1. Risk and Complexity in 21 st Century Organisations Saturday 4 October 2014 CIMA Conference: Essential management accounting tools

2. Why do people matter? Human nature is … Individualist … or … collectivist Human nature is … Individualist … or … collectivist What do you believe … ? I or C? Which do you think? The way we live … “superiors” tell “inferiors” … or … “equals” negotiate the “rules” Prescribed/In-equal … versus … Prescribing/Equal The way we live … “superiors” tell “inferiors” … or … “equals” negotiate the “rules” Prescribed/In-equal … versus … Prescribing/Equal Tell or Negotiate? T or N? Which way does it work? ©AndersonRisk, 2014

3. And cultural theory... Fatalist Individualist Egalitarian Hierarchist Richard Branson Philip Green Entrepreneur Greenpeace Environmentalist Prince Charles Typical Government Chief Scientist What will be will be I C Tell Negotiate ©AndersonRisk, 2014

4. How do we spot them? to me… to my competitor to someone else to me It happened… It might happen… ©AndersonRisk, 2014

5. The extended enterprise Joint Endeavour Outcomes Multiple Economies in Multiple Societies ©AndersonRisk, 2014

6. Multiple Economies in Multiple Societies The extended enterprise Joint Endeavour Outcomes Customer 1 Customer 2 Customer 3 IP Owner Regulator Sub- Contractor 1 Sub- Contractor 2 IT Outsource Provider Government Supplier 1 Supplier 2 Agents Prime Contractor Labour ©AndersonRisk, 2014

7. The extended enterprise economy A complex system is one in which even knowing everything there is to know about the system is not sufficient to predict precisely what will happen. Complex systems cannot be controlled – only influenced. Simple systems behave more like complex systems when under stress. ©AndersonRisk, 2014

8. Paradox: not susceptible to logical analysis Chaos & Paradox Volatility Uncertainty Complexity Ambiguity VUCA! ©AndersonRisk, 2014

9. Single enterprise or joint endeavour? ©AndersonRisk, 2014

10. The Social Dynamics of the extended enterprise Joint Endeavour Outcomes Multiple Civil Societies Extent of Shared Values Allocation of Incentives Relative Power Regulatory Influence ©AndersonRisk, 2014

11. What can we manage? ©AndersonRisk, 2014

12. Assurance and the risk manager Scale of the problem: Simple  Them  Complex Nature of the issue Operational  Strategic Approach Tools for Risk Management  Conversations in risk ©AndersonRisk, 2014

13. Risk Appetite and Tolerance Risk Culture Two management disciplines that must be “extended” ©AndersonRisk, 2014

14. Risk Appetite Level Propensity to take risk Propensity to exercise control Strategic Tactical Project/ Operational Measurement Stakeholder Value Risk Metrics Control Metrics Risk Taking Exercising Control Delegation Escalation ©AndersonRisk, 2014

15. So what does this mean in practice? A B t0t0 t1t1 Performance Time Current direction of travel for performance A B t0t0 t1t1 Performance Time Where you might get to if everything goes right D C Where you might get to if everything goes wrong A B t0t0 t1t1 Performance Time D C Risk Universe t0t0 t1t1 Performance Time Tolerance t0t0 t1t1 Performance Time Appetite ©AndersonRisk, 2014

16. What do risks have in common? Not a lot of prior institutional or individual experience Lots of perspectives or possible outcomes People liberated to argue from their own preconceptions Directly experienced in day to day activities Cannot imagine life without balancing these risks Manageable through science For example treasury, foreign exchange, some IT risks ©AndersonRisk, 2014

17. Achieving objectives depends on... – risk of taking on too much risk which becomes unmanageable Avoiding unnecessary problems – risk of avoiding everything, resulting in total inaction – risk of over-stretch resulting in burn-out Creating the right performance culture Setting appropriate corporate “ethics” and behaviours – risk of sclerosis as every stakeholder of every decision is consulted Taking more managed risk ©AndersonRisk, 2014

18. Zone 3 Dead Zone Zone 1 Dead Zone Zone 2 Performance Zone Long Term Performance Low High LowHigh (i) Managed Risk Taking or (ii) Avoiding Pitfalls or (iii) Performance Culture or (iv) Corporate Ethics and Behaviours Attribute: And doing the right amount of each ©AndersonRisk, 2014

19. Balanced Risk Performance Culture Corporate Ethics Avoiding Pitfalls More Managed Risk Performance Zone Dead Zones ©AndersonRisk, 2014

20. Enron? Or the Big Banks? Performance Culture Corporate Ethics Avoiding Pitfalls More Managed Risk Performance Zone Dead Zones ©AndersonRisk, 2014

21. UK plc? Performance Culture Corporate Ethics Avoiding Pitfalls More Managed Risk Performance Zone Dead Zones ©AndersonRisk, 2014

22. The objective Performance Culture Corporate Ethics Avoiding Pitfalls More Managed Risk Performance Zone Dead Zones ©AndersonRisk, 2014

23. And you…? Performance Culture Corporate Ethics Avoiding Pitfalls More Managed Risk Performance Zone Dead Zones ©AndersonRisk, 2014

24. So what? Performance Culture Corporate Ethics Avoiding Pitfalls More Managed Risk We want to create the mechanisms by which these risks can be taken to your advantage We need to avoid these without squashing your whole purpose and spirit Your’ culture has to be supportive of RM. We cannot cut across the corporate culture or go against the grain Do you have a can do/will do culture: this needs to be supported by appropriate, but not stifling, RM ©AndersonRisk, 2014

25. So what does this mean in practice? A B t0t0 t1t1 Performance Time Current direction of travel for performance A B t0t0 t1t1 Performance Time Where you might get to if everything goes right D C Where you might get to if everything goes wrong A B t0t0 t1t1 Performance Time D C Risk Universe t0t0 t1t1 Performance Time Tolerance t0t0 t1t1 Performance Time Appetite ©AndersonRisk, 2014

26. The bottom line for risk management? Start here... Get it right => Shareholder value growth Get it right => Shareholder value growth Get it wrong => Shareholder value destruction Get it wrong => Shareholder value destruction Bridging the gap Excellent competency in risk management Managing more risk taking Avoiding pitfalls Excellent performance culture Great corporate ethics and behaviours Managing more risk taking Avoiding pitfalls Excellent performance culture Great corporate ethics and behaviours ©AndersonRisk, 2014

27. Six components Risk Appetite 1 Business Context StrategyRisksGeographySegments 2 Risk Capab-ility CapacityMaturity 3 Risk and Control Risk Taking Control 4Measurement SH/H Val Key Data Governance model 5Assurance SourcesAlignment Risk Based 6 Board Report-ing InternalExternal ©AndersonRisk, 2014

28. DATA Risk Data Board and Senior Management Vision Risk AssuranceRisk Appetite Strategy Operating Model Policy Process Controls ©AndersonRisk, 2014

29. Risk Capability A function of 1.Capacity (how much you can carry?); and 2.Maturity (how much can your people cope?) ©AndersonRisk, 2014

30. IRM Risk Culture Framework IRM’s risk culture framework looks at component parts making up an organisation’s risk culture How will I react? How will I respond in recognition of other competing needs? What will I do? What will we do? Our overall risk culture Risk Culture Organisational Culture Behaviours Personal Ethics Personal Predisposition to Risk ©AndersonRisk, 2014

31. Risk culture aspects model Risk Culture Tone at the Top Risk Leadership Dealing with Bad News Governance Accountability Transparency Decisions Informed Risk Decisions Reward Competency Risk Resources Risk Skills ©AndersonRisk, 2014

32. Leadership in complex systems Relationships & behaviours Draw on widely diverse perspectives Adopt open enquiring mindset Go out of your way to make connections Tasks & ideas Be Clear Be Curious Be Courageous Invest in promoting values Establish compelling vision Embrace uncertainty Distribute leadership & decisions ©AndersonRisk, 2014

33. Conversations in risk management You CEO EE Partners Suppliers Clients IP owner Back Office ©AndersonRisk, 2014

34. Management campaign Take Stock Participants Purpose Roles Values Rewards Culture Appetite Target Operating Model Rules of engagement Desired outcomes Governance Information sharing Risk Management Gap Analysis Shortfalls from TOM Route map to achievement Address information asymmetries Next steps Action Implement Check Implement Check Implement Check Assurance Confirmation Harvest benefits Share lessons Desired Outcomes ©AndersonRisk, 2014

35. An approach to starting 1.Articulate strategy in terms of value drivers 2.Identify relevance and urgency of objectives, plans and projects 3.Identify both what needs to go right and what might go wrong 4.Develop responses 5.Document, keep fresh and share with staff (ie make it cultural) ©AndersonRisk, 2014

36. Value drivers Hard financial drivers Profitable turnover growth EBITDA Cash tax Interest Capital expenditure Changes in working capital Competitive advantage period Soft drivers Human capital Intellectual property Innovation Partnerships Joint ventures Reputation ©AndersonRisk, 2014

37. Some questions for the board How complex is our business operating model? What additional risks does complexity pose? Do we understand the risk tolerance associated with the complexity? How do we manage these risks? How do we get helpful risk information? How do we get sufficient assurance on our risk management investment? ©AndersonRisk, 2014

38. We use our knowledge, skills and experience, combined with proven tools, techniques and approaches, which we leave behind for them to carry on using long after we have finished, to transform their business. As a consequence they will face the future with more familiarity, they will feel more confident about their current position and they will be organised to go forward into these uncertain futures. This means that we must work with our organisations to re-imagine how they manage themselves, to make sure that they know where they are on important matters and to be confident that they know how to address uncertain futures. I passionately believe that we can make uncertain futures much more manageable... ©AndersonRisk, 2014

39. The bottom line ©AndersonRisk, 2014

40. THANK YOU Richard Anderson Mob: +44 (0)7807 780284 Email: rca@andersonrisk.comrca@andersonrisk.com Web: www.AndersonRisk.comwww.AndersonRisk.com Blog: http://andersonrisk.com/conversations/http://andersonrisk.com/conversations/ ©CIMA