way, whether it be, you know, I know plenty of women love motor racing and footy and play golf and and and like a beer at the pub, but those the social norms that that still exist around some of those things, I think mean that there is a greater opportunity for men to develop those informal championship relationships. And I think to young women, I would say, be really purposeful and specific about that. Find yourself great mentors and find yourself great champions. Be really clear about who they are in the organization and how they can actually help ensure your name is in the room when conversations are happening about opportunities for growth and development or promotions or succession planning.
Jane Tumurbaatar 42:32
I think you raised an interesting point about having mentors, and specifically around having diverse mentors, so men, women and also potentially people with different experience. I think that would really help a young professional to have different experiences or different advice to help with their career, regardless of what they choose to do. Are there any specific skills or experience that you think they should seek out, maybe, if they want to be in risk management, is there certain risks that you think they should know about or study?
Jo Shoppee 43:18
I think, um, I mean, again, at the risk of the risk of saying, you know, my career journey is the right one. I think it is invaluable to have frontline experience in any role, but particularly in risk management. I think it it helps you maintain a vigilance and realism to the often rather abstract world that we operate in. I think so that would be one thing. If I think about the things that stand me in good stead in my role. Now would be, you know, frontline experience, customer centricity, born out of that frontline experience. It would be the and these are somewhat generic, right this, before you get into some of the technical skills, it would be having a deep passion for doing the right thing and doing things right. And so I think I developed that in my formative years at at GE, who had a culture of integrity beyond that that I’d ever seen and before or since, and that is the spirit and the letter. And not only following the letter of the law and we think about in our world regulation and legislation, but also seeking to understand what spirit of that is, and that’s actually at the heart of compliance and regulation, right? It’s actually about codified rules that are set to ensure that the expectations of our community are upheld in our conduct and our actions and our operations. So I. Think, you know, a strong sense of moral and ethical action and behavior is really key. But then I think, I mean, I’ve benefited, I’m a bit of a I’m a lifelong learner, and I’m a bit of a paper collector, so I do, like, I’m really motivated by learning, both informally and formally, and I think really focusing in, if you if you’re looking for a, you know, technology risk career, then I think there’s a lot to be gained from studying there’s many industry options around that. But certainly one that I tend to favor and have over the years, it’s been really valuable to me is the range of courses available and certifications available through ISACA. So when I look across my team now, there’s a breadth of the breadth of certifications and experience and knowledge that’s been gained through a range of you know whether it be COBIT or NIST or or ITIL, learning and development. So I think there’s a in particularly in technology risk management, information risk management these days, there’s quite a lot that you can do to develop your knowledge and understanding of those environments with formalized courses. So I think there’s quite a bit to do to invest in there, but never discount the value of just good old fashioned experience and diversity of experience. But yeah, if I had to choose one thing, Jane, it would be frontline experiences. It’s just no and whether that be, you know, organizing to visit and and be, you know, be in the in the frontline environment, in whatever organization you’re operating in at the time, or actually taking a role there for a period of time or doing a rotation there, I think it’s an extraordinary developmental opportunity for everyone.
Jane Tumurbaatar 47:07
Yeah, I certainly agree. I think I’ve been in consulting for a long time, and when I moved into firstline, that’s when I really understood the impact of the recommendations that I was giving and what it actually means to manage risk. So I think it’s made me certainly a better risk manager and advisor as a result.
Jo Shoppee 47:30
Yeah, I would say the the converse is true. I mean, my journey right now is to move from the first line to the second line. I get a real sense now of the kind of I mean, well I call it anxiety, the kind of pressure I felt in the first line around delivery and the the compromising effect that the pressure, compromising pressure that placed on diligence and moving to a second line role. Gotta say, I’m actually really enjoying being able to sort of really immerse in that, that just diligence, without the pressure of delivery. But I’m very, very conscious and compassionate towards that, the reality of of the pressures that our teams are facing in in that more first line role. So yeah, probably the converse with probably nice bookends, Jane.
Jane Tumurbaatar 48:20
Yeah! So my next segue is around personal insights. But before we get into more personal topic, I would just like to ask what, what you think the top, I don’t know, three maybe risks might be for for you or for leaders like you in financial industry?
Jo Shoppee 48:51
Top three. I think I feel like this is a bit of a Vox Corps. I think I mean geopolitical risk is, is, you know, is, is soup de jour at the moment, right? I think certainly that’s why that’s getting a lot of attention. Emerging technologies is another and, yeah, you know the What, the How are we going to ensure that we have ethical conduct and ethical practices around Gen AI in particular. And probably the other one that would is top of mind for me, would be almost this art nouveau version of concentration risk that we’re seeing with, you know, the the the hyperscalers that you know, if you think about the shift to the cloud, and even now AI, and the hyper scalers that exist globally around that, and then the concentration that risk, that that that that is generating in a in a way that we probably haven’t seen since we started really looking at the geographical concentration risk a couple of decades ago. And then underpinning that, if I think particularly in fact, where you bring all three of those together, you’ve got geopolitical, you’ve got emerging tech, and you’ve got these hyperscalers, and all of that runs on energy. So if we think about oil and we think about coal and we think about energy, then they might be the three, but probably the macro level one for me would be probably energy security at this point. And I think about, you know, the I think about the the the huge demands we have now on power for large language models, and this, this insatiable appetite that organizations around the globe have for adopting Gen AI, and I think about the, you know, the hyperscalers that are innovating to give us easier access to more exciting innovations around the use of Gen AI, and that’s all. It needs to be powered. Needs to be powered. And it’s, it’s, you know, we’re seeing that the the demand for power go up. So I think energy security is probably at the heart, probably by the thing that if I had to choose something that would start keeping me awake at night, that’s probably the thing I would choose.
Jane Tumurbaatar 51:28
Yeah, that’s a really good point. I think I recently heard a fact that the data centers are obviously requiring much more energy because of the use of AI. And it’s, yeah, and, you know, a data center uses, you know, 1000s of households’ energy in a single day or single hour. So it’s the impact is big.
Jo Shoppee 51:54
Yeah. And I think I saw a headline last week. I want to say it was Amazon. Don’t quote me on that. Certainly one of the hyperscalers, I think it was Amazon has purchased a nuclear power plant in in the US, which really goes to the kind of bets that they’re the hyperscalers are starting to have around around energy as well. But, yeah, I think it’s a real emerging, emerging risk that we better all keep our eyes on.
Jane Tumurbaatar 52:20
Yeah, certainly, I think I’ve seen the same headline as well. All right, so I would like to close the podcast and this interview with something a bit more personal. So I would like to know outside of work, what your passions and hobbies are that you pursue in order to help you balance your work and life and family.
Jo Shoppee 52:51
I’d love to say, firstly, Jane, that I’m still practicing daily yoga, but I can’t! I’ve kind of fallen off the wagon a little bit. So really doing that so much, I I’m looking forward to a summer on my paddle boards. That’s like my favorite, favorite place in the world, outside of being at home with my family is out on the on the water, on my paddle board, with the, particularly on days when the dolphins pop up. So yeah, that’s sort of my favorite pastime in summer. I really enjoy, although I haven’t gotten to it as much this year as I have in past years, a cold water dip in the sea in in the winter. So I live, I live near the sea in a beautiful part of the world. And so my pastimes outside of work really center around walks along the beach, paddleboarding, dipping in the sea, and when you’re not finding me there, you’re probably finding me in the kitchen baking something or making something. So they’re probably my favorite pastimes, and one probably new one that’s actually arisen, perhaps less healthy, but certainly really enjoyable since I’ve taken on this new role and I’m spending a little more time in the cities, is discovering all the hidden bars of Melbourne, and, you know, the best cocktail rooftop bars. So that’s kind of a little bit of fun as well. But I do try and temper that with little more walking on the beach and a little more dipping.
Jane Tumurbaatar 54:26
To balance it out.
Jo Shoppee 54:28
Yeah!
Jane Tumurbaatar 54:31
All right, I think that ends my questions. Thank you so much for your time and indulging me in many different topics and questions. I really appreciated you sharing your insights, and it was great spending time with you.
Jo Shoppee 54:48
Yeah, thanks for the invitation, Jane, it’s been really nice to catch up.
Jane Tumurbaatar 54:53
All right, thank you.
Kimberley Cole 54:55
Thank you for listening to this episode of Risky Women Radio, be part of the ongoing conversation and learn more about our events and other programs at riskywomen.org