It's not about finding the guilty party. You use risk to get support to achieve your objectives.
1. Mastering Risk Management episode MRM 118, the third part of a mini-series, covers the CGRF risk management software and how it supports decision-making, running about 28 minutes against a planned 15.
2. Host Anthony Wilson is joined by Leo Arruca, general manager of Australia for CGR, and Brett Palmer, founding partner of ABM Risk Partnership, both of whom Wilson says are avid CGRF users.
3. The core thesis is that most organisations still run risk in Excel, and a platform that holds objectives, risks, causes, controls and actions in one place fixes traceability, collaboration and board visibility.
4. Arruca says the common starting problem is risk managers spending "an entire week" assembling a quarterly board report from documents scattered across drives, and that the CGRF first dashboard shows aggregate risks, controls and assurance with no extra clicks.
5. He adds that the software tracks every change with an audit trail back to the original entry, restricts editing to people's own areas while letting them see other areas, and keeps a knowledge base for when staff leave after "10 years down the track."
6. Arruca says risk work also covers compliance, audits, incident management and near misses, and Wilson says that because CGRF is built on forms and databases, a new item such as a digital code of conduct form can be added quickly.
7. On board reporting, Wilson says a risk manager who brings "200 or 250 or 300 risks" will "get chucked out on your ear," so the tool should help filter to the material risks that threaten or depend on objectives.
8. Arruca describes his preferred board report, showing objective, current risk, appetite, key risk indicators and control assurance across three lines of defense, where two failed critical controls prompt a question and possibly an investment decision.
9. Palmer and Arruca stress that the risk team should be small and act as an enabler, because the more risk staff there are, "the more chance" first-line staff think risk "is not their problem anymore."
10. Arruca's roadmap includes AASPS2 compliance reporting, risk assessment scenarios, expanded risk appetite configuration and AI that drafts causes, consequences and controls from a risk title for people new to risk.
