How are risk leaders tackling their first year in role?

Choosing which initiatives to prioritise in the first months of your new job is crucial. There's so much to think about while you also need to make a good impression and reassure senior leadership that you were the right choice for the job. 

Of course, each new CRO/Head of Risk role is unique. You may have been brought in with a mandate from the board or executive committee: to build ERM from scratch; to get the business ready for an IPO; to improve a specific area; or head a new consolidated team. 

While our membership is diverse, a significant number of our members are new into role. It's a time when peer collaboration couldn't be more vital and makes a significant difference to those challenging first months in role.

Here's a list of key areas that the majority of risk leaders in our network have focused on when new into role, and some practical tips they've shared.

Key challenges for all risk leaders new in role:

1. Building relationships with key stakeholders

Probably one of the most time-consuming parts of your new role is getting to know key stakeholders. Building relationships takes time, and you want to showcase Risk in the best possible light.

To support risk leaders in this position, we facilitate targeted collaboration with practising CROs/heads of risk who have extensive experience and can help you understand: how have other risk leaders successfully built relationships in a new company?

Get ideas and approaches from risk leaders who have built strong relationships in a new company

Speak to a member of our team about the targeted peer collaboration we can organise for you through membership.

Book an exploratory call

There may not be any shortcuts, but learning from the successes — and mistakes — of peers could save you valuable time in those first months.

2. Setting up or improving your GRC tool

When starting a new role, most risk leaders will review their current GRC tool (if there is one) and put together a plan for optimised risk data collection, monitoring and distilling, to elevate how risk data and insights are being used by the business and leadership.

Of course, a lot depends on the budget you're able to secure for a GRC system.

If you have budget
(Skip to the next section if you won't have budget)

It will become clear relatively quickly if your organisation has budget for investing in a new GRC tool or building a tool in-house.

Whichever path you choose, the process may seem pretty daunting. And while no step is quick, we have been helping risk leaders speed up the process through collaboration in our network.

(i) Choosing and implementing a new GRC tool

Key steps:

a) Putting together a business case
We've created a peer-contributed business requirements template for Risk-related systems to help speed up this part of the process for risk leaders in our network.

b) Create and narrow down a shortlist
How do you choose a final supplier without having to sit through endless sales pitches? We've helped our members speed up this process by facilitating a series of 1-to-1 candid discussions with other risk leaders who have experience of the systems on the member's shortlist, free from vendor bias.

c) Implementing and optimising your new tool
You'll need to get the new tool working effectively in your new organisation. We've helped our members to avoid early implementation pitfalls by facilitating 1-to-1 calls with peers who have already embedded the chosen system in their organisation.

(ii) Implementing an in-house solution

Of course, you may decide that you'd be better off spending your budget on creating an in-house solution.

Risk leaders in our network are collaborating and sharing approaches to save time creating their own system, and to create the optimum system for their organisation. 

Spend your GRC budget with conviction

Explore how membership can support you in all stages of overhauling your GRC system.

Book an exploratory call

If you won't have budget

Many risk leaders begin a new role with big plans to overhaul the organisation's GRC tool, but discover that there is no appetite or budget for such plans.

In that case, you'll need to work out how to make the most of your existing resources. Whether that's optimising the company's existing GRC system, creating a make-shift tool using spreadsheets, or leveraging free/cheap software such as Power BI, you can still make a huge impact. By collaborating with peers in our network, we can fast-track your route to success.

Would you like to hear from a risk leader who has been in this position and implemented something successful?

As a member, we can facilitate this kind of collaboration for you. Take tried and tested, budget-friendly approaches back to your company.

Book an exploratory call

3. Benchmark emerging risk in your sector

You've just started in your role. You're probably snowed under dealing with stakeholder engagement, and getting to grips with a new board and senior leadership dynamic. You might have an engaged board who value risk management and are keen to hear from you — or one of your biggest challenges might be to just get your board to even just engage with principal risks. You'll also likely want to improve the horizon scanning capabilities at the business and monitor its emerging risks.

You may well be able to bring some knowledge and techniques from your last role, but when will you have the time to properly make sure that you're on top of all the risks on the horizon for your company, and that you haven't missed any blind spots?

We offers our members two low-effort ways to stay on top of emerging risks. 

Example page:

Recently we've created bespoke benchmarks on emerging risk for members in the following sectors:

• Retail and consumer goods
• Digital/SaaS sector
• Renewable energy
• Telecommunications

As a member, you simply ask for the benchmark (and request any specific insight you want to get out of it). We find the right sector peers to participate, and produce a report with the results.

Are you interested in benchmarking your operating model, risk assessment criteria, or something else?

Arrange a short call to explore how we can help you with bespoke benchmarking as part of Risk Leadership Network membership.

Book an exploratory call

Risk Leadership Network's Horizon Scanning Tool

Request a demo today.

Request a demo

We're also developing a second AI-supported emerging risk solution. This is being built with members and designed to help ERM teams detect weak signals and leading indicators around key emerging risks. The aim is to help members track emerging risks more dynamically. This could help enhance your emerging risk framework making it more actionable and forward-looking. Book an exploratory call to find out more.

4. Validate your plans before implementation

When you start at a new company, sometimes it can be hard to find people to bat ideas against. Risk is isolated in general. And as the new starter, you really want to be confident in what you're presenting, and what you're trying to get the business to engage with.

But, with Risk Leadership Network membership, we can put you in front of people who have done that already. How useful would it be to talk to someone who's 6 months — or a year —ahead of you? 

By facilitating bespoke collaborations with the right practitioners, you can validate your proposed approaches before presenting them internally.

We've also introduced a buddy/mentor system so that you can have a risk leader outside of your business validating your plans. Perhaps you'd benefit most from buddying with another risk leader who was recently new into role, or maybe you'd prefer a really experienced practitioner who has been the newcomer a number of times throughout their career.

There's no need to be alone

Get external validation of your plans from some of the most experienced risk leaders currently in practice through Risk Leadership Network membership.

Book an exploratory call

5. Ensuring a risk lens to decision-making

You won't have been at your new company for long before risk appetite — or something similar — becomes a big topic of conversation. How are you going to embed risk into business decision-making.

Operationalising risk appetite is a common area of focus for many global organisations within the network — others also consider control effectiveness, target risk states and other methods to embed risk management in the companies.

Regardless of your organisation's current maturity, we regularly facilitate collaboration and knowledge-sharing among peers to support members with their specific priorities. Here are some examples of outputs from recent collaborations:

If you're starting in an established risk function:

Skip to creating a risk function from scratch

1. Assess your organisation's current risk maturity

Many risk leaders tell us that assessing their organisation's current maturity is top priority when they begin their role.

Often, you'll think you've got a good idea about the organisation's risk maturity through the interview process. Then you start the role. And you realise you hadn't quite got the full picture.

From your own experience, you'll quickly identify some areas for improvement, but you'll also want to externally validate your assessment to ensure it's fair and that you've covered all grounds. 

Some risk leaders get external consultants in to perform a maturity assessment but we've developed a maturity model and cohort benchmark that members are using as an alternative. Download a sample here.

Find out more about our membership model and cohort benchmark

Talk to a member of our team

Book an exploratory call

2. Revise your organisation's risk taxonomy

You come into a new role and one of the first things you'll review is your organisation's risk taxonomy. You'll quickly make your own judgment and identify areas for improvement.

It won't be long before you begin revising the organisation's taxonomy and will be looking to present a new version to your board/ARC.

But how do you ensure that your original assessment of the organisation's taxonomy was objective? Have you selected the right categories and risks for the new taxonomy? And will your revised taxonomy definitely be an improvement on the last?

You know that if you don't get it right, it's hard to get other elements of your risk management framework to stick. So what do you do?

For Risk Leadership Network members in this position, we've facilitated a peer review of the revised taxonomy. The member presents their revised taxonomy to sector peers, and participants will provide feedback and suggestions, based on what's working in their organisations.

Talk to us about how our network can help you review your taxonomy

A peer review is a quick way to move forward with confidence.

Book an exploratory call

3. Leading a risk transformation/evolution programme

How can tailored peer-collaboration support your risk transformation programme?

Speak to our engagement team to find out more.

Book an exploratory call

Speak to a member of our team

Discover who else in our network you could meet who has risk-adjacent responsibilities.

Book an exploratory call

If you're creating a risk function from scratch

1. Benchmark risk operating models in your sector

You want to establish your new risk function with the right structure and the right resources in place. But how do you know what operating model is the norm in your sector, especially if your new role is in a new sector?

Our members regularly ask us to create a benchmark of operating models among sector peers. Recently we've produced benchmarks for the following sectors:

• Pharmaceuticals
• Financial services
• Manufacturers
• Digital
• Energy and utilities sectors
• Retail
• Logistics

And we've also produced a market benchmark, with operating model data from over 50 multinational organisations globally.

2. Building ERM that actually works for your business

If you're setting up your risk function from scratch, some risk leaders like to lift as many templates as they can to get the job done.

But if you really want it to work for your business — i.e. you really want the business to see value from risk — then your approach will be nuanced. Lifting templates won't cut it.

You'll want to speak with other risk leaders who have implemented the various elements of your new framework, to get new ideas and validate your approach before you begin to implement it. And there's no better way than joining Risk Leadership Network.

We know you've got your work cut out in the months ahead. We also know that, from member feedback, this a time when Risk Leadership Network membership can be of incredible value to you.