“Embedding”​ Test

S is for Sponsored – ensuring that there is executive and board level support for the programme and it is maintained over time. Leaders should challenge, be demanding, not just say the right things occasionally

O is for Owned – if someone is a risk owner, he or she should positively feel the accountabilities of ownership and this should be linked to his or her performance management and reward.

D is for Decisive – risk management is all very interesting but if it does not inform significant management decisions then it is largely window dressing. What was the last decision that was actively influenced by risk information?

C is for Communicated – you can’t embed things if they are a closely guarded secret. People need to talk about risks and risk management. It needs to be on the agenda and openly and transparently discussed

I is for Integrated – “risk management” is not a separate industry or, in some cases, a function. It needs to be core discipline integrated into a day to day business processes and activities to gain any long term traction. Is risk considered as part of the business planning, budgeting and strategy setting cycle, and can this be evidenced? How is risk factored into product launches or acquisition due diligence?

V is for Valued – do management value the outcomes such as risk information and risk assessment reports? Do they take pride in the quality of the process and outcomes? Are they impatient to drive improvement and make it even better, or do they want to get through the agenda as quickly is as possible? In some ways this is the “golden test”

S is for Sustained – already discussed above in terms of the importance of building strength in depth and a succession plan for all key role holders. Clearly, a succession plan for all key role holders in the risk management process would be a good starting point in this case but sustained training and development programmes also play an important role in achieving this goal.