When someone is a self-proclaimed realist, or simply pessimistic by nature, decisions are often made considering only one factor: risk.  Faced with a decision, they ask themselves questions such as: <ul><li>What is the worst possible outcome? </li><li>What do I need to protect myself against? </li><li>If this doesn’t go as planned, how will I respond? </li></ul>

Risk-Based Decisions

Aside from the benefits of considering what might be, rather than what might happen, studies have demonstrated that taking an optimistic view provides benefits beyond thinking big. A recent study in ScienceDaily found that optimistic people have less overall stress, and as a result live longer, healthier lives.  The shift from self-proclaimed “realist” to “striving optimist” comes from practicing what I refer to as “flipping the switch.”

Be A Striving Optimist

If you find yourself considering risks, flip the question to something positive. “What’s the worst that can happen?” becomes, “What are the best possible outcomes?”

Flip Your Negative Thoughts

If you are typically pessimistic, your biggest critic will be yourself. For this reason, make sure you share your optimistic questions and initial ideas out loud with others. When we repeat things out loud, we override the little green negative person who is on our shoulder whispering pessimistic views in our ear.

Share Your Optimistic View out Loud

It’s near impossible to be optimistic if you are surrounded by pessimistic people. This said, you can’t always eliminate these people from your life, so instead push back. When someone shares a pessimistic view, get in the habit of challenging their viewpoint. Don’t worry whether you have the answer to their concern; just simply share an opposing, yet positive, view.

Challenge Pessimists and Realists

Like step 3 above, although we can’t always control the people we are around, we can control what we consume. Be aware of what you read, where you travel, or who you choose to spend time with. If we consume negative news or information or spend time with negative people, we in turn will be negative. If you aren’t convinced flipping the switch makes sense for you, then consider the alternative. The world needs more optimism, and you can have an impact.

Minimize Time Spent in Negative Environments

Stashed ideas

How to become more optimistic

Many financial institutions have recently undergone major risk transformations that drove universal risk capability uplift and cultural shift. Uplifting risk management capability for financial institutions can be particularly challenging if the required transformation requires coordination across business areas and functions. For two decades, there has been an intense focus on nonfinancial risks (NFRs). While regional or global “super incidents” originally drove the emergence of NFRs as a theme, the evolution of NFR management is ongoing, with variations in form, region and severity.

Risk Transformation: The Premise

The implications of a super incident can be significant and include direct financial losses, fines, compensation or remediation costs, and reputational damage. Secondary effects could include reduced sales or accelerated disintermediation by other market participants (such as fintechs) due to lost trust.

A Super Incident

This environment drove financial institutions to initiate major risk transformation programs to address incidents, immediate issues, and deeper root causes. These programs have significant monetary costs. However, the opportunity cost for the organization is much higher, given the amount of management attention and organizational capacity required for successful delivery and sustainable conclusion.

The Costs Involved

The biggest challenge in starting a risk transformation is often not the “why” or the “what,” but the “how.” Questions include how to set it up and conclude it, and then transition back to enhanced business as usual. Large-scale risk transformations often fail because change is not effectively implemented across the organization: milestones are ticked off without actually improving risk management, addressing underlying culture, or reducing risk.

The Question Is How

These transformations are typically business-led, driven by embedded line-one risk and control teams. Such transformations often include process, system, and control mapping; process simplification, digitization, and automation; documenting, decommissioning, and building ideally automated, preventative controls and monitoring in critical process breakpoints; and clarifying responsibilities.

The Four Broad Categories of Risk Transformations: Business Area 

These transformations are typically business-led, driven by embedded line-one risk and control teams. Such transformations often include process, system, and control mapping; process simplification, digitization, and automation; documenting, decommissioning, and building ideally automated, preventative controls and monitoring in critical process break points; and clarifying responsibilities.

Risk-Type-Specific Capability Uplift And/or Remediation 

These transformations are typically driven by the respective risk experts (such as a money laundering reporting officer for financial crime and chief information security officer for cyber crime) and supported by the risk function. Such transformations often include risk-type framework and operating-model uplift, paired with targeted remediation of severe issues for a specific risk type. They are often triggered by severe incidents, issues, and regulatory scrutiny.

These transformations are typically driven by the risk function. Such transformations often include defining the ambition and value proposition of the risk function; improving the structure of the function (including divisions, risk-type expertise regions, and shared services); simplifying and clarifying the interactions with the business and other functional areas; and identifying and hiring capabilities to deliver.

Risk Function Operating-Model Uplift

These transformations are typically board or CEO-sponsored programs involving all businesses and functions and considering all (nonfinancial) risks. Such transformations often include<ul><li> uplifting the risk management framework and policy governance;</li><li> establishing, improving or operationalizing the risk taxonomy;</li><li> improving the risk appetite statement, in particular, for NFR metrics cascaded into business and operationalization;</li><li> uplifting and implementing a code of conduct and consistently operationalizing the three lines of defense model.</li></ul>

Holistic Enterprise-Wide Risk Transformation

Risk transformations often take two to three years of dedicated effort, with enterprise-wide transformations typically taking three to five years. While transformation setups differ, most have a central program team of five to ten full-time equivalents (FTEs) for smaller transformations, with holistic risk transformations running central teams of 15 to 50 FTEs that focus on coordination, tracking, quality assurance, sharing of best practices, and support for the most challenging problems, including the coordinated delivery of change across business areas and functions.

The Time Factor

After supporting numerous businesses through transformations, we have found that while the science of transformations is crucial to get right, it is the heart and the art that deliver transformation programs to their successful conclusion and sustainably embed the change across the organization.With science and art, the key conditions are in place for a successful risk program. But the heart is a prerequisite for deep cultural change, which is required for a sustainable enterprise-wide transformation.

What Makes A Successful Risk Program

<ul><li>Science speaks to the mechanics that need to be in place around program structure, integrated plan development, delivery mechanisms, and regulator engagement throughout the process.</li><li>Art refers to capabilities, accountability, prioritization, and the use of targeted interventions to keep the program on track.</li><li>Heart includes genuine shared motivation or purpose, a transformation mindset, a willingness to challenge cultural norms, and a program of communication that connects with the professional identity of employees. </li></ul>

The Science, The Heart, The Art

“Because the regulator wants it” is not an intrinsic motivation—one needs to dig deeper and consider the motivations of employees. Successful transformation in any circumstance will require as much of a change in mindset as in any system or process. An in-depth diagnostic of the psychology of the organization can help define a vision of change that connects to the collective motivation and purpose of the organization and ensures that the desired change will stick in the long term. “Serving our customers better” is an example of collective motivation.

Getting to The ‘Heart’: Motivation

The mindset of the transformation needs to balance delivery discipline and accountability; agility and pragmatism; continuous improvement; and a sense of chronic unease. This mindset will enable organizations to do what they say while still being able to course-correct and improve when new information becomes available and to quickly spot and address emerging challenges. If a risk transformation is initiated in response to a major incident, an honest appraisal of what drove the failures and adequate humbleness when considering the magnitude of the required cultural change is key.

Transformation Mindset

Organizations have a variety of cultural traits that help them thrive in transformation but also some that hold them back. Traits that often lead to unsuccessful or stalled transformations include being too siloed or too collaborative. This can lead to change being implemented inconsistently or stopped by a few business areas, or over-collaboration that results in a lack of productivity and missed deadlines.

Culture

Motivation must reach the hearts and minds of employees. An intensive and continuous dialogue with a broad set of stakeholders allows a transformation program to keep its finger on the pulse while also enabling staff to own challenges and drive solutions. Communication needs to build on the organization and its leadership’s personal motivation—this is what makes it genuine and effective.

Communication

<ul><li>The skills required to transform are often not those required to manage. </li><li>A risk transformation program team must have capabilities across project execution, strategy, and risk management. </li><li>The team should adopt both an inward- and outward-looking mindset that leverages the experiences of others. </li><li>Key roles in the business and the risk function may require new talent to bring fresh impetus to transform or deviate from ingrained practices (that is, breaking the mould). </li><li>Targeted external support for the expertise and ongoing challenges and advice is reasonable.</li></ul>

Appreciating the ‘Art’: Capability

Large-scale risk transformations require collective accountability: the whole executive team must stack hands to deliver the target outcome. The complexity and duration of these programs make them hard to execute; they are often costly and feel more like a burden than an opportunity. Balancing the accountabilities of individuals versus the whole organization, and linking program outcomes to remuneration, are both critical. Strong top-down authority from the board and CEO is essential in supporting prioritization, providing advice, and clearing roadblocks.

Accountability

One of the biggest challenges is managing competing priorities and ensuring that the organization can absorb the amount of change required. This requires clear articulation of short- and long-term milestones to prioritize and sequence change at regular intervals. A radical simplification lens, which addresses gold plating by particular framework teams and over-implementation by the businesses, can reduce the need to deprioritize and descope.

Prioritization

Means to anticipate hurdles and support course correction must be created: formal mechanisms to identify expected challenges in the form of regular premortem exercises and formal program reviews are essential. The central decision-making body needs the authority to rapidly course correct through reprioritizing or redeploying resources. This is also critical to address change fatigue, which will naturally occur over the course of a three-year program.

Intervention Mechanisms

Banks often consider risk transformation as the accountability of the risk function. However, this setup may just scratch the surface and fail to address root causes and systemic issues. Effective large-scale risk transformation requires particular accountability for the program to be assigned across functional leadership and business areas, where many of the inadequacies in systems, processes, and behaviours originate. Coordination between these stakeholders is essential and often driven by a neutral, central program team that sits outside of lines one and two.

Excelling At The ‘Science’: Program Structure

Implementation of complex change across the business (line one) is often where risk transformations fail. The best-designed set of change initiatives can fail without an effective delivery mechanism that supports implementation and sustainable embedment of change. Developing a mechanism to ensure appropriate engagement between lines two and one in the design of change initiatives—and a well-coordinated and considered delivery mechanism for supporting line one implementation—is critical. vv

Delivery Mechanism

Transparency and continuous dialogue with regulators are important. Proactive, professional, and respectful engagement can enable greater understanding and appreciation for regulators with respect to the challenges faced in large-scale risk transformations and can encourage offers for guidance and positive reinforcement. Regulators might share their own expectations and observations from other institutions and provide insight into their own priorities.

Regulatory Engagement

As the above three elements (heart, art, and science) demonstrate, successfully concluding a risk transformation seldom ends with just milestones in a work plan, ending a monitorship, or meeting regulatory commitments. These are important, but genuinely transformative success lies in the smooth shift from programmatic setup to sustainably uplifted business-as-usual operations with embedded mechanisms for further improvement.

The Bottom Line

Risk transformations: The heart, the art, and the science

<ul><li>Avoidance means not participating in activities that could harm you.</li><li>Retention acknowledges the inevitability of certain risks, and in terms of health care, it could mean picking a less expensive health insurance plan.</li><li>Sharing risk can be applied to how employer-based benefits are often more affordable than if an individual gets their own health insurance.</li><li>Transferring risk relates to healthcare in that the cost of the care is transferred to the insurer from the individual, beyond the cost of premiums and a deductible.</li></ul>

The Key Takeaways

Avoidance is a method for mitigating risk by not participating in activities that may incur injury, sickness, or death. Smoking cigarettes is an example of one such activity because avoiding it may lessen both health and financial risks.Life insurance companies mitigate this risk on their end by raising premiums for smokers versus nonsmokers. Under the <a href="https://www.investopedia.com/terms/a/affordable-care-act.asp">Affordable Health Care Act</a>, also known as Obamacare, health insurers are able to increase premiums based on age, geography, family size, and smoking status. The law allows for up to a 50% surcharge on premiums for smokers.

#1 Avoidance

Retention is the acknowledgement and <a href="https://www.investopedia.com/terms/a/accepting-risk.asp">acceptance of a risk as a given</a>. Usually, this accepted risk is a cost to help offset larger risks down the road, such as opting to select a lower premium health insurance plan that carries a higher deductible rate. The initial risk is the cost of having to pay more out-of-pocket medical expenses if health issues arise. If the issue becomes more serious or life-threatening, then the health insurance benefits are available to cover most of the costs beyond the deductible.

#2 Retention

Sharing risk is often implemented through employer-based benefits that allow the company to pay a portion of insurance premiums with the employee. In essence, this shares the risk with the company and all employees participating in the insurance benefits. The understanding is that with more participants sharing the risks, the costs of premiums should shrink proportionately. Individuals may find it in their best interest to participate in sharing the risk by choosing employer health care and life insurance plans when possible.

#3 Sharing

The use of health insurance is an example of transferring risk because the financial risks associated with health care are transferred from the individual to the insurer. Insurance companies assume the financial risk in exchange for a fee known as a premium and a documented contract between the insurer and individual. The contract states all the stipulations and conditions that must be met and maintained for the insurer to take on the financial responsibility of covering the risk.

#4 Transferring

This method of risk management attempts to minimize the loss, rather than completely eliminate it. While accepting the risk, it stays focused on keeping the loss contained and preventing it from spreading. An example of this in health insurance is preventative care.Health insurers encourage preventative care visits, often free of co-pays, where members can receive annual checkups and physical examinations. Insurers understand that spotting potential health issues early on and administering preventative care can help minimize medical costs in the long run.

#5 Loss Prevention and Reduction

The basic methods for risk management can apply to all facets of an individual's life—especially health—and can pay off in the long run.

5 Basic Methods for Risk Management

You can’t build software without encountering incidents – from critical bugs to full-blown outages, dealing with incidents are an inevitable part of the process.As a result, you’ll find no shortage of articles telling you how to write a review – or as they’re commonly known, a post mortem – of your incident. These top tips are widely practised:<ul><li>Avoid blame</li><li>Focus on the details</li><li>Ask why multiple times</li></ul>

Get More From Incident Reviews

<ul><li>Do we know what happened?</li><li>Do we feel confident about how we detected this incident?</li><li>Was it easy and straightforward to mitigate, rather than difficult and slow?</li><li>Do we understand the takeaways, aka the lessons learned?</li><li>Do we feel confident that we can prevent this from reoccurring?</li></ul> the five-question format made presenters feel like they were on trial. They were in the hot seat, at the mercy of anyone with a question. This made the review a high-pressure, isolating experience for the engineer presenting. It’s hard to learn when you, or others around you, don’t feel safe.

The Old Way: Asking Five Key Questions

Another problem with the format was that it didn’t create natural openings in conversation for other engineers to jump in. By focusing on a single event with set questions, we often overlooked commonalities and trends across incidents. This made it difficult for other engineers to understand what they could take away from these meetings and how the lessons might apply to themselves and their team.

Unclear Takeaways

We decided to start experimenting.<ul><li>We looked at the main improvements we wanted to see:</li><li>We wanted everyone to feel truly safe</li><li>We wanted to open up the conversation, encouraging open dialogue and collective learning</li><li>We wanted to observe patterns and move beyond isolated incidents to observe recurring trends</li><li>We wanted our weekly meeting to feel valuable, to be a weekly highlight for engineers</li></ul>

The New Way: Updating The Incident Meeting Format

Facilitation is a learned and practised skill – hard to perfect but hugely rewarding when done right.The three desired outcomes as goals are:<ul><li>Time flies</li><li>Everyone stays engaged</li><li>Everyone grows, even the facilitator</li></ul>

Flex Your Facilitation Muscles

We set a goal to generate at least four strong talking points: two based on the particular incident under review and two that addressed common themes. At the start of every meeting we would launch a poll with each of our talking points and ask participants to vote for the topic they’d most like to discuss. We’d start with the topic that topped the poll and go from there.

Getting The Talking Points

The question and answer format was not working, that was clear. So how could we guide constructive conversations that brought about real learning? It has always been team practice to assess submitted reports before each review, to make sure they meet our standards for a good report. We decided to capitalize on this process and use this review as an opportunity to extract common themes across multiple incidents.

Extracting Common Themes

To make sure these techniques were working we started sending automated surveys to our incident review Slack channel after each review. The poll asked participants to anonymously agree or disagree with the following statements:<ul><li>This meeting was a good use of my time</li><li>I think we discussed the right things</li><li>This meeting felt safe and constructive</li><li>I learned something new in this meeting</li></ul>

Post Meeting Survey

The progress we’ve seen to date has been really promising. We still have our outstanding problems, like how to tie these learnings into actionable items on our roadmap, or how to keep attendance strong in particularly busy weeks. But the aim of our program is to build an honest, accountable, and constructive culture within teams that care about our customer experience. The way your organization processes failure is a mechanism of change – if that mechanism is broken, boring, or painful, then your organization can’t reach its full potential.

Building an Honest, Accountable and Constructive Culture

You can’t build software without encountering incidents. We changed up our incident review, or post mortem, process to learn more every time.

How your engineering team can get more from incident reviews

The researchers devised a spectrum of hypothetical near misses based on real-life practice. Employees were asked to rank the likelihood that they would report the following near-miss scenarios, which become progressively more threatening to the patient:
<ul>
<li>Could have happened. The pacemaker status of a patient was not checked at the initial consultation. </li>
<li>Fortuitous catch. The pacemaker status was not checked. </li>
<li>Almost happened. The pacemaker status was not checked.</li>
</ul>

The Research

By framing near misses as important learning opportunities, as well as by fostering psychological safety, business leaders can increase the chances that employees will discuss close calls, potentially helping to avoid costly errors immediately and in the future.It may be up to managers to communicate a clear and compelling purpose, and to make sure that employees feel like their contributions are valued. When employees feel free to express their ideas and concerns, the whole group benefits, particularly when it comes to close calls.

Avoided Catastrophes

A brush with disaster can lead to important innovations, but only if employees have the psychological safety to reflect on these close calls, says research by Amy C. Edmondson, Olivia Jung, and colleagues.

How to become more optimistic

Risk transformations: The heart, the art, and the science

5 Basic Methods for Risk Management

How your engineering team can get more from incident reviews

How to Learn from the Big Mistake You Almost Make

It's time to

READ

LIKE

A PRO!