Challenge :

The   Risk   Team   designed   a   process   that   assists   managers   of   every   line   of   business   to   think   about   and   input   information   about   risks   and   related   controls   into   a   standardized   system.   This   system   allows   the   managers   to   input   all   of   the   required   qualitative   and   quantitative   information   into   the   system   in   one   process.   This   interface   also   allows   the   auditors   and   senior   management   to   view   the   risks   of   the   various   business   units   and   the   company   in   a   more   effective   and   uniform   manner.   What   is   not   included   in   this   is   a   process   to   group   the   risks   and   controls   to   allow   a   better   understanding   of   the   larger   picture   and   how   that   could   affect   the   company   overall.   Some   of   these   macro-risks   could   be   a   collection   of   the   same   risk   that   was   identified   multiple   times   or   some   themes   that   are   not   easily   connected.

Selection:

I   decided   that   Mind   Mapping   would   be   a   great   tool   to   help   direct   the   team   toward   a   solution.   The   reason   that   I   thought   to   use   this   tool   now   is   there   are   multiple   experts   that   look   at   the   collective   data   and   draw   different   conclusions.   In   general,   these   conclusions   are   more   driven   by   the   biases   that   the   user   brings   to   the   table   and   less   on   the   given   data.   To   quote   Marianne   Moore   from  the   training   materials   “Mind   mapping   is   looking   for   patterns   and   insights   in   a   large   quantity   of   data   you   collected   during   your   exploration   of   what   is   the   current   reality.   The   goal   is   to   establish   criteria   for   the   what-if   idea   generation   phase.”

The   mind   mapping   process   can   be   summarized   in   the   following   steps.   First,   gather   all   of   the   facts   and   information   that   you   have   into   a   defined   location.   This   could   take   some   refinement   to   get   the   information   into   a   displayable   format.   Second,   have   your   stakeholder   review   this   physical   representation   of   the   facts   and   have   each   of   the   stakeholders   find   the   parts   that   they   think   are   important.   Third,   gather   the   stakeholders   into   small   groups   and   allow   the   stakeholders   a   few   minutes   to   define   some   categories   of   the   data.   Fourth,   have   one   of   the   stakeholders   share   one   of   the   categories   and   see   if  there   are   other   facts   that   have   been   found   that   can   be   included   in   the   category   from   other   stakeholders.   Continue   until   all   of   the   important   facts   are   in   a   category.   Finally,   find   an   insight   for   each   of   the   defined   categories.

Application:

The   steps   that   we   followed   were:

1. Assemble   the   risks   and   controls   into   a   visual   display   within   a   defined   location.   This   will   include   multiple   representations   of   the   data   including   individual   risks   and   controls   as   well   as   reports   and   metrics   from   the   collective   data.

2. Allow   some   Risk   Team   members   and   other   experts   review   the   data   and   look   for   the   “good   stuff”.   This   would   happen   at   their   own   pace   over   an   afternoon.

3. Have   each   Risk   Team   Member   categorize   the   important   risk   information,   into   categories.

4. Let   the   Risk   Team   Members   form   small   groups   (4-5   people)   and   have   one   share   a   category,   with   other   Risk   Team   members   adding   facts   to   this   category.

5. For  each   of   the   categories,   find   the   true   insight   for   the   category.

6. Allow   the   insights   to   inform   the   organization   of   the   macro   risks   that   exist   for   the   company.

Insight   &   Approach:

After   the   completion   of   this   exercise,   there   were   two   competing   directions   that   jumped   out   of   the   set-up   of   this   exercise.   The   first   was   the   process   of   figuring   out   how   to   set-up   the   gallery   of   information,   we   tried   to   resist   organizing   the   information   into   a   story   as   we   did   not   want   to   lead   the   Risk   Team   into   some   predefined   categorization.   In   the   end,   we   organized   the   information   by   department   with   some   of   the   summary   information   near   the   end   of   the   display.   What   happened   was   that   there   was   so   much   information   that   the   stakeholders   felt   overwhelmed   with   the   volume   of   data   that   they   needed   to   look   at.   Watching   the   people   flow   through   the   room   the   departments   that   had   their   information   near   the   beginning   of   the   display   ended   up   with   more   information   being   collected   by   the   stakeholders.   I   think   that   as   they   got   to   the   end   of   the   display,   some   of   the   information   that   was   not   really   seen   by   the   stakeholders   as   they   suffered   from   information   overload.

After   the   completion   of   this   exercise,   it  was   clear   that   we   needed   an   additional   step   to   take   some   time   and   apply   some   additional   summarization   of   the   data   as   the   volume   of   presented   data   was   an   unintended   barrier.   As   previously   noted,   there   is   a   risk   of   introducing   bias,   but   it  was   clear   that   having   too   much   unprocessed   information   leads   to   another   bias   which   was   ignoring   the   data   at   the   end   of   the   display.   In   addition,   because   of   the   large   volume   of   information,   we   could   have   helped   to   solve   this   problem   by   having   the   stakeholders   enter   at   different   points   so   that   the   information   could   be   semi-randomized.

