Podcast S9E10 | Managing Operational Risk in a Changing World

TRANSCRIPT

Kimberley Cole 0:01
This is Risky Women Radio, a show that connects, celebrates and champions women in risk regulation and compliance. We’re here to share the insights on the biggest issues in our industry and hear inspiring journeys from our global members. Sign up to our newsletter at riskywomen.org. I’m Kimberley Cole, your Chief Risky Woman.

Kimberley Cole 0:23
Welcome to Risky Women Radio. Today’s Risky Woman is a leader who has spent her career helping organisations navigate uncertainty, challenge, conventional thinking, and rethink how operational risk is managed in an increasingly unpredictable world from global financial institutions to academia and nonprofit leadership, she has built and led risk compliance and enterprise risk functions, while shaping industry thinking on operational resilience and nonfinancial risk. Her work has influenced how firms approach risk and controls, and her award-winning contributions to the profession have made her one of the most respected voices in operational risk today. She is also deeply committed to developing the next generation of leaders, teaching at both Columbia University and NYU, while serving as chair of Women Creating Change in New York City, and now through her new book, Managing Operational Risk in a Changing World, she’s challenging leaders to rethink risk in an era where disruption is constant and the stakes are higher than ever. So, joining us today on Risky Women Radio is Penny Cagan. Welcome, Penny.

Penny Cagan 1:38
Thank you, I’m thrilled to be here, so thank you. And Risky Women is an organisation I deeply admire. So, thank you for inviting me to this session.

Kimberley Cole 1:48
Thank you so much. I mean, as I just shared, you’ve really helped shape how the industry thinks from an operational risk perspective. So, tell me, was there a defining moment early in your career where you realised risk management was where you wanted to make your mark.

Penny Cagan 2:06
Yeah, thank you. Well, first of all, I have to say risk management, and particularly operational risk, is in my DNA. I think about it all the time, but looking back on my career, the defining moment was during the early days of Basel II, and they were really heady days when operational risk was just being defined as a discipline in the aftermath of the Barings Nick Leeson unauthorised trading event. I was intrigued with how broad and impactful operational risk could be, and even in those early days when it was considered a poor relative of credit and market risk, and I had worked in a risk consultancy at one point that was very focused on market risk, and I just embraced operational risk. It touches every part of an organisation, it’s complex and it’s interesting, and by doing operational risk work, you really get inside an organisation and their plumbing, and so back then I knew it was important. I knew it’d be meaningful, and I had the opportunity to participate in some of the early working groups. When the discipline was just being defined, it was previously called all other risks, and it was managed as part of credit risk. There was a lot of discussion at the time on whether it was a quantitative or qualitative discipline, and and at the time there was a lot of excitement about quantifying risk in general, industry was in love with risk models, but I always believed that at the core was a management and a qualitative discipline, but it doesn’t mean that there’s not a place for quantification, of course there is, but really you know operational risk is really about strong management.

Kimberley Cole 3:40
Well that’s fascinating. I was actually in Singapore the whole Nick Leeson.

Penny Cagan 3:46
Oh, wow! How interesting!

Kimberley Cole 3:48
That was very interesting!

Penny Cagan 3:50
I think we have him to thank, oddly enough, for the, you know, the emergence of the discipline.

Kimberley Cole 3:57
Interesting. Now you’ve led large teams through periods of major change and disruption, so can you share a moment where a setback or crisis or something, an unexpected challenge, really taught you some leadership lessons?

Penny Cagan 4:14
I mean, this, this work is hard, right? And so every job that I’ve done, and every project, I’ve learned a lot, you know, I learned the hard way, particularly from one project, that when you’re engaged in a change initiative and change is hard, you need to cover your bases in terms of gaining stakeholder engagement. So, I was hired many years ago to restructure a large bank’s RCSA programme. It was a massive change for the bank. The programme had in place a number of years, it was being implemented with a primary focus on control management, and so the RCSA program was called CSA, and it was missing the R piece, or the risk focus, and took me about a minute to figure out that that was an important piece of this, that it wasn’t just about, you know, testing controls. So you know, I put together a plan. I mean, my boss, when he hired me in an op-risk role, said fix our CSA. I’d met with the CEOs of each of the bank’s primary businesses. I did my dog and pony show, you know, I had my walking around deck, I went to every committee meeting, and I had the support of management in the bank, right, which was ultimately to restructure the RCSA programs around a risk prioritisation approach, rather than control lines, which I made the case was more efficient, more effective as well, and I got the funding to build teams and to restructure the programme, but I did not do a good enough job gaining the trust and support of the people that actually did the work right on the ground, and it was a painful lesson because key people failed to show up in workshops that I had scheduled. Remember traveling to schedule one RCSA workshop, and like two people showed up, and I found out that basically most of the team was told the workshop had been cancelled behind my back, so it was painful. I had to go back to some of my old Miller Heiman sales training, in fact, that I had taken many years prior in terms of covering the basis and how important it is, and I had to double down on my outreach and my communication plan and start meeting with each of the stakeholders who actually were responsible for supporting the program and implementing it, and what I learned ultimately was a change is hard, change initiatives are hard, you can’t slam them down people’s throats, and that you need to cover the stakeholders right up and down an organisation and gain that broad support and pushing change down in organisation’s throughout without covering all the bases ultimately would just slow the initiative down and kill it prematurely. I meant well, I was excited about the new approach, you know. It was a big global bank and a big platform, but yeah, there were some painful lessons there.

Kimberley Cole 6:57
Yeah, I think you said lots of things there. I think trust and support trust comes up time and time and time again in these conversations on Risky Women Radio, and just even when I’m at conferences, that you hear that that’s absolutely key. And then I love the, you had to use your sales training and communication, because we cover that often in our Rev-up sessions that we do monthly for our members, where we’re not just looking at the sort of technical skills, but those soft skills that are becoming, I’d say, probably even more important. You know, you’ve got to be able to get your message across and sell the dream.

Penny Cagan 7:32
Yeah, sell the dream. Yeah, yeah. I mean, an op-risk leader, or risk leader of any type, I think, is ultimately a salesperson, right? And they do have to sell the dream, I would agree with that.

Kimberley Cole 7:42
Yeah, and as you said, change is always hard, doesn’t matter what it is in, in whichever area. So that’s a great story. And obviously, through that, you built frameworks and approaches that have then gone on to influence a sort of wider industry. Was there ever a time when you had pushback against some of the sort of conventional thinking to get people to really think differently, especially think differently around the risk?

Penny Cagan 8:10
Yeah, so yeah, and I have a lot of examples as well, but you know, as I mentioned in the early days of op-risk, the financial industry was enamoured with risk models, and some very smart quantitative people were built in, and you probably remember this to build capital allocation models for the operational risk discipline, and I remember, like, when a credit or market person would come into op-risk and say, “We’re here to build the op-risk models, we have a lot of data, I’m like, come back to me in two weeks, because you’re going to hit your head against a wall, right? And I don’t want to disparage the work they did, because it was innovative. There was a love affair, though, in the industry at the time with the quantitative approaches to predicting exposures. Even with our much more advanced tools today, including AI-driven models, and a model can help identify patterns of emerging risk. It can point to powerful indicators, but ultimately, what counts is an organisation’s ability to manage through those risks and demonstrate through planning and the development of their control environment that the organisation is resilient and no model will do that, that’s basically old-fashioned management, right? And communication, we talked about as well, is a big part of that. So ultimately I’ve watched the operational risk industry pull back from AMA, the advanced measurement approach, that was 20 years of quantitative work, right, and come to a point where I think it understands that really what’s important is being resilient, but I took a lot of hits early on, you know, in terms of questioning a complete quantitative approach. The other area where I’ve pushed back on some attitudes, and again, have taken some hits in the industry regards the role of second line independent risk management. You know, I’m an old risk manager before the days of OCC Heightened Standards, even where three lines of defence became the standard model, but I always believe that as a risk manager, I’m in the battle, along with a frontline, as a trusted advisor, I see the role somewhat along the lines of a military strategist. The front line might be in the battle, fighting the risk issues and doing the hard work of remediation, but the trusted advisor is there to help them along the way and map out the strategy. I do not think a second line function can be successful with a hands-off, arms length approach, and yet I’ve heard many arguments when I’ve said that I see myself as a risk advisor, saying, well, then you’re not independent, and if the military strategist fails to check in with those on the front lines, how do they even know if their strategy is effective or where they need to adjust? So I’m hoping that some of the attitude will change in this new regulatory environment as well, but I have to tell you, I have taken some heat on that from some people in the industry.

Kimberley Cole 10:47
Yeah, I can understand that, that’s very interesting. And then, if you look back across your career, what achievement are you most proud of, and not necessarily because it’s the biggest title you’ve had or recognition, but because of the impact that you feel that it’s had on people or the profession?

Penny Cagan 11:04
So I think I’m going back to the early days of Basel II. I’m most proud of building the first operational risk industry database. It was called First F I R S T, which stood for Financial Institution Risk Scenario Trends. It’s owned today by IBM. It’s part of the Open Pages suite of products. I was working at the time with a Deutsche Bank strategic venture called Operationalrisk.com with several former Bankers Trust executives, and anybody that far back as I do know that, like, a lot of risk people came out of Bankers Trust. They did a lot of the early work on risk, and I was handed a spreadsheet of operational risk data points that the insurance guy at Bankers Trust had built and tracked and his tracking industry peers, and I worked on turning it into a robust database of case studies, and the case studies focused on dissecting the control failures of each loss event, which then could be used for an institution to do a health check. Those were the early days of Basel II. All of a sudden, all the global banks in the world needed lost data, operational risk data to build those capital models. And so I built a customer base. My first few clients were JP Morgan and Goldman Sachs, but in two years I had over 100 global banks. So it was heady times. I was traveling the world, peddling the database, listening to the needs of my clients, and I believe I really was a big influence on how the industry thinks about controls and operational risk today. It’s probably what I’m most proud of. It was a ton of work!

Kimberley Cole 12:36
Yeah, that’s absolutely amazing.

Penny Cagan 12:39
Yeah

Kimberley Cole 12:40
And what an incredible career you’ve had. So, I guess, as we finish off this section, what is the best piece of advice that you’ve ever received?

Penny Cagan 12:51
So, I think the best advice I ever received was to stop thinking of myself as a subject matter expert and instead think of myself as a leader, and so I was very proud of all the subject matter expertise I built around operational risk, and became a subject matter expert, and it was very important to me in my early days of my career, and I actually think it was foundational to my development, because ultimately, you’ve got to know something right? And a lot of people think they can build careers without knowing anything, but there comes a time and a pivot, if you want to be a leader, you need to understand that it’s not about what you know, although I’ll say that’s important, but also how you leverage your knowledge, how you communicate, and how you bring others along. And so that was a big pivot for me to understand that, right? It wasn’t just about being the most knowledgeable person in my subject matter expert, but to really start thinking of myself as a leader. And some people want to spend their whole careers as subject matter experts, and there’s nothing wrong with that, and we need those people, but I wanted to influence strategy and policy, and it wasn’t going to happen as the go-to person. And early in my career I spent 12 years managing a research team at PaineWebber, and when I gave notice to accept my first risk job, someone said to me, “Well, you can’t leave you’re institution in this place, and that was a bit of a wake-up call, right? That I never wanted to be an institution again. Consequently, after that, I spent about seven years bringing the first database to market, but then after that, I jumped into new opportunities every three to four years, and I learned a great deal at each institution that I joined, as well.

Kimberley Cole 14:26
I think that’s super interesting. Just be that person that everyone comes to, because they know that you’re going to know, and how do you sort of take that leadership approach? So, very, very interesting. Now we are thrilled to talk about the launch of your book, Managing Operational Risk in a Changing World. So, if I give a quick summary, that from my reading is that the book could be described as a modern field guide to how operational risk is evolving in an era shaped by AI, by cyber threats, geopolitical instability, ESG pressures, regulation, and constant disruption. Rather than treating operational risk as a narrow compliance function, you framed it as a strategic leadership issue that sits at the centre of resilience, governance, and organisational survival, and obviously it’s blending your 40 years of frontline experience and all those practical frameworks, some of which you just talked about, case studies and interviews from industry veterans, also, which I think is interesting for us to hear about, and connecting to major events ranging from Barings to Silicon Valley Bank. So I hope that’s a very good summary, but let’s you get more into it and tell us what’s in it. So, before we get into it, what prompted you to write “Managing Operational Risk in a Changing World” and why did this sort of feel like the right time to write it?

Penny Cagan 15:55
So, I mean, I’ve heard all the criticism about operational risk, it’s a check the box exercise, RCSA doesn’t tell us anything we don’t already know. So I’ve been thinking a lot about the world and how it’s evolving, and how I do believe operational risk is at a crossroads, and in order to be effective, it needs to evolve along with it. So I think a lot of that thinking went into my book. And I’m also surprised when I hear op-risk people tell me that things like geopolitical risk are not within their domain, I think it’s one of the most critical risks we’re dealing with today. And I also felt like I had a story to tell from my decades of working in the risk field that I wanted to share. This book was about a year of my life, wrote it over like most of last year, and so finally I felt there was a place for a book to pull together all the elements of an operational risk framework, such as scenario analysis, RCSA, risk appetite, along with the approaches for managing operational risk types, such as cyber AI, fraud, third party, but I also wanted to devote chapters that I hadn’t seen elsewhere in other books, like how to build an operational risk team and lead a function across the three lines of defence. How to manage regulatory environments as well. I have a change management chapter that I hadn’t seen elsewhere. I do have a chapter in AI and data risk as well. So the time felt right, and I’ve been teaching operational risk and enterprise risk at Columbia and NYU, so I also had an idea in my head of the kind of book that I would want my students to read and to use as a kind of a reference book as they build their careers.

Kimberley Cole 17:32
Yeah, I think that’s a fantastic perspective to bring to it as well. And obviously, you’ve named all these things that are going on, like we’re in a period of just such rapid change, so what do you think are the biggest forces reshaping the discipline today?

Penny Cagan 17:48
So, yeah, so there are so many forces, I think, coming together at the same time. This includes a pullback in the US and to some extent in the UK on regulatory oversight. We also have economic forces, which are leading financial institutions to be as lean and as effective as possible. There’s juniorisation going on in financial institutions, and then, of course, we have the technology change driven by the rapid development of AI, and we have an unstable world. Right, I mentioned geopolitical issues that are going on. And so, in addition, there’s also been a change in the operational risk operating model, with the first line taking on more and more responsibility for managing operational risk, and at the centre of this, I think, is the impetus for many firms that have become too complicated to really simplify their operational risk frameworks and methodologies, so they can actually be implemented right by the front line. So I think all of that’s coming together in terms of geopolitical risk, tensions in the world, wars, AI, lighter regulatory regime, and then the redefining, I think, of the operating model for managing operational risk.

Kimberley Cole 18:56
And it’s interesting because the book covers all of those risks that you just outlined, cyber AI, third party, etc. etc. How should organisations think about all of those, and are they connected, or do you think they’re looking at them as separate silos?

Penny Cagan 19:12
I think if there are organisations that look at them as separate silos, and they have their third party person here, and their fraud person over there, and their cyber person over there I don’t think that’s an effective way to manage operational risk, and I stress in the book, and I also stress in my classes, my graduate risk management classes, that risks are interconnected, and they’re all connected, and a program that manages them in silos is not managing risk effectively. So for instance, the concentration of services provided by the top cloud providers, and there’s really three big cloud providers exposes firms to third party risk, concentration risk, fraud risk, cyber risk, data risk, and privacy risk. None of those can be managed in silos. And then I think of AI as a transversal risk, given how ubiquitous it’s become and also how it cuts across and impacts all the different risk types, and then ultimately resilience as the outcome dependent on managing operational risk effectively across the board. So, yeah, I very much think that, you know, managing it in silos, and I know why that happens in organisations, for political reasons, for organisational reasons, teams organise around certain subject matter expertise, but it’s not really the most effective way of managing operational risk.

Kimberley Cole 20:29
And you mentioned before having operational risk frameworks that were practical and that were really usable by the front line. So, where do organisations most often go wrong when they’re implementing frameworks like RCSA and KRIS and scenario analysis, etc.?

Penny Cagan 20:48
So, I do have a confession. I am a framework geek at heart, you know. I believe in frameworks, I teach them, right? But my mantra has always been that a framework is only as effective as ability to be implemented. So, firms where the frameworks are developed behind closed doors by second line and then thrown over the wall really are not going to experience effective management of those or implementation of those frameworks. And I do think firms go wrong when they make their frameworks too complicated. As an example, when it comes to managing RCSA, and I know everybody likes to criticise RCSA, and determining inherent risk. Why not just focus on the ultimate impact of risks rather than going through the complicated exercises of determining severity and frequency for inherent risk? And I’ve sat through those workshops as well. And also I think frameworks have gone astray in their interpretation. I mentioned of the three lines of defence model, and most particularly the role, the second line, I think. So, as I mentioned, I always use my role in the second line as an advisor who’s here to assist the first line in their mission to manage risk as well. So, I think over complication, and then when you’re developing a framework, you really need the people that are implementing it to be in the room with you to give feedback, to feel like they own it as well. And I’ve done a lot of work recently on simplifying frameworks that have gotten too complicated.

Kimberley Cole 22:12
Yeah, which would help them be implemented. Now, your title says in a changing world, and obviously we’ve talked about the fact that there is a lot of change going on at the moment, and there’s so many different risks from the geopolitical, climate risk, technology, as well as, of course, AI, which is mentioned continuously. So, how should that change the way that risk professionals need to really think about operational risk?

Penny Cagan 22:40
Yeah, so think one of the emphasis is, and I think I mentioned it, of writing the book is the view I observed among some in the operational risk discipline that certain risks, such as geopolitical and climate, are not within their domain. And so I do think operational risk professionals need to think about all the major risks of our time, and I do go through them in the book, and really think about how they impact and drive operational risk overall. And so this troubles me, really. At conferences, I don’t see an opera’s conferences, I don’t always see sessions on geopolitical risk, and we know climate risk has become political in some ways, where it never should have, but when you think of convergence of risk types, there’s certainly drivers of operational risk, and it’s important to consider operational risk from a holistic perspective. So, in the book, for instance, I map out both climate and geopolitical risks and how they drive operational risks from a people, process, and technology perspective. And so I think operational risk managers need to be at the centre of the most impactful risks of our time. They can’t kind of cherry pick the ones they want to manage, right? And especially now I think it’s really critical to think about how geopolitical risk and climate risk are drivers, for instance, of our top risks. And it’s interesting when you see lists of top risks, the top ones are cyber always, I wouldn’t argue with that, third party has moved up the list. I don’t always see geopolitical risk on that list. I don’t always see climate risk on that list.

Kimberley Cole 24:13
Yeah a 100%. Now I love it that you’ve also interviewed industry experts throughout the book. So, what did those conversations, I guess, add to the book? Were there any themes that really surprised you?

Penny Cagan 24:26
Yeah, so first of all, I felt strongly that the book needed to be anchored in professional experience and lived experience, and I wanted that anchoring to be broader than just my own experience and my own stories. So I wanted to bring in more voices and perspectives. I mean, operational risk is broad and it’s complex, and I wanted readers to hear from a cohort of professionals who I respect as innovators. So, really, for each of the major risk types, I really gave a lot of thought to who were the experienced professionals that I wanted to pull into the book and interview, and most of the interviewees discuss the importance of managing core operational risk from a framework perspective. Which somewhat surprised me. You know, the person that I interviewed for cyber talked about that as well, and one of the compliance people really talked about how important core operational risk is to managing compliance risk. Two of the interviewees had military experience and discussed how this impacted their view of operational risk. One flew fighter jets under the Top Gun program, another one managed supplies for the army. Right, and so I thought that was also an interesting perspective. And then one of the interviewees who developed one of the early RCSA solutions really talked about how he would do things differently today as well. So I think just bringing in those diverse perspectives I thought was important to the richness of the stories in the book, but almost everybody agreed on the importance of operational risk.

Kimberley Cole 25:52
I mean, sounds like you would have had some very interesting conversations.

Penny Cagan 25:55
We did.

Kimberley Cole 25:57
Now operational resilience is sort of one of the major themes, and it’s interesting because it keeps coming up at several of the conferences that I’ve been to recently. And so how do you think that firms should really move beyond just business continuity planning and build true resilience in their business processes?

Penny Cagan 26:15
Yeah, so first of all, I don’t think it’s a risk type, I think it’s again transversal, I think you know it’s an outcome of managing operational risk well across all the risk types, or that I call them the operational risk subtypes. But managing operational risk at its core is about being resilient, and I think sometimes some organisations might lose that perspective. And in order to establish real resilience, you need to manage operational risk across all the types we mentioned as interconnected. I like to think of it as a portfolio of operational risks, like fraud and cyber, and IT risk, third party risk, transaction processing risk. So, as an example, I’ve worked through cyber attacks in my past life, where we brought together subject matter experts in third party, in data privacy, in permission security, in cyber, and business continuity, in order to get back online quickly. Of course, you want these parties together before there is an attack, right, to come up with a robust, multi-layered defence control framework, but ultimately it’s making the investment up front and strong risk management, if that makes sense.

Kimberley Cole 27:25
Yes, and then you write about regulators as the fourth line of defence. So, what does strong regulatory relationship look like, and you know, particularly when sort of expectations are shifting as they are at the moment?

Penny Cagan 27:40
I did interview two former regulators in my book as well to get their perspective. But I’ve always thought of regulators as my friend, I mean, not my friend, but friend of the institution. They wanted the same thing as any risk professional, which was ensuring safety and soundness of the organisation. And so I discuss in the book, and also one of the interviewees who I interviewed for the regulatory chapter discusses the importance of a strong and transparent relationship with regulators with open lines of communication. And I would say that’s even more important than ever before, with less frequent examinations and a trend towards more observations rather than written findings, and in this lighter regulatory environment, right, where you don’t maybe don’t have as much formality, but you still need to keep those lines of communication open. And in the US as well, where the climate is more principles and rules-based, it’s important to particularly have those strong relationships with your regulatory exam teams, and regulators see a lot, right, they examine banks across the industry, they have broad perspectives. So, I’ve always valued their opinions and their feedback as well.

Kimberley Cole 28:48
Now, of course, AI continues to be a really hot topic, and I’d say AI and machine learning are now sort of sitting at the board level. So, what should risk leaders be doing today to really strengthen governance around AI risk, and you’ve also got to manage that with it’s seen to be non-innovative, etc.

Penny Cagan 29:09
I think AI governance is one of the hottest topics today in terms of risk management. But you know, in order to balance it with innovation, you need to take a risk-based approach, ultimately. So some AI-driven processes, including agentic ones, carry more risks than others. So, you need to identify them. You need to have a risk appetite identified risk appetite for each of your agentic agents as well. So, I believe, for instance, when an agent is interacting with clients, or could have an impact on your regulatory strategy, or your firm strategy in general, there needs to be stronger guardrails than in some other instances, including off switches when there’s certain defined triggers are hit, and so it’s really monitoring them through behavioural analytics is one approach. If AI is used for decisioning, there needs to be also checks and balances to verify veracity, there’s still issues with hallucinations. I found it in my research as well that AI was really bad at giving me lists of sources that actually existed, just made them up, you know. There’s a lot of talk, everybody’s talking about human in the loop. What does that mean? I think most agree that AI agents cannot run rampant without oversight, in much the same way you would provide oversight over human-run activities, right. So I think of AI agents as employees who’s activities require the same level of controls as human-centred ones, again taking that risk-based approach. And so you might not need all the guardrails if you’re using AI to aggregate your RCSA data, for instance, that you would for interacting with customers or actually doing things that would have an impact on your strategy. So as always it’s being pragmatic and it’s thinking about oversight and controls on a risk-based level.

Kimberley Cole 30:54
Fantastic, so we’ve covered…

Penny Cagan 30:57
a lot!

Kimberley Cole 30:59
a lot, but probably just little snippets, really, of what you can get from the book. So, if someone’s new to operational risk, or even for senior executives who want to strengthen their current organisation’s programme, what’s the most important lessons that you hope that they can take away from the book?

Penny Cagan 31:17
I mean, I think the most important one is that operational risk matters, and that it needs to change, though, along with the working environment, but also people who are strong risk leaders, or those that have lived through multiple economic cycles, and their experience matters as well. So you don’t want to, like, kind of throw your, you know, senior experts to the side, you want to think about and learn from their lived history.

Kimberley Cole 31:43
Well, I hope everyone you know quickly rushes out, logs on, and looks to buy a copy of Managing Operational Risk in a Changing World by Penny Cagan. So look for it on all good platforms and snap up your copy now. So, thank you for sharing so much, and thank you for a year’s worth of your life into the book. Okay, we’re going to end with our little rapid fire round, so it’s just short, sharp little questions just to wrap us up at the end here. So, are you a risk taker or risk averse?

Penny Cagan 32:19
I’m definitely wired to be risk averse, but I’ve worked on and continue working on being comfortable with taking calculated control risks.

Kimberley Cole 32:27
Excellent. What’s your leadership superpower?

Penny Cagan 32:31
I was told early in my career that I was going to be in trouble because I was too nice. That was my one of my first managers, but you know, being kind and respectful of everyone I work with, regardless of level or title, I consider my superpower, and I’ve been told people like to work with me because I’m a pleasure to work with. So, I don’t think you can be too nice or respectful.

Kimberley Cole 32:57
What’s one word that would describe or define your career?

Penny Cagan 33:02
Knowledge.

Kimberley Cole 33:03
Excellent. Yes. Whoa, we can see that. And what is your top skill required for the future?

Penny Cagan 33:11
Adaptation. In this changing world definitely, adaptation.

Kimberley Cole 33:16
Excellent. I totally agree. And I guess we love to end on a bit of inspiration, so hopefully you managed to find us a quote or a message to inspire our Risky Women for the year ahead.

Penny Cagan 33:32
So I recently actually went to a wellness retreat, and actually nutrition started with this quote, and being the risk geek that I am, I couldn’t help but think about how it impacts risk management, so the quote is from Lao Tzu, and it is, ‘If you do not change direction, you may end up where you are heading.”

Kimberley Cole 33:49
Nice, I like it. Excellent. Well, Penny, it has been an absolute delight to speak with you, and best of luck with the book. We look forward to seeing it creep up the bestseller lists, and I hope everyone really enjoys getting this little insight, and then gets their copy of the book for you.

Penny Cagan 34:10
Thank you. It’s been a pleasure.

Kimberley Cole 34:15
Thank you for listening to this episode of Risky Women Radio, be part of the ongoing conversation and learn more about our events and other programs at riskywomen.org