Introduction

Key takeaways from the CERRIX webinar Your risk data knows how your organisation handles risk. Do you? with Jeroen Tacke (Senior Risk Consultant, ARCOTA Consulting) and Ruben Andeweg (Senior Risk Management Consultant, CERRIX).

Most organisations measure their risks. Few measure their own ability to handle them, yet the signals are already in the GRC tool.

Every improvement action, every due date and every rejected assessment leaves a trace. Red remarks, green remarks, comments, workflow steps. Most teams use that data to report on their risks. Far fewer use it to understand how their organisation actually behaves around risk.

That was the starting point of the session. Jeroen has worked in risk management and compliance in the financial sector for 30 years. Ruben knows the CERRIX platform from the inside, first as product owner and now as consultant. Their shared view: a platform can show the data, but that is where the real story begins.

This blog covers the three behavioural signals discussed in the webinar, how to read them, and why the conversation matters more than the number.

Reactive or proactive: where does your organisation stand?

The session opened with a simple distinction. Reactive risk management is about limiting the damage once something has happened. Proactive risk management is about anticipating, and making the effort to stop things from happening in the first place.

It is not black and white. Some reactive work will always be part of the job. Proactive is the next step up in maturity.

Why do people stay reactive? Often it is not a lack of willingness. They lack insight, or they lack a trigger. And many organisations have never defined what proactive means for them. Without a shared view and a shared ambition, discussions go round in circles.

There is an external push too. Jeroen pointed to the ECB's guide on governance and risk culture, which makes clear that supervisors expect banks to keep strengthening the way they manage risk.

A live poll asked attendees to rate their organisation on a scale from one (reactive) to five (proactive). The answers were spread widely. Most people placed themselves in the middle, and nobody chose five. As Jeroen noted, the answer also depends on who you ask: the first, second and third line often see the same organisation differently.

"Being very reactive means you are probably a bit late, with the risk of higher-impact incidents or more findings from internal audit, external audit or even the regulator. Being proactive means a transparent organisation, where a manager who raises a finding on their own is not cut off for it, because they show they want to improve." Ruben Andeweg, Senior Risk Management Consultant, CERRIX

Three signals already in your GRC data

Many organisations already report on whether due dates are met. But the metadata in a GRC platform says much more than that. Three signals came up in the session: proactivity, adequacy and timeliness. Each one can be read from data you already hold.

Proactivity: who raises the issue?

Every measure of improvement (MOI) in CERRIX registers a requester, linked to a role group. That shows directly where issues come from: the business itself, second-line risk management, or internal audit.

"If you want the first line to really own risk, you would also expect them to signal where their risks are not properly managed, and to take action to bring that back to where it should be." Jeroen Tacke, Senior Risk Consultant, ARCOTA Consulting

There is no single right percentage, though. Senior management may choose a strong, well-staffed audit function and accept that the first line self-identifies a little less. The point is to ask the question. Why do you wait for audit? Why not raise it yourself? And if there is an objection, perhaps a fear of closer scrutiny, that objection is exactly what the conversation should be about.

Adequacy: is it right the first time?

First-time right looks at which improvement actions are completed without being rejected. In the demo, Ruben compared departments. In one, half of the actions were rejected the first time. In operational processes, the first-time-right rate was far higher.

"It's not about beating finance. It's about seeing how another part of the organisation gets to a much higher number, what they could share, and what the reasons behind the difference are." Jeroen Tacke, Senior Risk Consultant, ARCOTA Consulting

Timeliness: are due dates met?

Per quarter, you can see how many improvement actions were completed on or before their due date. Most organisations already track this. The more telling part is the pattern behind the number.

Are actions finished steadily along the way, or do they pile up in the last week before the quarterly report? Are due dates met as originally set, or pushed back again and again? The first pattern points to people who manage risk as part of their daily work. The second points to risk work that is driven by the report. That is the reactive behaviour Jeroen described earlier: waiting until something shows up in a report before acting on it.

Neither pattern is a verdict on its own. But a department that always closes on the deadline, or keeps moving it, is a good place to ask why.

One more signal: when tester and reviewer disagree

In effectiveness testing, a tester in the business and a reviewer in the second line do not always reach the same conclusion on a control. Frequent disagreement in one department is worth a conversation. So is a department where they always agree.

"If you base these discussions on intuition, they quickly become a yes-no discussion. If you can show that you have looked at a full year, compared it with neighbouring departments and see a much lower percentage, it is still not an easy conversation. But at least you start from a more objective view." Jeroen Tacke, Senior Risk Consultant, ARCOTA Consulting

The examples in the webinar focused on improvement actions, but the same view works for control testing, incident management or any workflow with a due date. The data can come from standard widgets, exports from the registers, or an API into your own reporting tool.

A conversation starter, not a scorecard

If there was one message Jeroen repeated, it was this: do not start by setting targets.

"This data gives you a basis to talk to people in your organisation. In my personal opinion, it's very important not to start setting targets, but to use the information to have the conversation. What is happening here? How can we make things better? Do we all look at it the same way?" Jeroen Tacke, Senior Risk Consultant, ARCOTA Consulting

Or as Ruben put it: there is no right or wrong. There is just information.

Jeroen shared an example of how this can go wrong. In one organisation, managers were open and self-identified their issues. Senior management then came down on them for having so many. That is exactly the wrong signal. A fixed target, say 75% self-identified, does not work either. The aim is to learn from each other, not to put some people on a blacklist and others on a happy list.

One data set, everyone at the table

Another poll asked where attendees bring this data into the conversation today: with senior management, with the business, or both. "Both" was by far the most common answer.

That matters. Jeroen described a case where reports went only to senior management. They went one layer down and started asking pointed questions, and the layer below had no idea what they were talking about. Different layers can get different perspectives. But everyone should know it comes from the same data, so nobody is surprised.

"Everyone can have their own view on things, as long as you look at the same data. If everybody looks at it in a different way, the conversations get much harder." Ruben Andeweg, Senior Risk Management Consultant, CERRIX

Where to start

The second poll asked whether attendees were happy with their current level. A large majority said they still had work to do, some of them significant work.

Jeroen's advice depends on the size of that gap. Being proactive has a price tag, and an ambition set too high can mean you never even reach the middle step. So if the gap is large, start at the top. Make sure senior management sees it the same way you do before you take it into the business. Ruben summed it up in Dutch: neuzen dezelfde kant op, everyone facing the same direction. Then go to the business: this is where we want to go, and this is what it means for your responsibilities.

If you are somewhere in the middle, you can start smaller. Use the data to find the departments where there is most to gain, and begin there.

From there, the approach is a simple loop:

"The goal is not the platform. The goal is not the data. It should give you more information for better decision-making." Ruben Andeweg, Senior Risk Management Consultant, CERRIX

That is where the shift from compliance-driven to intrinsically motivated risk management begins. Not with a new rule or a new target, but with people who see the data, understand it, and want to do things differently.

"It's really about influencing behaviour. Having people look at things in a different way, and want to do things in a different way." Jeroen Tacke, Senior Risk Consultant, ARCOTA Consulting

Watch the full webinar

Want to see the examples for yourself? Watch the full webinar on demand, or get in touch with our team to explore what your own risk data says.

Frequently asked questions

What are behavioural signals in risk management? Patterns in how people handle risk, read from the metadata in your GRC platform. Three useful ones are timeliness (are due dates met), proactivity (who surfaces issues, the owner or the auditor) and adequacy (are issues resolved right the first time).

Do we need new data to understand our risk culture? No. Requesters, due dates, rejections and review outcomes are already recorded in most GRC platforms. The question is whether you are reading them.

Should we set targets on these indicators? Not at the start. Use the data to open the conversation first. Fixed targets, such as a required percentage of self-identified issues, can send the wrong signal and discourage transparency.

Who should see this data? Both senior management and the business. Each layer may need a different view, but everyone should be working from the same data set so there are no surprises.

Where do we start? If the gap between where you are and where you want to be is large, align with senior management first. If it is smaller, start with the departments where the data shows the most to gain.

‍