A simple and effective control to help manage risk is to establish “check points” in the risk mitigation process. This concept ensures the risk plan stays aligned with its goals by having multiple resources review progress multiple times at specific intervals in the plan.
It all sounds sensible, except for the fact that sometimes we rely on people to perform these checks. Experience tells us that people do not always act as expected, with potentially unexpected and unhelpful consequences.
This issue is illustrated powerfully in the book ‘Lessons From a War Zone’ by Louai AL Roumani. The story captures events dealing with running and building a business in a Syrian war zone, as well as setting the context for the horrible human tragedy in the region. Truly a compelling read!
The book has many business lessons to think about. The one that I would like to share relates to check points. Louai tells of his war time experience of driving multiple times through the 100 kilometres between Damacus and Beirut, a one hour and forty-five-minute journey across an international border.
Prior to the war there was one border check. After the war started, checks increased initially to six and then to nine. All soldiers were tasked with the same job, detect smugglers and identify the enemy.
What was fascinating is that as the number of check points increased, security and effectiveness dropped!
In evaluating what happened, it was determined that soldiers at each check point assumed that the previous or next check point would catch any issue. After all there were nine checks, so someone would eventually identify anything that was awry.
What we can learn from this is that when we introduce checkpoints into our risk plans for our business, we need to think about two things. First, whenever possible, we should automate or take “the human equation” out of the check point process. Second, when automation is not practical, we need to ensure that there is a culture of detailed diligence and consequences if human controls fail.
People and cultural factors underpin all risk management. At KRM22, we specialize in providing risk systems and controls that can help institute a risk culture that respect these factors, and improve risk from that.
If you would like to know more about how we can help build a risk aware culture in your business, please get in touch.
Louai, thanks for your insights.