Introduction to Risk Management and Business Process Mapping Skills

Registration Process: 8:30 AM – 9:00 AM

Session Start Time: 9:00 AM

1. What is Risk?
• Why is this so important? What does it mean to manager, employee and auditor?
• Traditional approaches to define risk
• Why traditional approaches are not enough
• Assessing risk at an organization-wide level vs. a business unit level
• What about areas that already have compliance controls in place (i.e.; environmental, safety, legal regulations)
2. Enterprise Risk Management vs. Risk Assessment vs. Self-Assessment
• What exactly are each of these, how they work, and why all are of critical importance in risk assessment processes and risk management
• How to integrate all three arenas above so that they work together and complement each other
3. Two Fundamental Approaches: the typical ones and the one that works
• The strength and weaknesses of the traditional approach that is usually taught
• A step by step process for implementing an approach that can be customized to your organization’s particular needs, and to the needs and goals of specific business functions
• Two examples: Harley-Davidson and the Los Angeles Employee Retirement Association (LACERA) (a private and public organization)
• Who are Harley Davidson and LACERA?
• The step-by-step process for each organization that we developed and how we got there
• The struggles and challenges we went through
• Changes we made along the way
• Simple risk universe maps from other companies (i.e.; Caterpillar)
• Reviewing ERM and/or RA approaches in small groups and class discussion
• The role of organizational culture, vision and resources in determining the best approach and our approach
• What to do if you have a supportive management and culture
• Suggestions if you do not have a supportive management and culture
• All about Questionnaires
• What types of questionnaires are there and what works best in companies and different organizational cultures
• Pros and cons to using questionnaires in risk assessments
• Different types of questionnaires: self-assessment, 360, and abilities-based, and the strengths and limitations of each
• How to put together a proper questionnaire that will gather the best information: what the experts say
• How to determine where to do business process mapping to verify risk and control information given in the questionnaire.
• Why questionnaires are not enough
• Asking follow-up questions after reviewing the questionnaires
• Reviewing ERM and/or RA approaches and questionnaires from the class, ranking and weighting risks without business process mapping first:
• Small groups and facilitated discussions
4. Gaining People's Buy-In to ERM and/or doing Risk Assessments
• Step-by-step strategies of gaining "buy-in" from the necessary people at all levels of your agency
• How to address and handle people’s fear of change
• What to do and say when any level of management says things are fine as they are
• Critical Communication Skills: Tying your function’s activities, goals and objectives to those you are trying to create collaboration with
• Explaining how risk management, risk assessment, the Audit Plan and the organization’s goals and their strategies for achieving them all work together.
• Using Business Process Mapping and specific self-assessment techniques (to be taught on second day) to help people see how risk assessments add value.
• How Business Process Mapping (BPM) ties in and fills the gap between the desire to achieve goals and the actual ability to achieve goals.
• How integrating (BPM) appropriate risk management actually helps all organizational functions achieve their goals, and stay in alignment with the larger vision of the organization.
• Building a partnership both “horizontally and vertically” through risk assessments
• Making sure Audit Committees or equivalent also understand your objectives, how all parts of the process (i.e., from ERM to RA to Audit Plan) all fit together and are committed.
5. Action Plan Part One
• What can you take from all this so far?
• Developing a preliminary plan, prioritizing areas to cover, determining how detailed to get
• Questions and concerns
• Sharing Your preliminary plan in groups

1. Introduction to Business Process Mapping (BPM) and Root Analysis Tools
• What is business process mapping, and what are the tools used in process mapping (overview)
• Determining which business processes in your organization, or an organizational function, should be monitored
• How to construct process flow charts that are efficient and effective
• The psychology behind business processes: how processes and procedures get messed up in the same way in all organizations around the world
• The objectives of process flow charting
• The extremely limited place for narratives and flowcharting software in BPM
• How to start aligning the process flow charts with BOTH risks and controls in mind
• The unique and only efficient way to do BPM:
• What specific process mappings to use: a step-by-step process
• What each process mapping tool is, what it is designed to do, and when to use each
• Determining value-added vs. non-value added activities
• Root Cause tools: the companion tool to this method of process mapping
2. Doing Risk Assessments and Analyses off of Business Process Maps
• Step by step instruction and practice in doing risk assessments off of process maps
• Determining “Root Cause”: what it is and why it is critical to successful audits and risk assessments
• Learn the best tool for getting to root cause
• How root cause work impacts overall risk assessment, audit planning and the audits themselves
• Using BPM as a baseline for measuring performance, and performance improvement
• Analyzing controls off business process and/or root cause maps
• Action plans: keeping them simple while integrating them into BPM
3. Introduction to Facilitation Skills for BPM and Group Self-Assessments
• Why are facilitation skills a core competency in all types of audit, risk, IT, compliance and related professions?
• The 5 competencies required for excellent facilitation of groups
• Using facilitation skills to gain buy-in to making changes in processes and procedures
• Managing their resistance to change and to listening to you
• Your role as an effective change agent that also gains every client’s respect
• Quick decision-making tools when consensus is not forthcoming
4. The Process for Leading a Business Process Mapping Workshop
• Prework:
• Planning the meeting from beginning to end to ensure success
• Meeting with the function’s management before the BPM meeting: what to say and do
• How to address sensitive issues (i.e.; politics, resistance, conflicts) and set clear expectations before and during the meeting
• The actual workshop: How to start the workshop: agenda, ground rules, etc.
• How to turn any goal into a process, procedure or system to be mapped (and how to turn any process back into a goal!)
• Does benchmarking or further research need to be done before finishing?
• Creating action plans for gathering necessary research before meeting again.
• Determining and ranking risks while encouraging creativity and innovation
• Determining the criteria for ranking risks and controls
• Bringing the type of risk into the picture- inherent risk, present risk, and residual risk
• Making sure the criteria for ranking and BPM improvements are customer focused, consider the vendor, and enhance quality, strategic goals and stated business objectives.
• Assessing controls from the map or from deeper root analysis tools
• Turning controls into action plans
• Ending the workshop, follow-up decisions and monitoring improvements
• Bringing the results back to the higher levels of larger risk assessments and to your risk universe or ERM program
5. Practice, Practice, Practice
• Practice on facilitation skills and the tools for doing BPM, Root Cause Analysis, assessing and ranking risks and controls
• Going through a live simulation of a BPM workshop
• Debrief and experience how it all fits together as one whole system
• Discuss applications ongoing to your own unique organization and situation
6. Close: Action Plans: Part Two
• Updating your action plan(s) to take back to work and start using immediately