Sean Thompson, President & Chief Operating Officer, NAVEX.
Between post-pandemic workplace issues, supply chain challenges, extreme weather, inflation and geopolitical turmoil, business risks are on the rise. Given these factors, business leaders must leverage all available data to identify potential risk for their organizations.
As the president and COO of a risk and compliance software company, I know there’s no shortage of data collected in running and operating a business, and more of it than one might think can be considered as “risk signal” data. Consider supply chain data, HR and personnel files, legal filings by suppliers and customers, sales trends, revenue and financial reporting and other third-party data. Viewed independently, these data sets each tell their own story. Collectively, they help you see the whole picture.
Looking at this data in aggregate, a business may see where there is causality and interdependencies, creating an opportunity to address root causes—treating the illness, not just the symptoms. For example, HR data might show an abnormally high turnover of female employees in the Midwest regional office over the last two years. Looking across data sources, it turns out there’s been an uptick in the number of harassment hotline reports in the region, and compliance training reports show managers in that office are overdue for anti-harassment training. Only when these data are considered together, do we have a clearer picture of the risk presented, as well as a path to mitigating it.
Moving From Siloed Data To A Comprehensive View
Today, it’s rare that a single person or system within a business looks at risk signal data holistically, which means leaders are often missing the depth of the business risk their organization faces. While each department may review its own data and address risks as they arise, ultimately, department heads are focused on individual mandates. The CISO must concentrate on the IT landscape, the CFO is focused on financial risk and so on across the executive suite.
While a Chief Compliance Officer (CCO) is charged with ensuring compliance with laws and regulations across the entire organization, I’ve found they typically have access to a limited data set directly related to compliance. Similarly, while risk management teams seek to uncover the different types of risk a company may face, data silos often keep risk teams from seeing the complete picture.
I think it’s clear that a holistic view of data is the linchpin for the next era in risk management and compliance, but it requires digital transformation. To understand and mitigate risks effectively, businesses need a comprehensive view of risk signal data and an understanding of the company’s overall risk profile. To get there, I’ve found organizations need three key ingredients: a system that collects, analyzes and presents risk data; a leader empowered to transform the organization to drive business insights from the data; and a supporting corporate culture.
The CCO As Transformation Leader
Who should lead this charge? I believe the CCO is the most appropriate leader to take on the challenge. They can drive this next era of risk awareness and mitigation. But they cannot do so if much of the needed data is inaccessible, and their own teams are still working from spreadsheets—or worse, paper. CCOs have the knowledge, motivation and skill set to drive risk awareness across functional areas, breaking down silos as they go. But they can only accomplish this if they have access to the right data—wherever it may reside—and the right systems and tools to analyze it.
When it comes to choosing technology solutions to help manage risk data, organizations should:
• Ensure they have fully assessed and understood the business problem at hand, as well as their desired outcome. By developing a list of core features and functionalities that are required to meet objectives, the scope of potential solutions will naturally be narrowed.
• Conduct a high-level ROI analysis to evaluate how the solution will meet the organization’s needs around risk data. This process should include validation of a vendor’s implementation and delivery track record.
• Prioritize change management initiatives and allocate the right resources to manage holistic risk data oversight. When it comes to the digital transformation of risk management and compliance, this means ensuring the CCO is supported in their role as transformation leader and involved in the decision-making process around the tools used to manage risk data.
I equate today’s CCO to the IT director role in the early 2000s. They helped navigate the first major digital transformation cycle. This was a time when information technology was once siloed—both in terms of data collection and the function’s status within the organization. Today, IT is rightfully considered strategic and is fully integrated throughout the business, with a CIO leading the charge. I predict this same evolution will play out for governance, risk and compliance (GRC). Of course, compliance leaders must partner with both IT and HR to drive the technology and cultural adoption needed to make this transformation happen—specifically because the risk and compliance agenda is becoming increasingly important to business success and an additional focus of executive management and the board.
As compliance leaders embrace this transformation, data silos and manual processes will begin to disappear. Risk signal data that informs smarter decision making will become increasingly visible—even obvious. At the same time, organizational cultures will become more ethically oriented, risk-aware and productive. If you’re skeptical, I suggest you just look at the data.