Al Davis is currently the chief risk officer at Nelnet, a public company with more than $23 billion in assets. He has 30 years of risk management, compliance, information security, business development, financial analysis, debt financing, credit underwriting, accounting, treasury management, business continuity, and leadership experience. Prior to Nelnet, Davis was a senior vice president at Wells Fargo & Company responsible for credit underwriting, debt financing, and lending practices. When Davis is not managing risk for Nelnet, he enjoys kayaking and spending time with his wife Jane and dog Bella on his farm in Leesburg, Va.
Protiviti released an executive summary sharing executive perspectives of the Top Risks in 2019. The focus was on identifying key issues being discussed in the boardroom and C-suite: https://www.protiviti.com/sites/default/files/united_states/insights/nc-state-protiviti-survey-top-risks-2019-executive-summary.pdf.
Al Davis was asked to respond to questions from this executive summary relating to operational risks.
HUBER: Operational risks are those that may impact key operations of an organization in executing its strategy. By answering the questions below, please share your perspective on some of these risks and your thoughts on how the risk can be mitigated.
Succession challenges and ability to attract and retain top talent in a tightening talent market is negatively impacting many organizations in achieving their operational targets. What is causing this, from your perspective, and what steps can be taken to mitigate this risk?
DAVIS: The current economy and strong job market can certainly make it more difficult to find and retain top talent. To minimize these issues, companies should first evaluate their salary and benefit structure to ensure they are aligned or better than the competing market. Additionally, companies need to make sure they have a strong organizational culture so that employees are engaged at work and have a sense of purpose. Employees need to know they are adding value to an organization. If employees are proud of what they do, you can retain good people.
HUBER: Resistance to change restricts an organization from making the necessary adjustments to business models and core operations. Why are we seeing such a resistance to change and what can organizations do to change “resistance” to “acceptance” of change?
DAVIS: It is human nature to resist change. You have to almost defy human nature. People like to be comfortable in what they do, and you have to work with people and communicate the purpose of changes.
Change can bring many challenges. We must help our teams approach a challenge just like a project; do your research, create a plan, set goals, understand the risks and rewards, measure progress, and celebrate the small victories along the way. Below are several things organizations can do to embrace change and challenges productively:
- Over-communicate. People want to be kept informed when facing change or challenges. You need to share as much as you can when you can. Ask the extra question(s) and acknowledge that we may not always have all of the answers. Acknowledge this and work though issues together. Encourage people to voice their concerns, speak up, and keep lines of communication open in all directions
- Share your ideas. Be proactive and think about how you’d like to solve a problem, meet a challenge, or improve a customers’ experience. Be open to the fact that you might not have the one right answers, but know your contribution gets organizations closer. The best solutions are often a combination of different people’s ideas and suggestions.
- Value everyone’s input. Everyone has ideas and when someone shares an idea, thank them. Listen to and understand the range of differing opinions, ideas, and possibilities as the goal is to make sure everyone feel they are being heard.
- Seek to understand when someone is hesitant to change. Put yourself in their shoes and ask questions to see their point of view. Then discuss and address their hesitation. When individuals are unsure about change, feeling valued, supported, and understood goes a long way.
HUBER: Risks arising from reliance on outsourcing and strategic sourcing arrangements, IT vendor contracts, and other partnerships/joint ventures to achieve operations goals may prevent organizations from meeting organizational targets or impact brand image. What mitigation strategies can organizations implement to mitigate the risk on outsourcing?
DAVIS: Companies really need to understand who their critical vendors are and understand the impacts these vendors can have on their organization. Once this is understood, you can focus your attention on building strong relationships with these key vendors and implementing appropriate oversight and performance monitoring functions. The better relationship you have with your key vendors, the easier it is to solve issues or problems when they may arise. Additionally, you always want to make sure you have strong contractual agreements with your vendors and your vendors are adequately insured for incidents that may occur.
HUBER: Organization culture may not sufficiently encourage the timely identification and escalation of risk issues that have the potential to significantly impact core operations and achievement of strategic objectives.
What risk mitigation strategies can be implemented to mitigate this risk? And, how do you measure the success of the mitigation strategies that were implemented?
DAVIS: It is important to permeate across the organization a culture of open and honest communication. This message needs to be communicated down from executive management and throughout the organization. How do you know if this is effective, can you measure your success? This is a tough one to measure, but I think you need to look at the long term stability of your company and how you have adjusted to adversity and economic changes. The more open and honest communication you have, the more quickly you can react and adjust to change.
HUBER: Evaluating an organizations risk assessment process is a critical and ongoing activity. The questions below are being asked as it relates to assessing the impact of leadership and culture on risk management:
What steps do you take, as a chief risk officer, to secure the board and C-suite’s support for a more robust risk management process that is evident to key stakeholders across an organization?
DAVIS: You must build strong relationships with the C-suite and board members and understand what is important to them. Once you understand their strategy and expectations, you can build a risk management program that supports their strategy and the mission and vision of the company. You must understand what they want to get accomplished and figure out how risk management plays in to that – otherwise, it is difficult to gain their support.
HUBER: How do you obtain an accurate read on how an organization’s culture is impacting how employees engage in risk management processes and conversations?
DAVIS: You can look at the decisions the company and management are making. Are these good decisions and do they reflect the company’s strategy and consider risk impacts. We can gage culture through the decisions that are being made. Within company meetings and team discussions are you hearing people discuss risks, concerns, and alternative options based on these risks? If so, you most likely have a strong risk-aware culture.
HUBER: How can an organization implement a “speak up” culture that encourages transparency and sharing of contrarian information and bad news? And, how can employees be convinced they can “speak up” without fear of repercussions to their careers or to their compensation?
DAVIS: This really starts with a commitment to open and honest communication. If management can build an environment of open and honest communication, employees feel more comfortable communicating their concerns or issues. However, you must also have alternative options available like an Ask Ethics hotline or anonymous reporting processes. And, these processes must ensure quick and accurate responses to employee questions. Additionally, information submitted through these processes must be reviewed for trends or systemic issues.
Related to fear of repercussion; there needs to be a policy in place that precludes retaliation and make sure everyone understands the policy. This includes having a mandatory training program so people understand they can speak up and understand there is not a repercussion if they do speak up.
HUBER: Nailing down accountability for managing risks following a risk assessment is a critical step. What steps should be taken to ensure risks are being reviewed and strategies to mitigate risks are implemented?
DAVIS: It is important that identified risks are recorded and communicated to management and strategic and emerging risks are reported to the board. Additionally, risk assessment processes should also include follow up activities to ensure risks are being adequately addressed based on their level of importance.
HUBER: Should decision making processes consider the impact of a decision on an organization’s risk profile?
DAVIS: Yes. Company executive management, in collaborations with the board, should define the company’s risk appetite and communicate these expectations throughout the company. Corporate strategy, objectives, and business decisions should also be aligned with this risk appetite, as well as, the corporate mission, vision, and core values.
HUBER: With respect to communicating and overseeing the risk profile, why is it important to ensure the board is informed of the results of management’s risk assessment?
DAVIS: The board must ensure the company has the right governance structure and risk management framework to adequately identify and manage risks. The board needs to be routinely informed of strategic and emerging risks that could materially impact the company. This allows board members the ability to guide the company in the appropriate direction and, if necessary, challenge the decisions that are being made.
HUBER: Why is it important for directors to agree with the determination of the significant risks?
DAVIS: To make sure there is buy-in and agreement that these are the significant risks and to appropriately prioritize and allocate resources to respond and minimize the possible impacts of defined risks.
HUBER: As you know, my focus is on business continuity management. What role does business continuity have as it pertains to understanding and identifying risks? What steps can business continuity professionals take to add value to the role of the chief risk officer?
DAVIS: Since business continuity works with all business segments and operational functions to define business recovery and response plans, they have a unique ability to help build risk management from the bottom up and escalate risks that may otherwise go undetected.
Colleen Huber, MBCP, MBCI, CRMP, CBRM is a business continuity manager with Nelnet/Great Lakes Education Loan Services in Madison, Wisc. Huber is the chairperson of the Disaster Recovery Journal Editorial Advisory Board and an active member on all EAB volunteer committees. In addition, Huber is on the board of the Wisconsin Business Resiliency Professionals of WI.
