Enterprise risk management INFO 312 AUTUMN 2015 UNIVERSITY OF WASHINGTON INFORMATION SCHOOL WEEK #6A NOVEMBER 2, 2015

Quizzes Some of you did quite well, and got all 3 points. For others, not so well. Going forward, I will try to mix multiple choice and fill-in-the-blank responses. I will also make sure that there is only one answer that could be the correct one.

HBR: “Strategic Decision Making” Most of the literature does not apply to the types of decision making that is most challenging for executives. Decision research has produced good advice for routine choices and judgements where neither competition nor change is concerned. To execs, though, it’s not of interest or use. Two dimensions of most of the research around decisions: Can the decision make actually affect the outcome and the terms? Is the aim of the decision to do well or to do better than others? But strategic decisions might include entering a new market or acquiring another company. Requires “clear-eyed analysis and the ability to take bold action.”

Rosenzweig’s Decision Matrix Performance = the way we measure success. Is performance absolute or relative? Control = Do we choose? Can we shape the options? And the consequences?

Four fields of the matrix Judgments and choices – grocery shopping and investing Influencing outcomes – ability to shift between first field and this one is called “deliberate practice” that includes a dispassionate analysis after the event (AAR). The shift is crucial element of high performance in repeated tasks of short duration, from sports to sales. Placing competitive bets – how well you do compared to others. Guidance here comes from game theory which can illuminate areas but players cannot alter terms of the game. “An essential element (human behavior) is absent.” Managing for Strategic Success -- we can influence outcomes and do better than rivals. (sports, politics, both left and right brain thinking) Execs need to understand which field(s) they are making decisions in.

Deloitte-Compliance Week 2015 Survey Corporate compliance function has evolved higher in Year 5 survey of 364 respondents 57% CCO reports directly to CEO or board 51% CCO has seat on executive management committee 59% CCO position is a stand alone (up from 50% in 2014) 55% regularly brief the board of directors But numbers flat or lower on federation of the program into business lines 32% say compliance is seen as business partner (flat) 55% say compliance is a partner “in some respects” 43% have designated compliance officers in business units, subsidiaries or markets; if they do, only half report also to the global CCO (40% report to senior managers)

CCO Responsibilities Top Three are unchanged Ranked near the bottom Code of Conduct Compliance Training Whistleblower Hotline Ranked near the bottom Records management Relationship with regulators Culture assessment 82% of organizations undertake an enterprise compliance risk assessment annually, if not more often In conjunction with Internal Audit 33% Or as part of an enterprise wide risk assessment 33%

Other troubling statistics Though CCOs see third parties as the biggest risk, they continue to use same tactics to manage it: 42% always audit with policies or regulations 38% always perform extensive background checks 32% always require training or certification 30% of respondents still do not measure the effectiveness of their programs. If they do measure, they use same old practices # hotline calls Internal audit findings Analysis of self-assessments done by business Need better measures of effectiveness if they want their programs to remain or grow: what the return on what already has been invested? What’s the projected return on new allocations?

CCOs and IT tools and systems Software used in compliance function may be jerry-rigged rather than a repository that pulls existing data from other reports Compliance staff backgrounds may be legal or audit, thus without knowledge to make good choices of GRC or big data tols. Staff spends a lot of time working to make reporting work rather than analyzing and trending the data collected. Only 26% of those reporting budget increases say primary drive was new tools. In smaller companies, the opposite is true, and may be because risks are managed in a more centralized way.

Other stats Compliance budgets and staffs are small with 50% who say they have staff of fewer than 5, and with 40% saying their budget is $1M or less. CCOs must work with other parts of the organization to carry out their mission, which will only work if CCO perceived as strong and trusted member of executive leadership Financial industry is further ahead than other private sector firms. Larger budgets (8% with budget of $50M or more; and 17% with 100-500 staff) and more likely to have a stand alone CCO (73%), who is more likely to sit on the executive committee (60%) and have subsidiary officers report directly (65%).

Questions? asearle@uw.edu abbast@uw.edu