Risk management – J. Howard, CDO & CPO

Abstract digital network diagram showing a combined shield and AI brain hub interconnected with data privacy, security, and risk icons.

Executive Summary

For years, financial services compliance playbooks were written by and for commercial banks. But broker-dealers (B-Ds) are fundamentally different: fast-moving, sales-driven, transactional, and notoriously lean. They view heavy, bureaucratic compliance structures as growth-throttling cost centers and reject massive capital expenditure on defensive software.

Today, B-Ds face a double-barreled threat: meeting strict new privacy mandates like the SEC’s amended Regulation S-P 30-day incident reporting rule, while simultaneously managing rapid, unvetted AI adoption across trading and sales desks.

The solution is not two separate compliance programs, nor is it simply overlaying AI checks onto legacy silos. The real answer is native operational convergence. By architecting data privacy and AI governance into a single operating engine led by a single accountable leader, B-Ds achieve complete regulatory coverage and advisor agility at a fraction of the cost.

What You Will Gain From This Guide:

The B-D Divergence Map: Why bank models fail, why governance requires a triangulation of Data, Tech, and Leadership, and why native transformation beats overlaying tech.
The Bidirectional Convergence Lens: How Privacy and AI Governance blend seamlessly from both directions, whether starting with data protection or model risk, and how to harness AI’s revenue-generating momentum.
A 5-Pillar Operational Blueprint: Includes a single accountable lead (“throat to choke”), embedded change management, a full 10-question unified PIA/AIA intake with human audits, concrete opt-out mechanics, global regulatory alignment, and accelerated 24 to 72-hour incident SLAs.
Advisor Buy-In & Dual Liability: How to protect both the firm and advisor under Reg BI while maintaining open channels with a strict 24 to 48-hour review SLA.
Tooling Leverage: How modern Privacy Management Platforms (PMPs) give lean teams the leverage to run a multi-domain program without inflating headcount.

1. Will Copying a Bank’s Privacy Playbook Work at Your Broker-Dealer?

To build a workable privacy program for a broker-dealer, you must first abandon the bank compliance blueprint:

Attribute	Commercial Banks	Broker-Dealers (B-Ds)
Business Model	Slow-moving, relationship & balance-sheet heavy.	Fast, transactional, market-driven, and sales-dependent.
Culture	Risk-averse; structured “Three Lines of Defense.”	Entrepreneurial, fast-paced, protective of client relationships.
Compliance Scale	Large, multi-million dollar privacy & risk teams.	Lean compliance teams where CCOs “wear five hats.”
Data Footprint	Deep, long-term credit histories and deposits.	High-velocity trading logs, portfolio data, suitability records, and chat logs.

The Triangulation of Governance: Data, Tech, and Leadership

Many compliance leaders observe that “AI risk is data risk.” While true, that view is incomplete. Data provides the raw fuel, Technology provides the algorithmic engine, but Leadership provides the strategic intent, risk boundary, and accountability. Without proactive leadership, data protection and tech innovation pull the organization in opposite directions.

Native Transformation vs. Passive Overlays

Most firms make the mistake of retaining legacy, siloed B-D workflows and simply overlaying AI governance checks on top of existing privacy rules. Layering duplicate controls onto existing silos creates bureaucratic friction and delays innovation. Forward-thinking B-Ds must natively transform their operational architecture. Data privacy and AI risk management should be built into core software procurement, data ingestion, and sales enablement workflows from day one, establishing a unified compliance posture by default.

2. Why Is Separating Data Privacy and AI Governance a Costly Mistake?

Building separate Privacy and AI Governance programs is financially and operationally non-viable for a lean B-D. Because both domains govern how data is captured, analyzed, shared, and stored, combining them into a single engine creates immediate operational synergy.

Convergence Architecture: Blending Data Privacy & AI Governance
Architecture Tier	Risk & Governance Focus	Key Operational Elements
1. Foundational Layer	Unified Data & AI Catalog	Single inventory mapping NPI data repositories alongside internal and vendor AI models.
2. Parallel Risk Domains	Privacy Risk Domain • Reg S-P Compliance • Consent & Disclosures • Data Minimization	AI Governance Domain • Algorithmic Bias & Drift • IP & Prompt Leakage • Model Hallucinations
3. Integrated Control Engine	Combined PIA / AIA Intake	10-question intake evaluating privacy rights, vendor training limits, suitability, human audits, and data purging.

The Bidirectional Blend: What If AI Governance Came First?

In practice, when organizations deploy artificial intelligence, AI controls are built in a completely separate silo. They are rarely retrofitted into privacy frameworks because business leaders fail to recognize the shared data-risk space between AI and privacy.

Furthermore, AI possesses a dual nature that traditional privacy lacks: AI has a major business dimension (revenue generation, advisor productivity, and sales alpha) alongside a risk and compliance perspective. Privacy, by contrast, is historically viewed by executives purely as a defensive, cost-center burden.

Understanding this commercial pull changes how governance should be architected. When a firm establishes AI Governance first, driven by business eagerness to deploy generative sales tools or predictive trading algorithms, the technical controls required to manage AI risk naturally satisfy core privacy obligations:

Model Lineage Demands Data Lineage: Ensuring an AI model produces compliant recommendations requires knowing what dataset trained it. Fulfilling this AI risk mandate automatically maps customer Non-Public Personal Information (NPI), solving the hardest part of privacy data discovery.
Context Windows Demand Data Minimization: Restricting the personal data fed into an LLM’s prompt window to prevent hallucination and prompt leaks directly enforces the foundational privacy principle of data minimization.
Algorithmic Transparency Demands Disclosures: Explaining automated rebalancing or predictive wealth algorithms to satisfy FINRA and SEC suitability rules creates the exact transparency mechanics needed for state Automated Decision-Making Technology (ADMT) privacy disclosures and international AI mandates.

By capturing the revenue-generating momentum of AI, smart B-Ds can piggyback privacy controls onto AI governance initiatives, turning business ambition into unified compliance leverage.

3. How Do You Build a Lean, Compliant Governance Blueprint on a Tight Budget?

To deliver complete regulatory coverage on a lean budget, B-D compliance leaders should deploy this 5-pillar operational framework:

5-Pillar B-D Governance Blueprint
1. Single Lead & Change Council	Privacy & AI Lead (Single Point of Accountability) + Change Management Committee
2. Unified Data & Model Catalog	Single live inventory for NPI data flows, vendor SaaS, and internal/external AI models
3. Native Consent & Opt-Out Engine	Combined Reg S-P notices, state ADMT opt-outs, model training restrictions, and global AI framework alignment (e.g., EU AI Act, Colorado AI Act)
4. Full 10-Question PIA / AIA Intake	Integrated intake for Data Minimization, Model Isolation, Suitability, Human Auditing, and Data Purging
5. Accelerated Incident & DSR Engine	24 to 72-hour AI triage SLA + 30-day SEC reporting + FINRA Rule 4511 recordkeeping overrides

Pillar 1: Name a Single Accountable Leader & Change Management Council

Programs fail when there is no single throat to choke. Appoint one executive, a designated Privacy & AI Governance Lead (often a dual-hatted CCO, Head of Operational Risk, or CPO/AIO), to own overall program success.

While this individual does not need to be a machine learning engineer or privacy litigator, they must possess a strong risk management background and a solid grounding in core data privacy and AI governance principles. Equipped with this foundational risk expertise, they leverage modern automated Privacy Management Platforms (PMPs) and chair a monthly Data & Tech Governance Committee composed of the CCO, CTO, Sales/Desk Lead, and Legal counsel.

To keep the framework evergreen, the Lead operates with a small, focused core team working in direct consultation with Legal to maintain a live inventory of applicable laws, rules, and regulations and map them directly into program controls. This core team is responsible for ongoing program maintenance, monitoring operational effectiveness, tracking regulatory shifts, and serving as a central advisory resource for the entire company.

Embedded Change Management: The Committee isn’t just an approval bottleneck; it is a change management engine. It establishes desk-level compliance champions, redesigned workflows that eliminate advisor friction, and active feedback loops to ensure policies fit real-world trading desk realities.

Pillar 2: Maintain a Unified Data & AI Model Catalog

Replace static spreadsheets with a single inventory mapping NPI data stores alongside internal and third-party AI models. Capture data sensitivity, hosting infrastructure, model types (rule-based algorithms vs. generative LLMs), and vendor training rights during initial software onboarding.

Historically, building and maintaining an accurate data inventory has been one of the most tedious and failure-prone exercises for financial services firms, often resulting in abandoned, outdated spreadsheets. Yet maintaining a comprehensive asset inventory is a mandatory regulatory requirement under comprehensive privacy laws, such as GDPR Article 30 (Records of Processing Activities), state privacy statutes like the California Consumer Privacy Act (CCPA/CPRA), and the SEC’s updated Regulation S-P safeguards requiring strict data mapping of Non-Public Personal Information (NPI). The good news is that modern tech tools, specifically Privacy Management Platforms (PMPs) equipped with automated data discovery and cataloging connectors, make building and sustaining a dynamic, live data and AI model inventory far more viable and operationally effortless than ever before.

Pillar 3: Operationalize Consent Architecture, Disclosures, & Global AI Requirements

Consent and preferences form the foundational cornerstone for managing data privacy, assessing incident blast radiuses, and servicing DSRs. If a firm cannot demonstrate valid consent or track preference revocations in real time, it cannot accurately enforce data deletion requests or determine whether an unapproved AI prompt input constitutes a regulatory breach.

This is precisely where the complementary nature of privacy and AI governance becomes clear. B-Ds operating across state or international boundaries must account for emerging AI regulatory frameworks, such as the EU AI Act’s high-risk system obligations, the Colorado AI Act’s algorithmic discrimination prevention rules, and SEC/FINRA risk guidance. Because both domains rely on transparent data handling and user control, operationalizing compliance by embedding consent management, global regulatory disclosures, and preference controls directly into B-D workflows creates a single, mutually reinforcing default posture:

Centralized Consent Tracking & DSR Linkage: Capture and log customer privacy preferences, opt-ins, and consent revocations across client portals and onboarding flows. Automatically link consent records to DSR workflows so when a client revokes processing permission or requests deletion, downstream AI pipelines and marketing databases are updated instantly.
Incident Scope & Blast Radius Evaluation: In the event of a data spill or AI prompt leak, having centralized, real-time consent metadata allows the Privacy & AI Lead to rapidly determine which clients gave permission for automated processing and which were improperly exposed, substantially reducing regulatory reporting uncertainty.
Automated Wealth Profiling (ADMT & AI Laws): Provide clear opt-out mechanisms for state laws governing Automated Decision-Making Technology (ADMT) and emerging AI statutes when algorithms generate automated portfolio rebalancing or risk profiling.
Vendor Model Training Opt-Outs: Automatically enforce contractual clauses prohibiting third-party software vendors from ingesting client NPI into their public LLM training datasets without explicit customer consent.
Reg S-P Third-Party Sharing: Harmonize annual SEC Reg S-P notices to allow clients to opt out of data sharing with fintech partners utilizing predictive analytics.

Pillar 4: Deploy the Complete 10-Question Integrated PIA / AIA Intake

Traditional compliance programs overwhelm vendors and internal software teams with generic, 40-page security questionnaires that stall software procurement and systems development. In a lean B-D, the tool is the operational delivery engine, while the 10-question intake is the distilled risk logic.

Rather than circulating static spreadsheets, modern Privacy Management Platforms (PMPs) host this 10-question assessment directly within the systems development lifecycle (SDLC) and procurement process. The tool uses conditional logic to automatically trigger the assessment whenever new software, internal system builds, or AI services are requested, scores risk in real time, and automatically populates the firm’s Unified Catalog, replacing bloated legacy paperwork with automated enforcement:

The 10-Question Integrated Privacy & AI Assessment (PIA/AIA)

Data Classification: Does this system ingest, process, or store client Non-Public Personal Information (NPI) or confidential firm data?
Data Minimization: Is the dataset restricted strictly to the minimum fields necessary to achieve the business purpose?
Model Type & Global AI Risk Tier: Does the tool utilize generative AI, Large Language Models (LLMs), or predictive machine learning algorithms, and how is it categorized under frameworks like the EU AI Act or state AI laws?
Vendor Model Isolation: Does the vendor contractually guarantee that firm data will never be used to train their public or multi-tenant models?
Data Location & Boundary: Where is the data processed and hosted (e.g., dedicated private cloud vs. public multi-tenant infrastructure)?
Algorithmic Suitability & Bias: Has the algorithm been tested for output drift, hallucination, or discriminatory bias in financial recommendations?
Human-in-the-Loop Oversight & Auditing: Is a qualified human advisor required to review AI-generated outputs before client delivery, and is there a scheduled protocol for periodic human quality audits?
Transient Data Deletion: Are temporary prompt inputs, caches, and intermediate processing files automatically purged immediately after session completion?
Access Controls & Authentication: Are role-based access controls (RBAC) and multi-factor authentication enforced to limit data exposure?
Audit Logging, Explainability & Human Verification: Does the tool maintain immutable logs of inputs, decision logic, and outputs to enable regular human compliance audits and regulatory examination?

Pillar 5: Streamline Incident Response & DSR Management

A Privacy and AI Governance program does not operate in a vacuum; it must seamlessly interface with the firm’s existing InfoSec Incident Management ecosystem. By connecting directly into InfoSec triage workflows and leveraging the Unified Inventory (Pillar 2) and Centralized Consent tracking (Pillar 3), B-Ds dramatically accelerate incident identification, blast radius determination, and inquiry handling:

Interface with InfoSec Incident Management: Privacy and AI governance acts as the regulatory and data-risk overlay to InfoSec’s technical response team. When InfoSec detects a security event, data spill, or unvetted tool activity, the Privacy/AI Governance Lead is instantly alerted to evaluate privacy exposure, legal notifications, and model integrity.
Leveraging Inventory & Consent for Rapid Blast Radius Analysis: When an incident occurs or a regulatory inquiry is received, the team queries the Unified Catalog (Pillar 2) and Consent Engine (Pillar 3) to immediately map which specific NPI data elements were exposed, which internal or vendor AI models ingested the data, and the precise consent status of affected clients. This transforms weeks of manual forensic data tracing into minutes of automated query resolution.
Accelerated AI Incident Triage (24 to 72-Hour SLA): While SEC Reg S-P mandates notifying affected clients within 30 days of discovering a breach, high-velocity AI leaks (e.g., an advisor pasting client portfolio NPI into an unvetted public LLM) require an internal 24 to 72-hour triage SLA between InfoSec and Privacy/AI Governance. Prompt inputs can be cached or ingested into model weights rapidly; immediate containment is essential to halt data exposure long before the 30-day external notification clock expires.
DSR Deletion vs. FINRA Recordkeeping: When a client submits a Data Subject Request (DSR) under state privacy laws requesting deletion of their personal data, B-Ds cannot simply wipe the server. SEC Rule 17a-4 and FINRA Rule 4511 legally mandate the retention of trade records, suitability communications, and account histories for 3 to 6+ years. By leveraging inventory mapping, your DSR workflow automatically grants access rights and purges non-essential marketing/AI data while applying legal overrides that retain statutory recordkeeping data.

4. How Do You Get Sales Desks and Advisors to Actually Follow Your Program?

Compliance programs fail if advisors view them as bureaucratic roadblocks. Win buy-in using these pragmatic tactics:

Highlight Dual Liability (Firm + Advisor): Remind advisors that under SEC Regulation Best Interest (Reg BI) and FINRA Rule 3110 (Supervision), using an unvetted AI tool that hallucinates allocation advice creates immediate regulatory liability for both the individual advisor and the broker-dealer firm. Protecting the firm protects the advisor’s practice.
Position Governance as an Enabler: Frame secure, pre-approved AI tools as a competitive advantage that lets advisors market cutting-edge, compliant tech safely.
Micro-Training + Responsive SLA Support: Replace dry 60-minute slide decks with 5-minute video clips showing safe tool usage. Pair this with a dynamic, living FAQ repository and a direct “Ask Governance” channel backed by an aggressive 24 to 48-hour turnaround SLA for reviewing new advisor tool requests, ensuring compliance never becomes a black hole that drives advisors toward Shadow AI.

5. How Do Modern Platforms Scale Governance Without Inflating Headcount?

Broker-dealers cannot afford bank-style compliance budgets, but they cannot ignore modernized SEC Reg S-P mandates or accelerating AI oversight. Operational convergence is the path forward.

Because privacy and AI governance share identical foundations, including data mapping, vendor reviews, risk assessments, and incident response, blending them turns two competing obligations into a single, cohesive workflow.

To scale this lean model, modern Privacy Management Platforms (PMPs) act as essential force multipliers. Rather than managing complex obligations on spreadsheets, purpose-built platforms enable small teams to:

Automate the joint 10-question PIA/AIA intake during systems development and vendor procurement.
Maintain a live, unified repository of NPI data stores and AI model assets.
Accelerate DSR workflows while automatically applying FINRA retention exemptions.

Conclusion: Native Convergence as a Competitive Advantage

Broker-dealers operate in an environment where speed, efficiency, and relationship-building drive survival. Attempting to build two separate, siloed governance programs for data privacy and artificial intelligence is not only financially impractical for a B-D, it creates operational friction that frustrates advisors and slows business growth.

The real power lies in native convergence. By viewing AI risk through the broader lens of Data, Technology, and Leadership, and empowering a single Privacy & AI Lead backed by modern Privacy Management Platform tooling, broker-dealers transform regulatory obligations into a lean, automated control engine.

Instead of acting as a bottleneck, a converged governance framework protects client NPI, ensures compliance with SEC Reg S-P and FINRA rules, and safely unlocks cutting-edge AI capabilities, turning risk management into a distinct market advantage.

CDO, CPO, IAPP, Information Management and Governance, Information protection, Privacy

Looking Ahead: The New Operating Model for Business

May 2, 2020May 2, 2020 James Howard

COVID-19 has had a horribly disruptive effect on almost all people and aspects of society. This paper starts a dialog around an admittedly tiny aspect of that and a view to the future. It in no way should be seen to marginalize or trivialize the pain and suffering endured by the millions of people directly impacted by the pandemic.

On May 1^st, CNBC published this article that discusses how some businesses are re-evaluating their need for physical office space in light of their experience with a majority of their workforce working remotely.

The rapid shift to work-from-home has served as a catalyst for change. Many years ago, when video conferencing first became available, companies started to invest in equipment that was office-bound, hoping to reduce business travel. That never happened because the technology was temperamental, brands didn’t interoperate very well, there were never enough facilities, and the equipment required expensive point-to-point T1 lines.

Since then, there were advances in the technology along many orientations, including high speed internet to homes, corporate adoption of laptops, smartphones, and importantly, audio conferencing. This enabled a shift toward work-from-home, and corporate shared office space – “hoteling” (universally adopted by consulting firms and hated by employees), smaller offices/cubicles sold euphemistically as “open concept” workspaces. But many were still reluctant to use video (Dilbert summed it up well with a series of comics depicting people “working from home” taking video calls wearing their bathrobes). Workers were far more comfortable with audio conferencing than video, but it still did a lot to get companies and workers more used to remote working.

The needle moved further toward remote workforce with the dramatic increase in off-shoring, leverage of contractors which in itself lessened the feeling of permanence of employment, and perhaps contributed to workers feeling more comfortable as individual contributors working from anywhere. Paradoxically, there was a simultaneous shift toward urban living, as the number of young people wanting to drive or commute went down, which one might have thought would shift them back to offices.

Powerful Disruptor

All these shifts were gradual, and the net result was tidal shifts in the work model. Leave it to nature to provide a dramatic disruption, which has resulted in remote working suddenly accounting for 95+% of non-essential workers. The points raised in the CNBC article are not at all surprising, given how the experts are bracing for periodic reemergence of Corona, but are also supported by:

The high cost of commercial real estate and the need to manage costs
The remarkable advances in technology enabling remote working
The quality of life impact of time-wasting commutes

A shift to predominantly remote working has immediate benefits, including the opportunity to hire the most qualified workers without regard to their physical location, which helps address challenges businesses have faced hiring the right talent. It also has consequences, such as the inevitable glut of empty office space. The sudden reduction in the concentration of office workers has a significant impact to businesses relying on them – restaurants, shops, laundry, shoe-shine, even metropolitan transportation – as large portions of their customers stop coming.

Opportunities

In the past, there have been dramatic disruption to business leading to the shrinkage or elimination of entire industries. Yet over time, business comes charging back. Before Corona, unemployment was at record lows, and companies were clamoring for skilled workers. This is after gloomy predictions of unemployment after waves of off-shoring everything from manufacturing to call centers to highly skilled workers.

What has to happen for remote working to become as effective as working from a managed location?

Physical space: Many people don’t have home offices and take over the dining room table instead. This isn’t sustainable, since asking people to shift from a company managed location to home involves a level of disruption and the only financial beneficiary is the employer. Wouldn’t it make more sense for the employer to provide each employee a remodeling budget (funded by savings resulting from reduced commercial real estate costs)? Small contractors could build-out home offices based on guidelines or specifications defined by the employer.

Technology infrastructure: When someone works in an office, the employer provides a laptop and a portfolio of business applications, but also the infrastructure to provide access to those applications – physical connectivity, wi-fi, deskside support. They establish standards that they are able to support in a cost-effective fashion. This needs to be replicated in some fashion at home, at least for a portion of the workforce. It’s not realistic to expect the worker to solve all their home technology issues and not impact their efficiency. Solution? A ramp-up of home technology service-providers (e.g., Geek Squad) who set up and support home offices.

Improved wireless: There is a race underway to roll out 5G infrastructure and public wi-fi 6 that promise high-speed performance that rivals (or beats) home-based/cable internet access. This may be a boon for remote workers and their employers because it simplifies the support model by eliminating the so-called “last mile” connectivity to the individual house in favor of a more controlled infrastructure using transmitters on towers in public spaces.

Comforts and conveniences: As people get used to working remotely, their appetite for convenience goods and services will likely return. This means the retail services that had been located near office buildings will cater to home-based workers. To be sure, it won’t look the same, given that the density of customers is different. There will be more home delivery or curbside service. Will it be the same in terms of volume? Probably in an overall sense, but the concentration will differ. But it seems reasonable that the businesses that can cater to distributed remote workers will benefit.

Challenges – Privacy and Data Protection – a tiny slice

There is no doubt that as with any fundamental disrupter, there will be challenges to be met before we move to equilibrium – the so called “new normal”. Among many others, information protection and privacy faces challenges. Some years ago, a colleague authored a prescient paper entitled “Privacy in a Pandemic” that explored the reasonable tradeoffs to be made when balancing individual rights against the needs of society, famously captured by Spock as he sacrificed himself believing “the needs of the many outweigh the needs of the few… or the one”. But the new equilibrium has implications for privacy and data protection in a more corporate setting. While privacy regulation accommodate these priorities, privacy and data protection programs will have to re-calibrate their risk assessments and place new weight on risks made more prominent by the shift away from office-based workers, to one where the line between personal life and professional activity is blurred to the point where you can hardly tell the difference. Clear desk policies went from being a constant real and philosophical debate to now being completely unenforceable, and therefore mostly moot. Implementing sound technical controls that don’t disproportionately interfere with the ability to work will take time, and likely require new technology deployments.

Understanding purpose: A key enabler to pivoting data privacy will be a mature data governance program. Making assumptions around higher level enterprise controls is no longer safe. Instead, knowing the nature and location of data is far more important in order to protect while enabling use. Providing more discrete permissions around the use of data will help lessen the risk of loss and unauthorized disclosure. Understanding the purpose behind proposed use of data will enable assigning more discrete permissions. Since preserving privacy is a lot more than just ensuring protection, the philosophy of understanding purpose also helps ensure appropriate use of data.

Fundamentals: Implementing new controls will take time and carries the risk of creating more frustration and confusion that benefit until the edges are smoothed out. Privacy leaders should step back and consider the full breadth of their programs, leveraging all techniques to manage risk while avoiding unnecessary disruption. An effective awareness program, for example, can go a long way to encouraging people to make safe decisions when handling data.

Summary

COVID-19 has created havoc in unprecedented ways, and has affected the lives of billions of people. The human toll cannot be measured, and the suffering by so many should not be swept aside. Experts are working through the optimal medical strategies while economists are still trying to model the short, medium and long term impacts to business. Entire books will be written and college classes will be structured around the Coronavirus pandemic. This paper has taken a very narrow slice of that and will hopefully start an open-minded dialog around how to help enable the future operating model for business. The dialog can and will continue in months and years to come.

CCPA, CPO, GDPR, IAPP, Information Management and Governance, Information protection, Privacy, Risk management

Why do we have such a hard time understanding, assessing and managing risk?

March 24, 2020September 9, 2020 James Howard

Introduction

Risk is a real concept that manifests across life. Within a business context, risk management is a valuable tool to help improve the probability of success. This paper explores the role of a risk manager, and is applicable across the board – whether business processes, technology, security, privacy, information or enterprise. The reader can easily extrapolate the ideas to any aspect of life.

Definition and Reporting

Definition of risk: The probability or threat of quantifiable damage, injury, liability, loss, or any other negative occurrence that is caused by external or internal vulnerabilities, and that may be avoided through preemptive action.

The key word is “probability” – the likelihood that the event will occur. In some instances, that can be calculated empirically, if all inputs and effects are known, where triggers can be identified – even if random (roll of the dice). Other times, probability can be estimated based on historical data around similar conditions (50% chance of rain).

Other times, especially in business settings, there are more variables than can be practically tracked and quantified. In those settings, Risk Managers use judgment to assess the risk of an event occurring. The risks are usually classified in a 3 or 5 point scale – say, red, yellow, green or severe, major, moderate, minor and insignificant. And the more knowledgeable the Risk Manager, the more insightful their assessment of risk, but it still remains a probability.

Challenges

Communicating risk gets complicated when we start factoring in risk mitigating strategies – avoid, reduce, transfer, accept—and reduction techniques – controls, TOD/TOE, residual risk, control risk, etc.

Even within the mitigating strategies there are grey areas – avoiding has consequences (lost opportunities), acceptance doesn’t mean the adverse event will occur, reduction doesn’t mean eliminate.

While some leaders claim they are comfortable navigating uncertainty, there is no question that business hates risk: markets react to uncertainty, and “punish” companies that operate with too many unknowns, and reward those that demonstrate clarity.

People publish dashboards and discuss numbers of controls, as though they were currency – more controls must be better – even though one good (strong) control could replace many poor (weak) controls. Even auditors are reluctant to rely on process controls and would rather verify every transaction instead (assuming they could).

So what’s the issue?

To some extent, we, as Risk Managers, are the issue. When asked about risk, we articulate it in our own language:

Risk Manager to Client (or internal business stakeholder): “there is a risk that such-and-such could happen that has these consequences”

Client: “how likely?”

RM: “moderate”

Client: (thinks: “huh?”) “what can we do about it”

RM: “implement x-y-z control”

Client: “will that make it go away”

RM: “implementing this control will reduce the risk, but it leaves a residual risk”

Client: (thinks: “huh?”) “Is that a ‘yes’? Why wouldn’t you just do it? And what’s that mean?”

RM: “here – sign this ‘residual risk acceptance document’”

Client: “ok – done”. (thinks: “thank god that’s over!”) Back to business as usual.

Let’s face, this exchange isn’t very helpful. The Client clearly doesn’t understand the risk as a potential impact to his/her business, and the “residual risk acceptance document” is a rubber-stamp.

Who owns the risk? Risk Managers say that their business process stakeholders own the risk, and the Risk Manager’s role is to explain the risk, options for control, and residual risk. However, it’s fair to say that the business process stakeholders often doesn’t truly accept their role, or if they did, they would engage in a more meaningful dialog. And the residual risk acceptance document effectively nullifies the dialog.

If the controls are effective, or for whatever reason, the risk fails to manifest, then what? How often does the client step back and acknowledge that RM did their job and issues were avoided? Or does the client question why the risk management exercise was undertaken? On the other hand, if an adverse event takes place, despite controls, does the client look at RM as though they failed? The cynical reader would point out that if the on-going processes of managing risk management were part of core operations, then you wouldn’t see a spike in RM funding after an event takes place; you might see some refinement or realignment, but not a huge uptick in funding…

An alternative approach

So the challenge is how to meaningfully communicate risk to leadership in a way that puts risk in a business context.

First, one must keep clear: generally speaking, risk can’t be eliminated if the business wants to undertake the activity that introduces the risk. That said, the Risk Manager can keep the following in mind as these points might promote meaningful communication:

Articulate the risk in familiar business terms (“speak English!”). Explain what would have to happen to trigger the risk. If you describe a chicken-little event without explaining the triggers, you might get dismissed.
Be realistic when describing the risk and the likelihood. The likelihood should include realistic related events.
Propose options for mitigating the risk, including avoid-reduce-transfer-accept. Bring a reasonable amount of research to present viable options, and be able to articulate the residual risk.
Understand appetite for risk at an appropriate level. A mid-level manager may have a different appetite for risk than the CEO.
Consider what kinds of risks needs to be escalated and to what level: Don’t present a risk to a CEO in a “Enterprise Risk Management” setting that should be addressed by a mid-level manager.
Be realistic in evaluating the consequences of the risk. Walk the stakeholder through understanding the various consequential outcomes to help determine an appropriate mitigating strategy.
Make clear who owns the risk. Get rid of “risk acceptance” documents – if a risk is significant enough to warrant action, it should be pursued. Risk Acceptance documents are an attempt to shift/assign responsibility, and if they are needed, then they will also be ignored in the post-mortem.
Acknowledge that business environments are dynamic, and events rarely unfold negative risks occur. People intervene. Processes engage. The outcome is rarely what was predicted when the risk was recorded. And the more catastrophic the risk, the more it morphs as it unfolds.

Many of these considerations apply in the post-mortem stage. One of the big challenges in the risk management community is one of appropriate hindsight. When evaluating changes to make in risk management in light of an event, it’s important to remember what was known and considered at the time risks were assessed.

The overarching themes in this article is that risk managers need to be realistic when articulating risks, consequences and controls. Risk managers must recognize they need to bridge the communications gap to their stakeholders by describing risks in business terms that will resonate.

Risk is a fact of life in every aspect of business. Bad stuff happens, and risk management is not risk “elimination”. Risk managers play a critical role, and by thoughtfully supporting their stakeholders, they can help business accelerate forward.

Tag: Risk management

Pragmatic Convergence: Building a Lean Privacy and AI Governance Program for Broker-Dealers