Podcast S9E14 | From Controls to Outcomes with Suzanne Allen

TRANSCRIPT

Kimberley Cole 0:01
This is Risky Women Radio, a show that connects, celebrates and champions women in risk regulation and compliance. We’re here to share the insights on the biggest issues in our industry and hear inspiring journeys from our global members. Sign up to our newsletter at riskywomen.org. I’m Kimberley Cole, your Chief Risky Woman.

Kimberley Cole 0:23
Welcome to Risky Woman Radio. Today’s risky woman is a powerhouse in operational and enterprise risk. She helps financial institutions turn complexity into clarity, transforming risk from a regulatory obligation into a strategic advantage. From operational resilience and AI-driven risk analytics to governance, DORA readiness, and incident management, she’s known for building smarter frameworks, stronger controls, and even cutting incident backlogs by 80% If you’re ready to hear how proactive risk leadership creates resilience organisations, you’re in for a great conversation, she’s also a Risky Woman Woman to Watch. Welcome, Suzanne Allen.

Suzanne Allen 1:08
Thank you. It’s great to be here, Kimberley.

Kimberley Cole 1:10
We’re excited to have this conversation with you today. So I’ve kind of shared just a little bit about how fabulous you are, but can you tell us more about how you found your way into risk management?

Suzanne Allen 1:24
Well, I actually had a whole other career before I started in finance and risk management, and I used to ride horses professionally. Which there’s more similarities between that and working in risk than you would actually think. So yeah, I grew up in Northern Ireland, spent weekends, evenings, all my time was riding horses, improving ponies, bringing them on, competing at shows throughout Ireland, and later, from the age of about 12 or so, I started competing at shows in England too. So I actually deferred a place to study medicine at King’s College London when I was doing my A levels, to take a year out. That year out turned into seven years out. So during that time, I was based in the northwest of England. I was competing in shows all over the country nationally. So I was very lucky to compete at Royal Windsor Horse Show, the Horse of the Year Show, which used to be at Wembley. It’s now at Birmingham NEC, and I also won the intermediate championship, which is for riders under 25. I won that at the Royal International Horse Show at Hickstead.

Kimberley Cole 2:29
Amazing!

Suzanne Allen 2:30
But then a few years passed, and I decided it was time to finish my education. I’d already ruled out medicine, despite my earlier notion to do medicine, so I actually thought…I’d done a little bit of work…I worked closely with show secretaries and things while I was riding and competing in England. Actually, created the first online entry system for horse shows called Show Pay. So, ever in hindsight, it was about 15 years ahead of its time because people didn’t actually start using those systems until after the pandemic, when shows started opening up again. So I was a trailblazer in that respect, but just far too early to market. But because of that experience with databases, spreadsheets, all the admin stuff I did, I thought I’ll do a business IT degree, and I want to move back to Northern Ireland. It’s a good university. I was educated in Belfast. Queen’s seemed like the obvious choice. When I started that degree, I knew I was also keen on it because there was a placement year included, so one year third year placement where you worked in industry for a year. All I really wanted to do when I started my degree was work at Google. I don’t quite know why. When it came down to interviewing and applying for roles, I applied for Google, and they said, “Oh, we only offer a three-month internship, but if we like you, you could stay on. In order to get my degree, I needed to do 11-12, months, full year, and I didn’t want to take the risk of not being given a full year placement. So I thought, well, let’s look elsewhere. And I actually was at one of our careers events at Queen’s, and I picked up a job spec for forensic technology at Price Waterhouse Coopers, and it wanted somebody who had an understanding of spreadsheets, databases, bit of financial services, know-how, and understanding of how financial services operated, and I thought, “Oh, fantastic! I’m going to apply for this. So, yes, had a very exciting year. I actually spent 16 months at PwC, based in London for the entire time. Even though I was working for the Belfast office, I lived for six months in the Mayfair Hotel, got some great hotel points, then moved into a service apartment because I just decided I wanted to not be eating out every night, but it was a great experience. So I worked on the administration of Lehman Brothers following its collapse in 2008. So yeah, I joined PwC in 2009. Was there for just over a year. Realised through my experience there that I really, really didn’t know that much about financial services, banking, investment banking markets, and wanted to learn more. I thought the best place to learn from that was to work somewhere within operations. So I wasn’t really interested in going straight into front office. Didn’t want to be doing a solely technology role, so I thought operations was a good place to go. So I joined Nomura on their operations scheme, spent just over a year in middle office looking after fixed income on the prop trading desk, then fairly quickly moved into operations risk and control, and since then all my roles have been within risk. So all elements of frameworks, RCSAs, incidents, losses monitoring, KRI’s, and scenario analysis, and I’ve absolutely loved it.

Kimberley Cole 5:45
What an amazing journey! I love all. I didn’t know anything about the background of horses and moving from medicine to the career that you’ve had. So that’s fantastic. And thinking about that sort of sporting background, are there things that you still consciously apply in your leadership and risk management today that you think you’ve brought from that sporting background?

Suzanne Allen 6:10
Yeah, I think the preparation and proactiveness is key. When you’re producing a horse for the show ring, you want it to peak for the biggest shows, so you learn from things and develop the animal as you train it, as it grows and matures. You take what you’ve learned and apply it to what you’re going to do in the future, and that’s very much what I do with risk. So, for example, I’ve worked in fintechs, global markets organisations, investment banking. What I like to do is take what I’ve learned previously, where I’ve made a mistake, realised too late I should have taken a slightly different approach, but I won’t make that mistake again. And it’s the same thing when you’re competing a horse. If you realise they don’t like flags, then you maybe don’t take them to a show where there’s a lot of flags and noise and things. So, it’s really that preparation and resilience has been really helpful, and also time management, having a target. So I’ll know if you’re wanting to peak for the horse of the air show at the end of the season. You prepare your horse in that way, and then the same thing if you’ve got a quarter end deadline, or you know you’ve got your year end scenario analysis and ICARA sort of submissions and things to do. You work backwards and plan by this milestone. I want to achieve this. Then by the end, I’ve made sure I’ve given myself a few weeks leeway if something goes wrong. So it’s that resilience and planning has been key throughout my career, and that’s something I’ve brought from my world of riding horses and producing them for the show ring.

Kimberley Cole 7:42
I think that’s great, and I think that’s something that people, certainly those starting out earlier in their career, should think about. That there’s so many different experiences that you can have that you can bring forward, and skills and knowledge and capability that you can apply. So I think that’s amazing. So what change would you hope that your leadership ultimately leaves behind, and whether that’s in people, cultures, or the profession?

Suzanne Allen 8:10
I think all three. I’d like to imagine I could have an impact in what people sort of think about risk, and maybe bring about a shift in how people think about a risk. I think it’s quite often perceived as something that sits alongside the business, but more increasingly, my most recent roles have been more instead of being the no person, they have been more as business partnerships and working with the business. One thing I think has become more prevalent in risk management in coming years, and everybody’s sort of buying into this is it’s about outcome-based focused. Does risk help us make better decisions? Giving risk a seat at the table when decisions are made, and not just after a new product has been discussed and confirmed and is ready to go to launch. The very very beginning of a new product, and it’s just making conditions where people ask better questions. They challenge constructively, and they understand the consequences of the choices they are making. And I’d like risk management to be more accessible. It shouldn’t be very much jargon based and technical. It’s something that everybody should go about their role, especially financial services across wealth managers, banking environments-we’re all risk managers to a certain extent. And one thing I’m exploring to give a little bit of a plug for Risky Women as well. I entered the Risky Women Write competition last year, and although my English teacher won’t be very surprised to know I didn’t win a prize, I got some quite good feedback, so I was happy with that. So I’m looking this year some sort of provocative titles I’ve come up with. Or risk management will disappear. Because we are all risk managers and we’re all responsible for managing the risk in our organisation. Whether you are a risk owner in first line or you’re working more in the second line, which is where most of my career.

Kimberley Cole 10:00
Yeah, excellent, and thank you for mentioning Risky Women Write, one of the favourite programmes that we run. I absolutely love it because we get just so many interesting and amazing thoughts. And obviously, our aim is to get more female voices out there, get more females quoted and sourced in other press, so thank you for being part of that as well. I love this question and to get people’s different views on this. But what emerging challenge in GRC do you think will disproportionately require women’s voices and leadership?

Suzanne Allen 10:39
Okay, so one of the main things I really love about working in risk is the fact that you get to see all over a business, and that requires you to be quite adaptable in the processes you’re building, the technical skills you need to have. You’re communicating with people at all levels of seniority and all levels of knowledge and understanding of risk. So, talking to somebody in front office or technology is very different from talking to somebody in legal, and then I also think it’s one of the few professions where curiosity is genuinely a strength. So by that, we need to ask better questions. We don’t just accept the status quo; we make suggestions to improve the control framework, to mitigate risk, to lower risk, and I think that’s something that females are quite adaptable, and it’s not just female diversity, but it’s diversity of all respects. So having all those different viewpoints in a business, if they’ve all come up from the graduate scheme in the same business, and there’s nobody’s ever come in and challenge what they’re doing, they’re going to be a bit taken aback by somebody coming in and say, “Well, actually, have you thought of this?” So I think that’s something. I think women can be quite pragmatic and naturally curious, which I think is a key thing. And then the other emerging challenge in GRC. I haven’t been to a roundtable or a CPD event or anything this year which hasn’t mentioned this particular area. Think you’re going to know whatit is. It’s AI. So for AI governance, it’s not simply because it’s a new technology. It’s we’re being forced to make decisions around ethics, regulation, customer outcomes, technology, business strategy, and I think women are quite adaptable, and although they’ll have the technical background, they’re not purely technical conversations. They’re like human conversations, and I think women are naturally quite good at those communication skills, softer skills. So we’re not just saying, “Oh, there’s a risk of explainability here. We’re actually working out from a perspective of being embedded within a desk or a team in a bank or a financial services organisation, how does it impact us? And I think women are-I think we’re like naturally collaborative, curious, and comfortable navigating ambiguity. So I would really like to see in the next few years, as the role of the chief AI officer becomes more prevalent, there’s already those people in place in the bigger organisations. Sometimes the CRO or the Chief Technology Officer will become Chief AI Officer. But what I’d really like to see is more women taking on that role.

Kimberley Cole 13:14
Yes, especially given some of the bias that exists in the model. So, totally agree. Now let’s get on to today’s topic, which is the future of risk management. So we kind of lead nicely in there, from controls to outcomes. And you mentioned some of that outcome-based focus already. So you speak a lot about moving from controls to outcomes. So can you explain more about what you mean by that?

Suzanne Allen 13:42
Yes, absolutely. So recently, I’ve been publishing a series of articles on LinkedIn. I’ve planned a two-week, 10-week series, published every Thursday morning. I do a quick sort of blog entry article on various aspects of the future of risk management. The first one I went to was from controls to outcomes. I think in doing that, I’ve learned a lot. The feedback I’ve got and the comments that have generated have driven the next one in the series. So I haven’t just been sort of rigid in what I’m going to discuss. I’ve taken on board people’s comments and used that to drive the rest of the series. So I’ve been quite fluid in preparing, sort of from two through to the final series, which should publish in a couple of weeks. So sometimes, what I think about moving from controls to outcomes, traditionally we’ve counted the number of controls and the number of completed risk assessments, the number of policies reviewed, or how many committees we have. And although these things are important. They’re measures of effort rather than measures of success. So that’s what we really want to come to with outcomes. So at the minute there’s a lot of focus on new regulation, so AI governance, we’ve touched upon. The other one to consider is consumer duty. It’s very much about your outcomes for clients. Customers, customer doesn’t care whether you’ve got perfect framework in place. They want to know that their money’s being looked after, their fiduciary duties are being followed by the company, they’re being protected from harm. So that’s sort of the key thing: Are we treating customers fairly? Are critical services resilient? And what sort of strategic decisions are being made with appropriate understanding of risk, and how can we make boards aware of the consequences of their decisions and help them in making those decisions? So yes, consumer duty has been very important. You’ve also got resilience considerations, particularly with the rollout of DORA and the FTA’s rules on operational resilience, so yes, consumer duty resilience-it’s healthy for the profession. It brings risk management closer, closer to the board, and closer to what organisations are trying to achieve.

Kimberley Cole 15:56
Interesting, interesting. So, I mean, I guess what are the practical changes that you think organisations should make if they’re really going to become outcome focused?

Suzanne Allen 16:06
Yeah, they don’t need to ask questions like, “Has a policy been reviewed? Is this control been tested? It’s really, are we giving customers the right outcomes? Are we looking after our clients appropriately? Are our critical services resilient because ultimately, client is going to be impacted by a disruption. They won’t be impacted if a policy doesn’t get signed off by the deadline. So it’s interpreting which of these things are key for our good customer outcomes, not just the more tick box compliance type exercise about risk management.

Kimberley Cole 16:41
Yeah, which I think would also make the job more meaningful to the people involved as well. I mean, that’s it is about the why almost, isn’t it?

Suzanne Allen 16:51
It’s about people’s reason for being, and what I’ve always tried to get across in my career, particularly in risk, where they tend to see, oh, risk are going to say no, risk are just asking us to update RCSA. What I’ve tried to get across to them is good risk management is good business management, and I’ve always tried to frame, if I’m putting a meeting in for somebody to talk about their RCSA, to talk about their incident backlog, I try to frame it as why is this an important thing for you to be doing, and you to understand why are we doing it. Not just we need to review this because it’s due at the end of the year. Yeah, that’s what I try to get across, and I think that’s really important. So, determining if you’re performing a risk register, we’re looking at decisions around strategic initiatives and things like that. So, like when you start measuring success in terms of business outcomes, your governance reporting and controls naturally begin to align around what really matters.

Kimberley Cole 17:51
And you mentioned about risk having a seat at the table and even this being like a board agenda. Do you think boards are ready for this change in approach, or is there still a gap between expectations and the capabilities?

Suzanne Allen 18:06
I’ve worked in a number of contracts in different types of organisations the last few years. So I’ve been at fintechs, I’ve been at wealth management firms, a couple of markets. The challenges they all face are very similar, but a lot of it is down to are they a more traditional business? In that case, I think those more traditional businesses there is still a bit of a gap and a bit of a maturity journey for them to go on before the boards are going to be fully comfortable and fully cognizant of what’s going on in risk and how it impacts them and their decisions. What I’ve seen in some of the more modern firms, so in fintech, regtech, and research I do myself in looking at various issues and things like that, they tend to be a little bit more mature and risk focused on the boards of those types of companies. So every company is different, but I do think across the industry we are moving in the right direction. Boards are becoming-they want the CRO at the table. They want the risk managers, senior risk managers, head of operational risk, head of credit, for example, to be able to come and present at board meetings. And they want to understand what’s going on from a risk perspective. There’s still a bit of a way to go for most firms, but we’re on that maturity journey.

Kimberley Cole 19:20
Excellent, and of course we touched on AI, but AI is clearly transforming financial services, and the adoption in financial services is probably one of the highest. Where do you see the biggest opportunities and risks?

Suzanne Allen 19:35
Well, it’s interesting because it’s both an opportunity and a governance challenge, as I touched on before. But I think a lot of public discussion talks about futuristic scenarios, but a lot of the risks posed by AI are risks that we face across other areas as well. So it’s a governance challenge, as I said, unclear accountability, inadequate oversight, bias or incomplete data, lack of transparency, and obviously AI can appear to be a little bit of a black box when it’s making decisions. So these are issues that risk professionals have been dealing with for ages. Now they’re just coming about a different context from the context of AI. One of the articles I published on LinkedIn was that AI governance will become product governance, and we’ll view it through the lens of new products, developing initiatives, new decisions that have to be made, new regulations that need to be followed. But yeah, customers don’t experience AI models; they experience products and services, and that’s why I arrived at that conclusion.

Kimberley Cole 20:41
And the AI governance piece. What’s then the biggest sort of misconception that organisations currently have about AI governance?

Suzanne Allen 20:50
Okay, I think they see it as a technology problem when, in reality, it’s a business governance challenge.

Kimberley Cole 20:56
Right.

Suzanne Allen 20:57
So a lot of bigger organisations tend to be quite siloed, so technology teams they build and validate models, but then that’s not viewed across the organisation. It’s only viewed in the vertical. So I think organisations need to understand accountability, customer impact, fix regulatory expectations, and ongoing monitoring. And I think it needs collaboration between all the different teams. So you’ve got technology who are maybe producing in-house AI tools, or are responsible for selecting the copilot ChatGPT offerings that companies have been implementing. But yes, it needs collaboration between tech teams, business, legal, compliance, and risk. So the organisations using AI, which there’s very few organisations are not using AI now. It’s a given, but they have to remain accountable for decisions even when technology is involved. So ultimately, the key controls you’d expect to have in place are the human in the loop type controls, which we’ve discussed at this fantastic events that you’ve been holding recently. It’s about who’s accountable and are we making sure that somebody is reviewing what goes out the door before it does?

Kimberley Cole 22:05
Yeah. So I mean, obviously, it’s making a big change to the role as well. So how do you see the role of the risk professional evolving?

Suzanne Allen 22:14
I think this is one of the most interesting periods for risk management. We’ve got so many new and emerging regulations, which I’ve touched on, consumer duty, AI governance, and I think the maturity level of frameworks will develop a lot in a lot of companies over the coming periods. So things like paying a law firm to review all the regulations that you’re subject to, to help you write policies, that will disappear with AI. It’ll become something which used to involve MI reporting at the end of the month, for example. Maybe involves a team of five people, analysts and associates producing decks. Now we have fantastic data visualisation tools. People can go and self-serve their risk data through Tableau, Power BI, all those great things. AI is becoming more helpful in looking at a huge document that comes from one of the regulators and determining what are the key things we need to be interested in. Where do we need to focus resources? The job will ultimately become more interesting as you’re not doing that admin-type work, which was a necessity before the emergence of AI. One thing which does concern me slightly early in my career, I did a lot of manual processes, reconciliations, building out macros to, certainly when I was my first job in middle office, when I was automating P&L reporting, I was building macros, improving spreadsheets and formulas, and doing all that manual effort, and we had various manual processes that we then automated. But in automating them, I learned a lot about how to programme, develop code through VBA, etc. I think those jobs don’t exist anymore. So what worries me is we’re going to have a gap. People are coming out of university; they’re AI natives. Those processes will be taken over by AI. So, how do you then get those people who are coming into the organisations and into the industry? How do you then get them from being analyst level? How do you then get them to the VP level if they’re not doing all that, for want of a better word, grunt work, which a lot of us had to do 10-20, years ago.

Kimberley Cole 24:24
Yeah, I think that is going to be a very interesting challenge across so many different industries as well. Whether there’s gaps in the knowledge and gaps in the capabilities because of that. So, I mean, if someone was starting their career in risk today, what skills would you encourage them to develop.

Suzanne Allen 24:41
Then, okay. So, firstly, this is something I’ve touched on: is you need a certain level of curiosity if you’re going to work in risk. You can’t just accept what you’re told. You need to be prepared to challenge, to form your own views, to take something you’ve learnt from one particular risk register and one part of the organisation, take that elsewhere, and you want to continually improve. So whether it’s improving a report, improving your technical skills, improving your soft skills, communication skills are so important. Although technical expertise is existential, if you can’t explain complex risks in a way that helps people make better decisions, then you’ll struggle to influence. And then finally, you need to use AI. Need to embrace technology. You don’t necessarily need to become a coder or a programmer, but understanding AI, data analytics, and digital transformation will really help differentiate you as a risk professional as you go through your career.

Kimberley Cole 25:37
And so, keeping on that future theme, what do you think risk management’s going to look like, say five years from now? And pick one big change that you hope that the profession embraces over that five years.

Suzanne Allen 25:52
I think risk management will start to disappear. We probably, maybe not in five years, but certainly in 10 to 15 years’ time, we will have risk managers embedded within departments and within teams, so it won’t just be the second line. It’ll be we are. This is one of the Risky Women Write submissions was that the three lines model is no longer relevant. I think that’s one of the biggest changes we’re going to see. Maybe in five years, but more certainly within 10 to 15 years, the three lines model will disappear. We will have risk embedded within every process we do, every decision we make, every report we produce. And as I said, good risk management is good business management. That will become more and more prevalent, and risk will become more and more embedded in processes, controls, systems, and everybody will have a part to play in risk, rather than it being thought of as the ultimate responsibility of the CRO and up to his team to execute risk within an organisation. It’ll become much more embedded.

Kimberley Cole 26:57
And what excites you then about that future of risk management?

Suzanne Allen 27:01
I think the opportunity to get more involved. If I was to move into a role as a risk manager within a trading desk or within a fintech, I could become much more involved in actually making those decisions and saying, at the minute, risk has a seat at the table, but quite often it’s not the ultimate. It’s either we see these risks. This is how we think we should progress. It’ll become much more embedded in decision making. It’ll become seen as really key. The CRO function may cease to exist if you have a number of risk managers across the organisation all reporting on their different, say, a risk manager for technology who then reports up to the CTO, Chief Operations Officer will have a risk person as well, and I think what that will do, and what I hope it will do, is break down silos.

Kimberley Cole 27:52
Well, I think that’s an interesting perspective on the evolution, the change, and the future state. So that’s fantastic. Thank you for that. And I guess if our listeners, our Risky Women listeners, took away one message from today’s conversation, what would you hope that it would be?

Suzanne Allen 28:10
I would like, I try to get this across to the people I work with – my key stakeholders in all companies I’ve worked for, risk management isn’t just about saying no; it’s helping people achieve their ambitions in a safe, sustainable, and informed way, and ultimately that company achieving what they set out to do. So I think technology regulation, customer expectations will continue to evolve, and the organisations that thrive will be the ones that see risk as a strategic capability rather than just compliance obligation, and I think that’s what excites me the most about the future of our profession. There’s a lot of evolution still to come. AI is driving that. Every time I move on to a new role, a new contract, look at a different framework, there’s something I’m learning from that, which I can then bring on to my next task and keep evolving, and I do think in certain type of careers you perhaps get to a certain level of seniority, and the work you do later in your career doesn’t really change year on year, six months on six months. I think you’re always evolving in risk, and that’s what really excites me and makes me encourages me that I think I’ve found somewhere that’s going to be an interesting enough role and a very interesting industry. It’s going to keep me occupied for a good while to come because I’m no spring chicken, but I’m going to be in the industry for a good while.

Kimberley Cole 29:31
Yeah, excellent! I love that. Absolutely love it. So now we’re going to do our little quick wrap-up questions. So short, sharp, punchy. Your leadership superpower?

Suzanne Allen 29:45
Creating clarity.

Kimberley Cole 29:46
Ooh, I like it. One word that defines your career?

Suzanne Allen 29:52
I’ve just used this word to describe how risk management as an industry is progressing. I would say evolution. So I’ve moved between first and second line, I’ve worked in all areas of financial services, and then I’ve got more involved recently in things like AI governance. Started doing my own thought leadership, and I believe risk management itself is evolving. So my career up until this stage has been about evolution, and I hope it continues to evolve.

Kimberley Cole 30:19
Excellent. I thought it was going to be hard to just get one word.

Suzanne Allen 30:24
Sorry.

Kimberley Cole 30:25
Top skill required for the future?

Suzanne Allen 30:28
I think judgment. So we need to combine the data, what the technology does for us, what technology tells us, but ultimately it needs someone to make that decision. So it’s the signed judgment of the human not allowing technology to make decisions for us.

Kimberley Cole 30:46
And what’s the future of governance, risk, and compliance in a single word?

Suzanne Allen 30:52
Outcomes.

Kimberley Cole 30:53
Oh, nice!

Suzanne Allen 30:55
I’ve got one more word for it, though.

Kimberley Cole 30:56
Okay,

Suzanne Allen 30:58
Because I was debating what to use, but I think outcomes is key, but also intelligence, and I don’t mean AI intelligence. I mean decision and risk intelligence.

Kimberley Cole 31:08
Right, interesting. Well, it’s been a fascinating conversation on the future of risk management from controls to outcome. So everyone should go on and follow Suzanne Allen on LinkedIn and read all of the articles. And thank you so much for joining us and being a fabulous Risky Woman.

Suzanne Allen 31:30
Thank you, Kimberly. It’s been great to join you. Thank you so much. And Risky Women, anyone listening out there, it’s a fabulous organisation, great events, good competitions, fantastic CPD. I’d fully encourage anyone to join, and I look forward to meeting more risky women at future events.

Kimberley Cole 31:46
Wonderful. Me too. Bye.

Kimberley Cole 31:49
Thank you for listening to this episode of Risky Women Radio, be part of the ongoing conversation and learn more about our events and other programs at riskywomen.org