As we move into the more detailed areas of risk management, it is only right to spend a few minutes considering risk training. Risk management involves everyone from the chairman to the doorman. It includes considering outsourced service providers and contractors as much as employees.
Few staff are actually hired due to their knowledge of risk management and indeed many do not need believe that they need either risk management skills or mathematical skills to undertake their daily work. They are being hired to do a task, often with limited latitude for innovation or variance.
If you are seeking to implement a risk management framework, you will need to involve all the staff in the process. They need to understand their role in the framework and what it means for the job they do on a day-to-day basis.
They will be asked to think about things that might go wrong, as opposed to just being beaten up about things that have gone wrong in the past. This work could be conducted by the same staff who have previously been criticized whenever something is found to be wrong—and you now want them to admit things that have not even happened yet. Even worse, you expect them to be able to evaluate the impact of the uncertain event. Basically, they are unlikely to be able to do this without a significant investment in structured training.
There are accredited risk qualifications available, but these are unsuitable for most staff. Instead, the firm needs to develop its own training program that fits the market in which they operate. It needs to be commensurate with the size and complexity of the firm.
The key model that tends to be adopted looks at the following:
Severity = Event x Probability
If you are intending to ask staff about probabilities of things occurring, then they will need to understand basic mathematical techniques. Do not underestimate your challenge here.
Many people in management, even senior management, have very limited understanding of mathematical techniques. For lower level staff, expectations rather than knowledge levels could be even lower. Clearly, some degree of mathematics training is likely to be useful. Businesses use such business mathematics all of the time, yet the skills frequently are not there to enable the techniques that are available to be used and communicated effectively.
All staff need to understand the point of having a risk management framework. They also need to understand the difference between severity, as defined above, and the actual loss that is being considered. Remember, in any case where an event loss exceeds the unitary risk appetite, it must not be allowed to occur. It is not the severity that is taken against the risk appetite, it is the actual value. It is that loss that is unacceptable, not a percentage of it.
This training needs to be practical and relevant, focusing on the things that matter most to the audience. The values of the program need to be emphasized without making the whole process appear as a regulatory construct. If employees are provided with sufficient training so that they can understand their role in this process, then they just might reduce the level of errors that they make and get things right.
The issue of outsourced suppliers and contractors is also important. Just as new starters receive an induction program, including risk management, likewise consideration should be given to extending this to outsourced suppliers and third parties.
Finally, do not forget the Board and particularly non-executive directors. Since they are going to be provided with information on risk management, they had better be able to understand it.
In terms of how long the training should be, this will depend on the structure that you adopt. Many firms choose to appoint risk champions within individual business units who will have a higher level of training and knowledge than that provided to all staff.
If that is the structure applied, then the following depth of training may appear to be appropriate: