Governance, Risk and Compliance

An Introduction to Risk Assessment Workshops

A key part of a successful risk management program is establishing a mechanism for accurate and effective Risk Assessments. Assessments come in all shapes and sizes, but the most common is the workshop. A successful risk assessment can contribute extensively to an organization’s ability to capitalize on events as they occur. A poorly run risk assessment is very inefficient and can result in an unfocused approach to risk mitigation.

The Risk Assessment Workshop

A workshop format enables participants to both contribute and learn in a natural environment. The result is not only a ranked list of key risks, but a fascinating discussion about the control environment, risk appetite, and individual risk tolerances. As stakeholders walk away from the session their understanding of business operations, objectives and challenges has expanded and they are equipped with the knowledge and the detailed analysis to make improved business decisions.

Some of the key benefits of a well-run risk assessment include:

  • A prioritized list of risks
  • Assigned action plans for each risk
  • Discussion of risks by stakeholders
  • Consensus about relative importance of risks among stakeholders
  • Awareness of different viewpoints
  • Understanding of where current control activities exceed risk appetite

Challenges of traditional Risk Assessments

A successful risk assessment can contribute extensively to an organization’s ability to capitalize on events as they occur. A poorly run risk assessment is very inefficient and can result in an unfocused approach to risk mitigation. Why? It starts by understanding what a typical risk assessment looks like. The average workshoplasts about 3-4 hours and typically has 5-10 senior managers, 2-3 additional employees, 1-2 consultants and a facilitator. Beyond the personnel costs there are also travel requirements and scheduling challenges.

In a traditional, manual risk assessment the facilitator guides the group through a set of risks and the group collectively voices opinions and tries to determine the impact and likelihood of the risks by consensus. Every risk and group is different, but on average a group of 10-15 employees will discuss each risk for about 15 minutes to arrive at an agreed opinion. Factoring in breaks and other normal meeting protocol the rate of analysis is about 3 risks per hour. That results in a very high cost per discussion, but well worth it if the result is accurate and provides insight.

Unfortunately a group environment has other dynamics that disrupt the process and result in an inaccurate or unrepresentative conclusion. The most often discussed of these is Groupthink; a symptom that emerges when a group of individuals collaborate in a closed environment and each influence and convince each other into agreement on a faulty conclusion. Another factor less commonly discussed but equally relevant is the bias that one dominant individual can place on the group opinion. This often manifests itself in the form of a very outspoken senior executive who uses his position to influence the opinion of others.

A sample of typical challenges follows:

Inefficient use of stakeholder time:

  • Inconsistent process
  • Difficulty understanding risk definitions
  • Inefficient collection of info
  • Wasted time in “fierce agreement”
  • Unfocused discussion

Reporting challenges:

  • Time spent mapping risks onto heatmaps and creating risk registers
  • Time spent keeping risk registers up to date
  • Opportunity for errors in creating manual reports (e.g. heatmaps & risk registers)
  • Effective Communication of Results

Inaccurate conclusions:

  • Discussion and results are dominated by a single powerful voice
  • Groupthink
  • Contributions are self-filtered to protect reputation
  • Politically sensitive issues are not candidly discussed

How Resolver Can Help

Over the past 15 years the global accounting and consulting firms that help you run these risk assessments have had a secret weapon in their pocket. Each of the Big 4, and many others including: Grant Thornton, Sunera, Protiviti, Eide Bailly, McGladrey, Marsh, Aon, BDO … use Resolver to run better risk assessments. Why? Because this simple tool improves the communication, the honest and accurate exchange of information, the efficiency, and the accuracy of a risk assessment workshop.

Resolver Risk Assessment is a simple application that enables the anonymous assessment of risks in a workshop environment. It is simple and flexible so that the technology does not distract from the meeting, in fact, you barely realize you are using a technology system. The anonymity encourages honest and candid assessments which convey the true impressions of the group. The reports and analysis you need are already built-in so you can see results immediately. Finally, the software allows you to focus the discussion and analysis on the risks that need it.

You’ll find that a workshop with Resolver Risk Assessment allows you to cover up to 10x the number of risks in the same time period without sacrificing important discussions. You’ll also find that the results are more accurate as it enables quick analysis of the degree of consensus for each vote.

Some of the benefits of a workshop facilitated with Resolver*Ballot are listed below:

Reduced cost:

  • Consistent terminology
  • Clear process
  • Common understanding of risk definitions
  • Rapid information collection
  • Improved discussions

Improved reporting:

  • Real-time reporting
  • Automatic heat map generation
  • Detail and high level views
  • Pre-built reports
  • Clear communication of results
  • Stakeholder Reporting

Accurate conclusions:

  • Equal representation in assessment
  • Anonymity improves candid responses
  • Politically sensitive issues can be tactfully managed

Resolver works with Risk Assessment Advisors who have helped companies around the world derisk their companies. Our clients include financial institutions, retail, government agencies, technology firms, mining companies, and small, community based companies.

The services we provide will ensure that your workshop will be a success. Having executed hundreds of workshops our teams know what the stumbling blocks are and how to avoid them. Our facilitators know how to handle the tough participants and get the group and focused on the right goals. And finally, these services and software are nicely bundled to get you everything you need for your successful risk assessment workshop.

Some specific benefits of our well-managed assessments include:

  • Clarity on terminology and assessment criteria
  • A proven, repeatable process
  • Risk language and phrasing improves comprehension and accelerates effective results
  • Risk Workshop Facilitation ensures a smooth and successful workshop
  • Software and services that provide a comprehensive solution

A Typical Risk Assessment Package

1. Planning and Project Management

Resolver works with customers to plan the risk assessment workshop to ensure that organizers and participants are properly briefed to complete the assessment. During the planning phase Resolver will:

  • Provide templates and examples of assessment formats and planning agendas to be customized for the engagement
  • Hold a pre-planning conference call with customers and participate in subsequent conference calls to plan the successful launch of the assessment
  • Develop the criteria and structure within the Resolver Risk Assessment software for participants to utilize
  • Populate the assessment software with the risks provided by the customers
  • Post-work meeting to review and provide results of workshop

2. Execution of Risk Assessment Workshop

  • Provide the customer with a workshop briefing PowerPoint presentation
  • Resolver will manage the logistics of the workshop, working with customer’s administrative team to ensure the facility is properly prepared.
  • Facilitate, operate and lead the customer through the Risk Assessment
  • Provide onsite technical support to ensure your meeting is a success

3. Summary Reports

  • Resolver will provide a variety of reports including the following:
    • An overall company heatmap
    • Vote distributions for each risk by division and stakeholder
    • Detailed results of risk assessment

4. Software & Hardware Rental Fees

  • Resolver Risk Assessment software application for Risk Assessment Workshop
  • Resolver Risk Assessment hardware – keypads and receiver

5. Beyond the Assessment – Manage the Mitigation Process

  • Resolver will discuss the options for managing the risks beyond the assessment. This will include
    • Developing a risk response plan for the risks;
    • Implementing risk responses for each of the risks; and
    • Managing the responses.
  • The outcome will be the ability for the customer to analyze information, manage risk, and present structured, tailored reporting (roll up and drill down) to senior management, auditors and other stakeholders.