Podcast S9E2 | Obituary for the Risk Matrix with Sabrina Segal

TRANSCRIPT

Kimberley Cole 0:01
This is Risky Women Radio, a show that connects, celebrates and champions women in risk regulation and compliance. We’re here to share the insights on the biggest issues in our industry and hear inspiring journeys from our global members. Sign up to our newsletter at riskywomen.org. I’m Kimberley Cole, your Chief Risky Woman.

Kimberley Cole 0:23
Welcome to Risky Women Radio. Today’s risky woman is a licensed US attorney and a Certified Fraud Examiner with 20 years plus experience of leading and supporting internal audit, fraud detection, legal risk compliance, due diligence, ethics, integrity and project management, work in public, private and multinational organizations in the humanitarian and international development sectors. She has a huge range of experience that we will talk about, and let’s just share the international environment. She has worked in Angola, Egypt, El Salvador, France, Guatemala, Iraq, Israel, Italy, Jordan, Kazakhstan, Liberia, Malawi, Mozambique, Namibia, Nepal, Nigeria, Pakistan, Rwanda, South Africa, UAE, USA, Uzbekistan and Zambia. And I like how it was all in alphabetical order. So welcome Sabrina Segal, Director at The Risk Collaborative.

Sabrina Segal 1:27
Thank you so much for having me. I’m thrilled to be here today.

Kimberley Cole 1:30
Absolutely! I mean, what an amazing list of countries. But before we get into all of that, tell us about The Risk Collaborative, because I’m really interested to learn more.

Sabrina Segal 1:43
Sure. So The Risk Collaborative is a nonprofit initiative that was formally launched in January of 2025 but really has sort of been living in my brain rent free for a few years, because, as you gave my that lovely introduction. I’ve been in the international development and humanitarian charity, nonprofit space for more than 20 years. I started out my career with the US government, so working with a major donor, and then I moved to small, medium and large international organizations, small national organizations, things like that. And one of the things that I’ve picked up over the past maybe 10 years of my experience is how the concept of risk has become a lot more crystallized in the third sector. So when I say third sector, it’s not the government, it’s not the private sector, it’s sort of the charity space. When I first started, it wasn’t so I won’t say relevant, but it wasn’t so formalized and structured. But over the years, as funders were giving more and more resources, they started requiring more and more structure around risk and compliance and oversight. And the other thing that I found was that a lot of these organizations were established because they saw a need in their community. They didn’t necessarily establish themselves because they wanted to manage procurement according to a big INGOs procurement environment, and so the concept of risk in the third sector was not new to these organizations, because they were managing risk all the time, but the formality was quite novel, and they started to import a lot of tools and approaches that were used in the private sector, which weren’t really appropriate for the third sector. And so I did a little bit of research, and was saying, Well, what’s best practice in risk in the third sector? And I couldn’t really find much. And so, you know, over my research, over these past 10 or 15 years, we’ve sort of established The Risk Collaborative, which is really a part of the Charity Finance Group in the UK. They’re being wonderful in incubating The Risk Collaborative right now, we’re working very closely with them, but it’s really a space to provide information, some learning, some collaborative as it says in the name get togethers to talk about and amplify really good and unique and different risk management approaches in the charity sector that really work well for large and small and medium INGOs. So we do advocacy around risk sharing, we do training around different ways to do risk management in the sector. And yeah, it’s been a great experience so far. And watch this space, because the Collaborative is going to be doing a lot more in 2026.

Kimberley Cole 4:16
Brilliant. That’s fascinating. And obviously you’ve had an incredibly International career in so many amazing countries that we just heard about. So sort of take us on that journey a bit. You sort of started some of that, but tell us where and how you got to all those places.

Sabrina Segal 4:31
So I always knew I wanted to do something bigger. And I went to law school because as a young woman, I was living in Washington, DC at the time, and as a young woman living in a capital city, if you really want to get into the mix, it’s very difficult because it’s usually older men that are kind of running everything. So I realized that I needed some sort of credential, some sort of bona fides, in order to be able to continue to move in the direction I wanted. So I went to law school. While I was there I studied International law and commercial law. There really is no such thing as international law. It’s just simply treaties and agreements and what people are willing to compromise on. And I loved that concept, and I also really knew I wanted to get into charities and nonprofits and humanitarian work. So it was a great combination. I was able to start my career with the US Department of State, and what existed at the time was USAID, and that was really launched me into the humanitarian and development space. And then a lot of the countries that you listed, I was able to work in and go to, when I was with the US government, I moved into an oversight role in the Special Inspector General for Afghan reconstruction, looking at a lot of the Afghan programs that the US government was funding, and then I had had enough of being in DC and I moved overseas, and really just had some fantastic opportunities with organizations large and small, everything from working in a headquarters on contracts and compliance in the UAE, to being in a Syrian refugee camp in Jordan and working on water sanitation and hygiene programming and food distribution. So I’ve been very lucky in my career. I’ve sort of had a depth and breadth in the sector, and been able to see it at a lot of different levels. And it’s been great. It’s been a great adventure.

Kimberley Cole 6:10
And where are you now?

Sabrina Segal 6:11
I am I am dialing in from Kigali Rwanda. So probably…

Kimberley Cole 6:16
It was amazing when we got an application for the writing competition from Kigali – it was like wow!

Sabrina Segal 6:23
I’m gonna let a lot more of the women around here know, because Rwanda is a really fascinating country. I mean, it’s a landlocked country in, you know, East Africa, but they’ve really focused a lot on education. They’re focusing a lot on technology and AI and a lot of people know the country because of the genocide that happened in the 90s, but they’ve moved on so much more from there, and it’s a really fascinating place. So I encourage any of your listeners, come out to the warm heart of Africa is what they call Rwanda. Come on down.

Kimberley Cole 6:52
Yeah, beautiful. And obviously you’ve done so many things. If you’re going to pick out a highlight, what would you say was the highlight of your career to date?

Sabrina Segal 7:02
I guess. I mean, I’m not that old. Come on, don’t maybe it’s like having to pick one of your favorite children. I mean, I did a lot of really interesting things when I was a lawyer with the government. You know, you really get a great opportunity to negotiate interesting agreements and represent the government in court. But I have to say, I think recently, the most exciting thing that I’ve done is probably launched The Collaborative, because there just really was this gap in the space. You have a lot of kind of interest groups around finance and safeguarding and things like that, but nobody was really talking about risk from the charity point of view. Everyone just sort of got a big arm wave and it just said, Okay, we’re going to fill out this risk register, and you know, everything’s going to be fine, but when you really unpack it, it’s fascinating. I’m going to get a little nerdy now, because I’m actually doing my doctorate. Shout out for the University of Bath in the UK, but my area of research is risk management in charities and nonprofits. And when you get into it, it is such a different operating environment, because, for example, if you’re doing risk at a bank or a petrochemical company or something like that, you know you’ve got your R&D department, you’ve got maybe your customers, you’ve got your product and is quite linear. In the charity space you don’t really, you can’t really define who your customer is, right? Is your customer, your funder, is your customer, your beneficiary or your participant in your program. There’s a tension there, and there’s a lot of questions around power dynamics. And when you mix power and risk and decision making, it can become quite a complex environment. And so again, with the collaborative I think that’s been the most exciting thing so far, because it’s providing a space for charities to think differently about risk. Think of it in a more strategic way, as opposed to an operational way. And when you’re working with organizations that have very limited resources, any little bit of advantage that they can get helps, and I firmly believe that thinking about risk differently can give them such an amazing advantage, and it just delivers more impact in their programming for the communities that need it. So so that I would say Risk Collaborative is probably the best thing so far.

Kimberley Cole 9:11
Yeah, I think it’s really interesting, really entrepreneurial, and I love it, that it’s that positive – How does it give you an advantage? How does it differentiate you? I think you’re doing an amazing job. So, yeah, really, really great. And what I guess, when you think about your career, how have you distinguished between a risk that you think is worth taking and risks that you think should sort of signal some kind of caution?

Sabrina Segal 9:41
So that’s a great question, and it’s really funny, because I think my training as a lawyer has given me a slightly different point of view on things. A lot of times people go, Oh, well, you’re a lawyer. You must be very conservative. And it’s actually not the case for me when I’m looking at risks worth taking, which I would reframe as opportunities, right? Or risks that signal caution, which I would call threats. To me, it’s just all about information. It’s just, can we go in with our eyes open? You’re never going to understand the complete environment, right? But can we understand enough to not only say, Well, if all these things go sideways, that’s really going to be bad, but also, if these things go well, or even if a fraction of them go well, what’s our additional impact that we’re going to be able to have on our community? And I think, to me, that’s the most important thing. And so it’s funny because people say, Oh, well, you’re a lawyer doing risk, but you’re really encouraging people to push the envelope. That seems a little bit odd. But again, in the charity space, if we don’t do that, if we’re too conservative, we’re never going to have the impactful programming that we really need to have to kind of get things to change in some of the spaces that charities work in.

Kimberley Cole 10:53
Yeah, absolutely. Yeah. I did some work in the stop slavery space, and just so challenging in so many of those areas, and looking at all the different charities trying to do different elements in that area. Yeah, you’ve got to be, as you are saying, entrepreneurial, and look at how you’re going to push things and change things. And I guess when you’re doing some amazing things, what’s that kind of legacy, or what’s that ultimate thing that you want to leave behind in terms of impact?

Sabrina Segal 11:28
Well, I mean, hopefully one of the things that The Risk Collaborative is really trying to now start to introduce, and some facilitate conversations about, is this concept of risk sharing in the third sector. And this goes back to a little bit of what I was talking about earlier with power dynamics and things like that. So like I said, as I saw over the past maybe 10 or 15 years in my career, risk was becoming more formalized, and organizations were being asked to do more and more oversight, compliance reporting with fewer and fewer resources, and what we ended up having was quite a large power gap. We already have a power gap between funders and recipients, but these additional requirements, these additional assurance requirements, was making that gap even more and a lot of organizations were being forced to subsidize these additional things that funders are asking them to do because the funders won’t fund overhead. For example, they won’t fund an improved IT system or a better accounting system in order to generate some of these bespoke reports that these funders are demanding. And it was causing organizations to more rapidly go down what’s being called the starvation spiral within our space. So organizations are being asked to do more and more with less and less essentially. And risk sharing is a concept that really should have been around for a while. People do risk sharing in the commercial space, but it’s because in commercial transactions, you tend to have equal power, and you’re doing sort of arm’s length transactions in the charity space, people are running after resources, so risk sharing is now getting its day, and I’m hoping that a lot more advocacy and training and education that we can do with the collaborative will bring that there to help facilitate these conversations between funders and recipients. In order to, I’m not going to say shift the power for the people who work in the third sector. You’ve heard that phrase a lot. We’re shifting the power. I respect that phrase, but I don’t believe it, because no funder in their right mind is going to give up their own power. What we need to do is rebalance the power, and we can do that by empowering the recipients so that their power level starts to come close to funders, and we can do that through risk sharing. So I always say that I really want to rebalance the power in the third sector through the lens of risk, and I believe that we can do it because risk is something that funders always want to talk about. So if partners can come to the table empowered and negotiate from a position of strength, then we’re able to really start to kind of understand where these funders can be picking up that risk conversation and supporting their implementing partners in a more partnership kind of way fascinating.

Kimberley Cole 14:13
I really feel like we could have another podcast on so many of these areas.

Sabrina Segal 14:16
Let’s do it. Let’s do it!

Kimberley Cole 14:19
So just to leave this section, what do you think is, it doesn’t necessarily have to be an emerging challenge, but a challenge in GRC that you think disproportionately requires women’s voices and leadership?

Sabrina Segal 14:35
That’s a really good question. And like we were talking about a little earlier, I think gender, as much as you know, I was raised second, third wave feminism. Women can do anything they want. When you step in a room, and particularly in the risk space, which has been sort of dominated by the male finance types for so long, people look at you and they go, Oh, wait, you know what’s she doing here to do risk? But I think that women bring a collaborative nature to decision making, but also a decisive nature. And I feel like women get a really bad rap for being indecisive, and I don’t think that’s the case. I think if you’ve looked at any woman that’s actually been faced with a decision to make, like she analyzes everything, and she makes it. I haven’t really been around a lot of waffling women. I’ve been around waffling people when an organizational culture is one to waffle, and I kind of try and take that on with my risk conversations, and particularly, I’ll say, in the third sector, where consensus is so valued, and I get it, we want to get along, and we’re a charity, and I’m here for it. And the problem is, is when you end up waffling and you’re looking for consensus, you end up just being frozen. You don’t make any decisions. So I think women’s voices in leadership is a combination of that collaborative nature, but also decisive decision making that I think we can edge out men a little bit with the collaborative area and then also being decisive. So I think in governance, risk and compliance, you need both, and you bring people along the journey. And I think that women are really well placed to do that.

Kimberley Cole 16:09
This episode is brought to you by Kroll. Stay ahead with Kroll. As the leading independent provider of financial and Risk Advisory solutions, Kroll leverages their unique insights, data and technology to help clients stay ahead of complex demands.

Kimberley Cole 16:26
Thank you. Well, now let’s get into what we’re here to talk about, because we had our second Risky Women Write competition this year, and you had the winning article, and it’s a bit of a sad day for some, maybe, but your article bids a fond farewell to the traditional risk matrix. You described it as a beloved relic of the 1970s once the darling of boardrooms, it now fades into obscurity, leaving behind a colorful legacy of simplicity in a world that demands nuance. Who knew a grid could be so tragic? So from our judges, you got great feedback, such a clever and innovative approach, which uses humor to land the author’s point. This obituary style review brilliantly reimagines the traditional risk matrix with a witty, clear narrative that engages readers and demystifies complex risk concepts. The creative framing and approachable tone make the piece highly accessible, very clever and engaging. Novel topic. Such a good read and the argument is thought provoking and for leaders, adds humor into not another heat map and risk assessment. So some fabulous comments there. And so I hope all of our listeners will also go online and read the article, which is published on the Risky Women website, and also the Association of GRC has published and a few other places. So take a look and have a read, but we’re going to go through and give you some more background and information around it. So congratulations on winning.

Sabrina Segal 18:09
Thanks so much.

Kimberley Cole 18:11
It was great. So I mean, we had so many great entries, but obviously yours really stood out for everyone. So what inspired you to sort of write an obituary for the risk matrix?

Sabrina Segal 18:22
Well, again, I want to just thank the judges and everyone for selecting this. I’ll be honest with you, I was on the call when you announced the winners, and there was a fourth place and a third place and a second place. And I was listening to the titles, and I was hearing about the content, I was like, there is no way my cheeky, you know, article about a risk matrix dying can even compete with these women. And I’ve read the other articles since then, and they are all amazing, and just so well thought through and well written. And I just kind of, when you guys said that I won, you should have seen my face, I was just like, Oh my god. So thank you very much. I’m glad again that my my tongue in cheek article caught people’s attention. I mean, what inspired me to write this? I’ll be honest, frustration. I am so frustrated with just having to continue to say, Guys, these tools that you’re using, you’re spending so much time on your board meetings, you’re arguing whether something should be amber or red or green, and it’s not really helping you do much of anything. So people who know me, who’ve listened to my podcast, or know why I write on LinkedIn and things like that, understand that I have this love hate relationship with matrices and registers and appetite statements and so really, I just said, how can we get more attention on this? And humor is something that I try and use a lot of people know me on LinkedIn. I’ve got ridiculous memes that I use and things like that. So, you know, it was frustration, but also trying to just get another platform to amplify the message that there’s better ways to manage risk out there, and you don’t need to use these colorful boxes anymore.

Kimberley Cole 19:54
Now, you mentioned your podcast, and I kept meaning to ask that – So name is a podcast, so we can put a link in as well.

Sabrina Segal 20:00
So the podcast is called Tolerable Risk. It’s got 35 episodes, but I haven’t done any recently, and basically something had to give when I started my doctorate, and so the podcast was put on hiatus. Fair enough.

Kimberley Cole 20:17
Fair enough! Well we’ll still go look at that.

Sabrina Segal 20:14
And the 35 episodes are really interesting. I think a lot of them are still quite relevant. Again, it’s focused on charities and nonprofits, but also it’s interesting. I had a lot of small businesses reach out to me when I was doing the podcast and say, Look, you know, we’re functioning in a low to no resource environment as well. And a lot of these episodes have been quite helpful for them too. So have a listen.

Sabrina Segal 20:21
So back to the riskmatrix, yes. Why do you think it became so beloved and enduring for so many decades in the boardroom?

Sabrina Segal 20:47
I think anything that has colors is easy. And I think that over time, the matrix sort of just became the symbol of, you know, it’s like a traffic light. Is it red, yellow or green, everyone understands that it’s easy. There’s a reason why kindergarteners start with colors, but risk isn’t a kindergarten level exercise. It doesn’t have to be rocket science, but we need a little bit more nuance, and we are working right now, no matter what sector you’re in, in quite a volatile and uncertain environment, I can go into a lot of the analytical details about why matrices don’t work. I mean, it’s taking subjective concepts and trying to apply a quantitative approach to them. I always joke around with people and I say, Well, what’s better? A four by four, a five by five, even a six by six matrix. Which one’s better? And the answer is, none. They’re all rubbish. And that’s why people hear me say, burn your risk matrix. It’s not worth your time and valid enough people come back and say, Oh, well, it’s not the matrix itself. It’s the conversation. And I go, yes, absolutely. But the problem is, is that those matrices are then sort of hung up on a pedestal and paraded it out. Once a quarter, the board blesses it with holy water. Everyone gives high fives. Look at us. We’re managing risk. And it’s just, it’s theater, it’s risk theater. And you pile on that a 278 line risk register and then a risk appetite statement that has no linkage to reality, and everyone’s like but all the time that we spend on all of this, and my frank response is, yeah, it’s kind of wasted. There’s way better approaches where you can still have those really valuable conversations that everyone says, Well, that’s the value, but you actually end up with something at the end of those conversations that helps you make better decisions. And that’s the kind of risk management I think, that we need to start moving towards.

Kimberley Cole 22:39
And when did you make this realization that the register was really not helping?

Sabrina Segal 22:45
So I was the head of risk and compliance for Save the Children in Egypt, and I remember sitting at my desk one day and getting an email from one of the business development teams or the fundraising team, and saying, you know, we’re going for this particular opportunity. We need you to look at the risk package, and this was about four hours before they had to submit. So first of all, I was like, risk is obviously not getting a whole lot of valuable attention. Nothing against the organization. I love Save. They do amazing work, and they have since changed their ways, but I’ll tell you why. And so I remember just getting really frustrated and going, this is not how we manage risk. Again, this is theater. This is we’re ticking a box. We’re not really having the conversations that we need to have around this. I was so frustrated that I fired off an email to the head of risk, of Save the Children International in London. I had no idea who he was. His name is B Sharma. He and I have since become quite good friends. But I remember firing off an email from, you know this, I’m this new person in Cairo, going, the way you do risk management is rubbish. It doesn’t work. Why do you do it this way? This is awful. And from that point is sort of when I started talking more about objective centered risk management, which I believe is much better structured for the charity space. And he and I became quite good friends, and I kind of told him a little bit more about this concept. He looked into it himself. And Save is now really wonderfully starting to integrate objective centered risk management into their enterprise risk management, as well as their project approach, which I think is working out a lot better for them too. So, yeah, I mean, I personally had that I want to burn it all down, moment when I was faced with a matrix with four hours to review it and going, this is there’s to be a better way.

Kimberley Cole 24:27
And in the article, you mentioned diverse perspectives from behavioral science, system thinking, data science, they all expose the limitations of the matrix. And so you started to talk there a bit about what’s better. So tell us then on that, what are those perspectives that you think have the biggest impact?

Sabrina Segal 24:48
I think fundamentally, the matrix is always presented as a quantitative tool, because it has numbers, but you barely have to scratch the surface to realize that it’s all subjective. What does likelihood have an impact mean? Is anybody who’s making these judgments, you know, as Doug Hubbard writes in his books, you know, are they calibrated, like, do they know what they’re talking about? Is this just a gut feeling someone’s finger in the air? Like, I don’t where is any of this judgment coming from? Also, not to mention the fact that they are quite backwards looking, they’re static. They’re not linked to what organizations are trying to achieve, and they’re certainly not linked to resourcing, which, again, in the charity space, is just of critical importance. Between behavioral science and systems thinking and data and all the kind of new things that we know now, for me, I think that primarily the behavioral science element is really important. Again, speaking from the third sector, the charity sector, is we deal with a lot of humans like we’re not making widgets on a manufacturing line where we can get an engineer to estimate when we need to do phased maintenance on a particular machine. We’re dealing with very complex things in very unstable environments, and it’s humans and people all the time. So that behavioral science element, I think, is missing in the matrix and the register and a lot of other things that we use traditionally, one of the things that I would point to is, for example, in economics, you have the concept of a rational actor, but we know that the rational actor doesn’t exist. And so why would we make that assumption that it exists in risk management as well? I think secondarily, the systems thinking is really important too. Again, when you’re working in a dynamic environment like the charity space, I like Dave Snowden’s Cynefin approach. I read a lot of his stuff. It’s really influenced, sort of the organic way of thinking about risk and crisis, and feeding in concepts of resilience to that as well. And I think again, charities, especially right now, more than ever, really need to be thinking a lot more about agility, not big A Agile software development, but just being able to pivot, you know, be aware of what’s coming down the road in front of them, identify those things, pivot, adjust, and then accelerate through it. All organizations need to do that. But I think charities in particular do as well.

Kimberley Cole 27:00
So you mentioned their objective centric risk assessment, and that really coming to the fore. So why is it shifting from impact to likelihood to uncertainty around objectives? Why is that so powerful?

Sabrina Segal 27:15
Well, in the charity space, which is really where I focus, again, when we have a low to no resource environment. We don’t have the luxury of having a risk team or having a lot of data that you can pull from. The folks who love their quantitative tools, love their Monte Carlo simulations and all of that. I respect them. I wish we could do more of that in the third sector space, because I think it brings an additional dynamic to your analysis. However, the problem with those quantitative heavy tools is you really need a clean and verified data set in order to run those regressions or to, you know, run your simulations. In the charity space, we don’t really have that data set, and so it’s very difficult to get a useful output from a quantitative tool. And so that’s why I think the objective centered approach gets a really great variety of input on the qualitative side. So the objective centered risk management approach that I talk about for charities is based on Tim Leach’s objective centered shout out to Tim, big fan of his. He’s sort of like a mentor to me. He’s fantastic. But he developed the objective centered uncertainty rating approach for the private sector, and it’s very thorough. It’s too thorough for charities. And so he and I talked about this, and I took a lot of what he did, and I pared it back, and I made it much more applicable to charities and nonprofits. And what it does is it takes that objective centered approach and it layers over it a systems mapping. And it sounds more complicated than it really is, but essentially what I do is, I’ll take a cross section of team members who are trying to achieve a particular objective, whether it’s a strategic objective or a project objective in a charity, and we ask a series of questions. The first question we ask is, what are your threats? What’s going to prevent you from achieving that objective? And then, what are your opportunities? What can enhance the achievement of your objective? Traditional risk approaches don’t ever ask about opportunities. And when you’re dealing with a charity, and one of the things I love about working in the charity space is that no matter who you are, you are an optimist. You cannot be a pessimist and work in the charity space because you want to make the world a better place. And I love it, right? So you’re either an optimistic optimist, you are a pessimistic optimist, or you are an optimistic pessimist, but you can never be a pessimistic pessimist and work in the charity space. So why are we not giving these optimistic folks an opportunity to say, what are the opportunities that could actually make this objective even more impactful for these communities? So usually, when I do these training sessions, people like grumble, and they’re rolling their eyes, and they’re like, oh, risk It’s so boring. As soon as I put that question on the table, people’s ears perk up and they go, oh, wait a minute, there is a way that we could make this child financial literacy program even more impactful. There is a way that we could make this childhood nutrition program more impactful. There is a way we could make this environmental protection more impactful, and then I’ve got them hooked on risk, and they love it after that. So basically, we start with those two questions, and then we sort of do a modified mind map. We go into, what are the causes of these threats, what are some indicators that may be on the horizon that this opportunity is coming our way? And then we go to what are our preparation elements? And so at the end of it, they end up with sort of what I call a flying spaghetti monster, but it’s all around the objective, right? The objective sits in the middle, and then you’re able to actually see it’s a one to many and many to one connection. And they’re able to kind of, then look at this we do it on a Miro board or in person I’ll do it with a bunch of sticky notes after about 45 minutes, they’re able to step back and go, this is the operating environment that my objective has to survive. And it’s like having a kid and sending them out into the world, right? The world is a dynamic place. Risk is not linear. That’s the other thing about traditional tools. You know, we’ve got our original risk, and then we do these magical things, and then we have our residual risk. And isn’t that great? That’s very linear. We, no one exists in that world. And so I think that this objective centered approach for low to no resourced organizations, and particularly for charities, it just gives them such a better view. And then with the preparation steps, which is the last question we ask them. They then get to price those and then put them into the budget, and that becomes a real, tangible go no go for management. Because you can then go back and say, Do you want us to achieve this objective? Here’s the resources that we need. Is it a go no go? Instead of, is it yellow, or is it, whatever it’s we said we’re going to do this active monitoring, or we’re going to do this mitigation, and if we don’t have the resources to do it, we need to go back and adjust the objective. And it’s very practical, and they see the value in it right away. After about 45 minutes, organizations are like, this is great. It’s very practical. So it links to the objective. It’s forward looking.

Kimberley Cole 31:59
Yeah, exactly, practical, action oriented, you can make a decision off the back of it.

Sabrina Segal 32:06
Absolutely, and it links to their resourcing. So that’s why I think the objective centered approach is really good for the third sector.

Kimberley Cole 32:12
Yeah, fantastic. And obviously, look the way you framed this obituary format is very fun and playful, etc, and it sounds like the way you’re also bringing your programs has an element of storytelling and this optimism, etc, that really helps make risk more accessible. Is that the intention?

Sabrina Segal 32:35
Yeah, absolutely. It’s so funny, because I do these workshops and people go, I’ve never been so excited about risk in my life. I think a lot of it comes back to when I was starting out my career as a young lawyer, particularly with USAID. I was giving ethics training, and I was giving anti corruption training, and I was giving data protection training and stuff that can be really dry. And I remember after the first couple of sessions, even I was getting bored. I was like, I gotta do something else. And so I found ways to make that information, which is so important, accessible and entertaining, and really try and customize it to the audience. I used to give talks at conferences from the government point of view about how to negotiate a good cloud computing contract. And I used to have a stuffed broccoli. I got it like IKEA I think it was like a stuffed animal broccoli thing. I used to joke around and say, you know, you’re going to have a lot of other people at this conference who are going to be talking about really exciting things. It’s going to be like the ice cream and the cake and the sugar and the biscuits. You know, I am here to talk to you about how to negotiate a contract. And that is your vegetables. And you need to eat your vegetables. You need to know how to do this in order to do all the other fun stuff. So here you go. Here’s your broccoli for the conference. And you know, studies show that when people laugh, they get more interested, they wake up a little bit more, and they pay more attention. And anything that’s boring and dry like you’re never going to get your point across, so why not be a little bit more silly about it?

Kimberley Cole 33:58
And at least everyone’s going to say, Did you hear the woman who was speaking about the broccoli and we need to eat our vegetables?

Sabrina Segal 34:02
Yeah and I mean and that’s why I am such a huge risk nerd. But I firmly believe that if we can get folks to be thinking about risk from a strategic point of view, as opposed to an operational point of view, we can exponentially, really increase the impact of anything any organization wants to do. And I wrote an article a little while ago about why risk should be sitting in your strategy unit and not under like your finance or your operations unit. Compliance can sit under finance and operations. That’s fine. It’s a checklist anyone can do compliance. Sorry, compliance, people out there, I know it’s very important, but I think you know, you have a lot more structure or kind of around compliance risk is genuinely like, are we going to take this opportunity, or are we going to shelter because of a threat? And there’s no black or white answer around that, and we need to think about it from a strategic point of view. And risk provides value, so much value. It’s hard to quantify, but it’s one of those things that if you do it well, and you kind of know when you see it and you get it integrated into the organization, it can make such a difference.

Kimberley Cole 35:11
Absoljutely. So is there anything from the matrix legacy that you think that risk professionals should carry forward?

Sabrina Segal 35:21
Yeah. I mean, I think that the matrix absolutely had its moment in time, and it served honorably. We’ll have an eternal flame for the matrix. But I think one of the things it did highlight was that talking about risk is important, and putting some sort of structure around how you facilitate those conversations is important. The matrix, I don’t think is the right way for how the world is today, but I do think that talking about it is important. The thing is, is that right now, time is extremely valuable. Time is the most valuable I think we have, and so we need to make it count. And I think we need to use tools that add value and don’t add theater, is the way that I would look at it. So I think let’s take that we get a lot of value about having the conversation away from it, but then let’s structure those conversations so we get even more value from the conversation.

Kimberley Cole 36:10
Sounds great. Now finally, in this section, if you had to write another obituary for an outdated tool or practice in risk, what would that be? I think I’m going to ask this question to everyone from now on ’cause I think it’s a good one!

Sabrina Segal 36:27
I think three lines of defense is the next one in the crosshairs, and I have seen more people, although I know I’m going to get probably a lot of hate mail, a lot of a lot of harassing on LinkedIn. But again, I think it was a great structure, it is, or was, I think, a great structure for thinking about dynamic operating environments. But I think that that analogy now we need to move on to the next phase of what the three lines of defense actually means. When we silo anything, we cut it off at its knees, and three lines of defense, I think, is siloed. It’s very much a bolted on concept, as opposed to a built in one, because it draws lines. And I think again, for manufacturing, where you have a very clear, this is where we make the widget, this is where we do the QA/QC for the widget. You could have that. But when we move into an information economy and AI, what line of defense is AI now? I think that the three lines of defense concept has had it stay, but we need to move on from that. Now, I’m not one of those people that’s going to say, well, risk is everyone’s responsibility, because when you say that, it becomes no one’s responsibility. But this is why I really think risk and these types of ways of thinking need to be built in, and that’s why it’s so important we put it into strategy and just good decision making, like when I do objective, centered risk management workshops, and then I show people like the dashboard, and they go, the objective certainty rating, That’s just performance management. And I go exactly! We should not have a is this particular risk accelerating or decelerating? You end up now with these registers, and you’ve got like, 18 columns across and 1000 rows down, and now you have colors and arrows doing different things. And I’m like, no, no, like, we don’t need any of that. We need to actually say, are we achieving what we’re here to achieve? That’s good performance management. If we’re not achieving what we’re here to achieve, it means we’re not managing our threats. Something is getting off course. So build risk in. Don’t bolt it on. So yeah, I mean, I think the three lines of defense is probably what I would say next year for Risky Women, I’m going to write an obituary for three lines of defense.

Kimberley Cole 38:42
Well, I think it’s interesting, because of all the conferences I’ve been to recently, there’s a lot of discussion over the three lines, are they going to consolidate, how they’re going to change? What’s the impact of AI? So it’s definitely an interesting one that we will watch this space.

Sabrina Segal 38:57
Yeah, yeah.

Kimberley Cole 38:59
So thank you for all of that. Now we’re going to have a quick wrap up, and I have just modified this so you are the first guinea pig, because generally on the wrap up, we’ve tried to do it like give us quick, short punchy answers, but we have not achieved that. So let’s see how we go on this one. This is our fast

Sabrina Segal 39:16
Do my best!

Kimberley Cole 39:17
final round Okay, so risk taker or risk averse?

Sabrina Segal 39:23
Informed risk.

Kimberley Cole 39:27
Ooh, your leadership, superpower?

Sabrina Segal 39:29
Curiosity, closely followed by humor.

Kimberley Cole 39:32
OK. One word that defines your career?

Sabrina Segal 39:37
Grateful, grateful for the amazing opportunities that I’ve had.

Kimberley Cole 39:43
And a top skill required for the future?

Sabrina Segal 39:48
There’s so much uncertainty now that we can’t walk into something and make assumptions. We genuinely there was the quote. It was lead with curiosity and not judgment. The more curious you are the better off you’re going to be because you’re going to have a lot more information to make your decisions on.

Kimberley Cole 40:04
And finally, what’s the future of GRC, governance, risk and compliance in a single word?

Sabrina Segal 40:12
Dynamic.

Kimberley Cole 40:13
Oh, nice. Excellent. Well, I think you performed really well. I think I can keep some of those questions. Excellent. Well, look, it has been an absolute delight to speak with you, and I am sure we need to have more conversations, because there is just so many interesting things that you’re doing, and maybe once you finished your PhD, you can come back and tell us more about what you found there.

Sabrina Segal 40:44
That’ll be a few years, but yeah, happy to do it. And also for the risky women community, I know that they mean a lot of the women are in the commercial space, but if any of them are in the third sector space, or if any of them are interested in moving into that space, or even better, if any of them are interested in becoming trustees, because charities and nonprofit really desperately need people who understand this, because they are adrift in this volatile environment right now, please reach out. I would love to chat with you about how you can use your skills to help really well deserving organizations in your community, and I’m sure that if you knocked on their door and said, I’m a risk person and I’d love to be a trustee, they would welcome you. So please, anybody who’s listening, feel free to reach out.

Kimberley Cole 41:30
That great idea. Fantastic. Well, thank you so much, Sabrina, thank you for entering the writing competition. Thank you for joining the podcast, and thank you for being an amazing, risky woman.

Sabrina Segal 41:41
Thank you so much. This has been so much fun, and again, I’d love to continue the conversation whenever you’d like.

Kimberley Cole 41:46
Fabulous thank you.

Kimberley Cole 41:47
Thank you for listening to this episode of Risky Women Radio, be part of the ongoing conversation and learn more about our events and other programs at riskywomen.org