1. Enterprise risk management
INFO 312
AUTUMN 2015
UNIVERSITY OF WASHINGTON INFORMATION SCHOOL
WEEK #6A
NOVEMBER 2, 2015

2. Quizzes Some of you did quite well, and got all 3 points.
For others, not so well.
Going forward, I will try to mix multiple choice and fill-in-the-blank responses.
I will also make sure that there is only one answer that could be the correct one.

3. HBR: “Strategic Decision Making”
Most of the literature does not apply to the types of decision making that is most challenging for executives.
Decision research has produced good advice for routine choices and judgements where neither competition nor change is concerned. To execs, though, it’s not of interest or use.
Two dimensions of most of the research around decisions:
Can the decision make actually affect the outcome and the terms?
Is the aim of the decision to do well or to do better than others?
But strategic decisions might include entering a new market or acquiring another company.
Requires “clear-eyed analysis and the ability to take bold action.”

4. Rosenzweig’s Decision Matrix
Performance = the way we measure success. Is performance absolute or relative?
Control = Do we choose? Can we shape the options? And the consequences?

5. Four fields of the matrix
Judgments and choices – grocery shopping and investing
Influencing outcomes – ability to shift between first field and this one is called “deliberate practice” that includes a dispassionate analysis after the event (AAR). The shift is crucial element of high performance in repeated tasks of short duration, from sports to sales.
Placing competitive bets – how well you do compared to others. Guidance here comes from game theory which can illuminate areas but players cannot alter terms of the game. “An essential element (human behavior) is absent.”
Managing for Strategic Success -- we can influence outcomes and do better than rivals. (sports, politics, both left and right brain thinking)
Execs need to understand which field(s) they are making decisions in.

6. Deloitte-Compliance Week 2015 Survey
Corporate compliance function has evolved higher in Year 5 survey of 364 respondents
57% CCO reports directly to CEO or board
51% CCO has seat on executive management committee
59% CCO position is a stand alone (up from 50% in 2014)
55% regularly brief the board of directors
But numbers flat or lower on federation of the program into business lines
32% say compliance is seen as business partner (flat)
55% say compliance is a partner “in some respects”
43% have designated compliance officers in business units, subsidiaries or markets; if they do, only half report also to the global CCO (40% report to senior managers)

7. CCO Responsibilities Top Three are unchanged Ranked near the bottom
Code of Conduct
Compliance Training
Whistleblower Hotline
Ranked near the bottom
Records management
Relationship with regulators
Culture assessment
82% of organizations undertake an enterprise compliance risk assessment annually, if not more often
In conjunction with Internal Audit 33%
Or as part of an enterprise wide risk assessment 33%

8. Other troubling statistics
Though CCOs see third parties as the biggest risk, they continue to use same tactics to manage it:
42% always audit with policies or regulations
38% always perform extensive background checks
32% always require training or certification
30% of respondents still do not measure the effectiveness of their programs. If they do measure, they use same old practices
# hotline calls
Internal audit findings
Analysis of self-assessments done by business
Need better measures of effectiveness if they want their programs to remain or grow: what the return on what already has been invested? What’s the projected return on new allocations?

9. CCOs and IT tools and systems
Software used in compliance function may be jerry-rigged rather than a repository that pulls existing data from other reports
Compliance staff backgrounds may be legal or audit, thus without knowledge to make good choices of GRC or big data tols.
Staff spends a lot of time working to make reporting work rather than analyzing and trending the data collected.
Only 26% of those reporting budget increases say primary drive was new tools.
In smaller companies, the opposite is true, and may be because risks are managed in a more centralized way.

10. Other stats
Compliance budgets and staffs are small with 50% who say they have staff of fewer than 5, and with 40% saying their budget is $1M or less.
CCOs must work with other parts of the organization to carry out their mission, which will only work if CCO perceived as strong and trusted member of executive leadership
Financial industry is further ahead than other private sector firms. Larger budgets (8% with budget of $50M or more; and 17% with staff) and more likely to have a stand alone CCO (73%), who is more likely to sit on the executive committee (60%) and have subsidiary officers report directly (65%).

11. Questions?