By Alexander Larsen

As published in a longer article by the Institute of Risk Management HERE

What is a Risk Champion?

For an introduction on how to implement a successful risk management framework, we would suggest you read the following article from our Risk Guide published articles: Implementing A Successful Risk Champions Network

In order to implement an effective Enterprise Risk Management (ERM) structure to an organisation, the risk knowledge, decisions and behaviours needs to be integrated at every level. A Risk Champion is vital to achieving this goal, as an extension to the core risk management function, they can communicate risk information and influence risk culture and behaviours. In addition they can report back to the risk management team on what frustrates staff on the risk management approach and help overcome some of the challenges faced.

In some cases they can even act as leaders of culture change. Supporting staff and providing training. This is usually only the case once they have themselves received extensive training and as part of a risk mature organisation

What education do they need?

• champions need to be relatively senior
• they need to have the authority and ability to speak to people at higher levels
• they need to have been in the job for a while
• they may need to have a certain personality
• you might want someone with certain qualifications (e.g. financial or engineering background)

You don’t want to step on managers’ toes, but if you can give them a good idea of what you are looking for and how the specific characteristics and criteria will benefit them, you’re more likely to get the champions you need.

Once risk champions are in place, the training should begin from the very outset.

Induction and basic training

Context is important and therefore risk champions need to have an introduction to risk management and an understanding of their roles and expectations as they relate to the organisation.

These sessions should be interactive and involve various identification and assessment exercises.

Running sessions where the risk champions are able to work together also adds value. They build an informal relationship that can be helpful in understanding other parts of the business and how risks may interconnect and it helps to eliminate biases and groupthink from the early stages of developing risk management capabilities. It also builds a network of risk champions who can rely on each other and not always feel the need to ask questions of the risk management department.

One-to-one training

The Risk Manager should be hands-on and deliver dedicated one-to-one training and support.

This may be in the form of shadowing, inviting champions to workshops and involving them in the preparation and running of the sessions, as well as observing them running sessions as time goes on.

Essentially the role is to handhold until they are confident enough and providing the right quality of output to go it alone. These one-on-one sessions need to be integrated with the annual performance review process and cycle which should also include individual development plans for risk management.

Soft Skills training

Soft skills are a vital skill for any risk professional and risk champions will benefit greatly from such training, depending on the expectation set upon them. As an example, if they are expected to run workshops, then they should receive facilitation skills training, for presenting reports they should have presentation skills, and for dealing with numerous stakeholders they should be offered communication skills training.

These are just some examples of the types of soft skills training that would be extremely useful in their roles although there are numerous others

Multi-layered and multi-year training

Whilst the above training should be in place as standard, it is important to have a training plan in place that aligns with the longer-term aspirations of the risk management department. This should dictate any scope that you require from training companies. Alternatively an organisation could request a Risk Training specialist to develop a training plan for them.

Linking the training to the risk maturity aspirations of the organisation might be a good way to develop the training requirements. As an example, if the expectation is that quantitative risk analysis will be a feature of the risk management process across the organisation within a 3-5 year period, it might be useful to build a training program that prepares your risk champions to either understand the data inputs required or even go as far as training them on how to run Monte Carlo simulations with the help of software.

Having a 3-year training program (or longer) in place which guarantees a set number of days for training, for example, 5-10 days training a year over a three year period, will greatly improve the skills and knowledge of the risk champions whilst also meeting the needs of the organisation’s risk maturity aspirations. This has the positive knock-on effect of improving the overall risk culture of the organisation, with the risk champions able to better communicate the benefits of risk management to staff as well as improved support to all involved in the risk management process.

To really add value to the training program, it can be undertaken in conjunction with an organisation such as the Institute of Risk Management which would allow the risk champions to achieve a certificate by the end of the program. This ensures not only top quality bespoke training developed specifically for the organisation’s needs and in conjunction with a highly regarded professional training and education body, but it also adds an incentive to be a risk champion and to remain a risk champion, for the 3 years or whatever period the risk champions role has been specified as.

Encouraging HR to include such a certificate as a prerequisite for certain managerial promotions, etc., will even further encourage people to willingly put themselves forward for the role of risk champion.

Typical Agenda:

When training a risk champion, the following elements should be covered;

• What is risk management?
• What does risk management look like in the world?
• What does the organisation see as risk management (focus on opportunities too)?
• What is risk appetite and tolerance? What is the organisation’s current risk appetite?
• How do we go about identifying risk?
• How do we measure those risks?
• How do we manage those risks?
• How do we communicate and what reporting requirements do we have?
• How to facilitate workshops and risk conversations.