Chief Audit Executives and Risk Management Silos

Silos: Pros and Cons

On the positive side, silos enable risk specialization, with the finance department managing credit risk, the IT department handling security and privacy risks, and so on. Such specialization is an essential component of intelligent risk management.

On the negative side, however, silos allow risk specialists to work in organizational, and even physical, isolation. Different units within the enterprise bring to bear different philosophies and approaches. In the extreme, silos can become miniature ecosystems, each with its own culture, jargon, and practices.

A siloed state can lead to a host of problems, including duplication of effort, risk of unidentified gaps, lack of standard methodology, increased burden on the business, lack of appropriate reliance on one another's work, and absence of information sharing. All of which makes it extremely difficult—if not downright impossible—to fully understand and manage the totality of risks facing a company.

What's more, while organizational silos might work in isolation, risks certainly don't. A privacy risk, for example, can evolve into a reputational risk, a litigation risk, or a financial risk, all in rapid order.

Adopting a Portfolio View of Risk

The challenge for the chief audit executive (CAE), then, is to promote the integration of risk management information across organizational boundaries. By facilitating the development of a uniform corporate governance, risk management, and compliance framework, which is technology enabled, the CAE can bring about a better understanding of risks and how risks interact to help the organization formulate a stronger response to risks.

CAEs can also help risk specialists develop a common risk language, as well as a shared methodology for identifying, assessing, and measuring risk. This could enable the company to reduce the number of multiple risk and control self-assessments that are being performed, while yielding better information and business intelligence.

The lack of a comprehensive, or "portfolio," view of risk is an almost universal problem. When a company manages risk in silos, it can end up blind to the relationships between risks. For example, a company may set out to consolidate its product fulfillment centers as a way to reduce operational costs and risk; but at the same time, it may undertake a strategic risk and launch several new products that end up having little administrative or operational support on the back-end. As a result, order fulfillment and billing may be delayed, and customer dissatisfaction may run high. And the company's share price could plunge because the company did not consider the total risk picture.

Need another example? Consider third-party relationships. The legal department typically handles contracts and agreements when third-party relationships are initiated. But provisions often fail to factor in associated accounting and IT requirements, as well as controls monitoring or metrics tracking to ensure contract compliance. By taking all the appropriate functions within the company into consideration, a holistic view of outsourcing and third-party risks would result in a more efficient and effective risk management process.

CAEs can facilitate a portfolio view of risk by emphasizing cross-departmental sharing of lessons learned. The objective is to shift individuals' focus from a local perspective to an enterprise-wide response that effectively cuts across functions.

Harmonize, Synchronize, and Rationalize

As noted above, the multifaceted process of bridging organizational barriers to risk intelligence requires the development of a uniform framework. This framework can be divided into the following three tasks.

1. Harmonization—standardizing policies, practices, and reports, and establishing a common language for risk management. This can lead to a better understanding and management of risk interactions. It can also improve access to, and comfort with, risk specialists across the organization.
2. Synchronization—implementing cross-functional coordination for improved anticipation, preparedness, first response, and recovery. By developing a coordinated workflow, workload demands of various constituencies can be smoothed out. This helps to avoid unmanageable spikes as well as lighten the burden on the business.
3. Rationalization—working in conjunction with others, CAEs can help to reduce or eliminate duplication of effort with respect to assessment, testing, and reporting. This can be achieved, in part, through the deployment of new technology or with better utilization of existing technology. Rationalization also has the added benefit of reducing the expense burden on the business.

Conclusion

Even the most forward-thinking companies have experienced the disadvantages of silos. While CAEs should not assume accountability for risk intelligence, they can play a vital role in bridging these silos—and in improving their companies' risk intelligence capabilities.