Challenge :

The   Risk   Team   designed   a   process   that   assists   managers   of   every   line   of   business   to   think   about   and   input   information   about   risks   and   related   controls   into   a   standardized   system.   This   system   allows   the   managers   to   input   all   of   the   required   qualitative   and   quantitative   information   into   the   system   in   one   process.   This   interface   also   allows   the   auditors   and   senior   management   to   view   the   risks   of   the   various   business   units   and   the   company   in   a   more   effective   and   uniform   manner.   What   is   not   included   in   this   is   a   process   to   group   the   risks   and   controls   to   allow   a   better   understanding   of   the   larger   picture   and   how   that   could   affect   the   company   overall.   Some   of   these   macro-risks   could   be   a   collection   of   the   same   risk   that   was   identified   multiple   times   or   some   themes   that   are   not   easily   connected.

Selection:

I   decided   that   Mind   Mapping   would   be   a   great   tool   to   help   direct   the   team   toward   a   solution.   The   reason   that   I   thought   to   use   this   tool   now   is   there   are   multiple   experts   that   look   at   the   collective   data   and   draw   different   conclusions.   In   general,   these   conclusions   are   more   driven   by   the   biases   that   the   user   brings   to   the   table   and   less   on   the   given   data.   To   quote   Marianne   Moore   from  the   training   materials   “Mind   mapping   is   looking   for   patterns   and   insights   in   a   large   quantity   of   data   you   collected   during   your   exploration   of   what   is   the   current   reality.   The   goal   is   to   establish   criteria   for   the   what-if   idea   generation   phase.”

The   mind   mapping   process   can   be   summarized   in   the   following   steps.   First,   gather   all   of   the   facts   and   information   that   you   have   into   a   defined   location.   This   could   take   some   refinement   to   get   the   information   into   a   displayable   format.   Second,   have   your   stakeholder   review   this   physical   representation   of   the   facts   and   have   each   of   the   stakeholders   find   the   parts   that   they   think   are   important.   Third,   gather   the   stakeholders   into   small   groups   and   allow   the   stakeholders   a   few   minutes   to   define   some   categories   of   the   data.   Fourth,   have   one   of   the   stakeholders   share   one   of   the   categories   and   see   if  there   are   other   facts   that   have   been   found   that   can   be   included   in   the   category   from   other   stakeholders.   Continue   until   all   of   the   important   facts   are   in   a   category.   Finally,   find   an   insight   for   each   of   the   defined   categories.

Application:

The   steps   that   we   followed   were:

1. Assemble   the   risks   and   controls   into   a   visual   display   within   a   defined   location.   This   will   include   multiple   representations   of   the   data   including   individual   risks   and   controls   as   well   as   reports   and   metrics   from   the   collective   data.

2. Allow   some   Risk   Team   members   and   other   experts   review   the   data   and   look   for   the   “good   stuff”.   This   would   happen   at   their   own   pace   over   an   afternoon.

3. Have   each   Risk   Team   Member   categorize   the   important   risk   information,   into   categories.

4. Let   the   Risk   Team   Members   form   small   groups   (4-5   people)   and   have   one   share   a   category,   with   other   Risk   Team   members   adding   facts   to   this   category.

5. For  each   of   the   categories,   find   the   true   insight   for   the   category.

6. Allow   the   insights   to   inform   the   organization   of   the   macro   risks   that   exist   for   the   company.

Insight   &   Approach:

After   the   completion   of   this   exercise,   there   were   two   competing   directions   that   jumped   out   of   the   set-up   of   this   exercise.   The   first   was   the   process   of   figuring   out   how   to   set-up   the   gallery   of   information,   we   tried   to   resist   organizing   the   information   into   a   story   as   we   did   not   want   to   lead   the   Risk   Team   into   some   predefined   categorization.   In   the   end,   we   organized   the   information   by   department   with   some   of   the   summary   information   near   the   end   of   the   display.   What   happened   was   that   there   was   so   much   information   that   the   stakeholders   felt   overwhelmed   with   the   volume   of   data   that   they   needed   to   look   at.   Watching   the   people   flow   through   the   room   the   departments   that   had   their   information   near   the   beginning   of   the   display   ended   up   with   more   information   being   collected   by   the   stakeholders.   I   think   that   as   they   got   to   the   end   of   the   display,   some   of   the   information   that   was   not   really   seen   by   the   stakeholders   as   they   suffered   from   information   overload.

After   the   completion   of   this   exercise,   it  was   clear   that   we   needed   an   additional   step   to   take   some   time   and   apply   some   additional   summarization   of   the   data   as   the   volume   of   presented   data   was   an   unintended   barrier.   As   previously   noted,   there   is   a   risk   of   introducing   bias,   but   it  was   clear   that   having   too   much   unprocessed   information   leads   to   another   bias   which   was   ignoring   the   data   at   the   end   of   the   display.   In   addition,   because   of   the   large   volume   of   information,   we   could   have   helped   to   solve   this   problem   by   having   the   stakeholders   enter   at   different   points   so   that   the   information   could   be   semi-randomized.


Challenge : The Risk Team designed a process that assists managers of every line of business to think about and input information about risks and related controls into a standardized system . This system allows the managers to input all of the required qualitative and quantitative information into the system in one process . This interface also allows the auditors and senior management to view the risks of the various business units and the company in a more effective and uniform manner . What is not included in this is a process to group the risks and controls to allow a better understanding of the larger picture and how that could affect the company overall . Some of these macro - risks could be a collection of the same risk that was identified multiple times or some themes that are not easily connected . Selection : I decided that Mind Mapping would be a great tool to help direct the team toward a solution . The reason that I thought to use this tool now is there are multiple experts that look at the collective data and draw different conclusions . In general , these conclusions are more driven by the biases that the user brings to the table and less on the given data . To quote Marianne Moore from the training materials “ Mind mapping is looking for patterns and insights in a large quantity of data you collected during your exploration of what is the current reality . The goal is to establish criteria for the what - if idea generation phase . ” The mind mapping process can be summarized in the following steps . First , gather all of the facts and information that you have into a defined location . This could take some refinement to get the information into a displayable format . Second , have your stakeholder review this physical representation of the facts and have each of the stakeholders find the parts that they think are important . Third , gather the stakeholders into small groups and allow the stakeholders a few minutes to define some categories of the data . Fourth , have one of the stakeholders share one of the categories and see if there are other facts that have been found that can be included in the category from other stakeholders . Continue until all of the important facts are in a category . Finally , find an insight for each of the defined categories . Application : The steps that we followed were : 1 . Assemble the risks and controls into a visual display within a defined location . This will include multiple representations of the data including individual risks and controls as well as reports and metrics from the collective data . 2 . Allow some Risk Team members and other experts review the data and look for the “ good stuff ” . This would happen at their own pace over an afternoon . 3 . Have each Risk Team Member categorize the important risk information , into categories . 4 . Let the Risk Team Members form small groups ( 4 - 5 people ) and have one share a category , with other Risk Team members adding facts to this category . 5 . For each of the categories , find the true insight for the category . 6 . Allow the insights to inform the organization of the macro risks that exist for the company . Insight & Approach : After the completion of this exercise , there were two competing directions that jumped out of the set - up of this exercise . The first was the process of figuring out how to set - up the gallery of information , we tried to resist organizing the information into a story as we did not want to lead the Risk Team into some predefined categorization . In the end , we organized the information by department with some of the summary information near the end of the display . What happened was that there was so much information that the stakeholders felt overwhelmed with the volume of data that they needed to look at . Watching the people flow through the room the departments that had their information near the beginning of the display ended up with more information being collected by the stakeholders . I think that as they got to the end of the display , some of the information that was not really seen by the stakeholders as they suffered from information overload . After the completion of this exercise , it was clear that we needed an additional step to take some time and apply some additional summarization of the data as the volume of presented data was an unintended barrier . As previously noted , there is a risk of introducing bias , but it was clear that having too much unprocessed information leads to another bias which was ignoring the data at the end of the display . In addition , because of the large volume of information , we could have helped to solve this problem by having the stakeholders enter at different points so that the information could be semi - randomized .