Enterprise Risk Management and Therapy

Eric Bonnell
8 min readAug 17, 2024

--

Eric Bonnell, SVP, Director of Enterprise Risk Management, First Financial Bankshares

Resistance to change: Should you be? Shouldn’t you be? Does this cause you grief? Well, I’d be skeptical about someone who would wish to change into a criminal or go about creating change in a nefarious manner. Then again, if I had a decent chance to win $1,000 legally with minimal embarrassment, I might just go for it. So maybe it’s both!

Yes! Managed Change!

This is the crux of Enterprise Risk Management (ERM). We ask the questions to make sure that what is being done or proposed to be done is rational, effective, and contributes to the organization’s well-being, and if there is uncertainty risk, confirmation that the organization agrees to accept that risk with the potential for a profitable gain.

Doesn’t that sound like therapy? If someone needs help to reconfigure their life, perspective, and happiness, they often seek therapy. Isn’t this, in essence, the same process?

Risk managers, change managers, executives, and leaders provide therapy of this type. They consider the overall picture provided in the code of ethics, organizational policy, and strategic objectives when considering whether a new change should be pursued. Sometimes, a “traumatic” event, like a regulatory or audit exam, opens the eyes of an organization and they need help to regroup and reorient. Personal and group therapy begins!

So, what aspects of therapy relate directly to ERM?

1) Dealing with the trauma and grief

Changing is grieving, to some level or another.

Dr. Elisabeth Kübler-Ross established the definitive work on grief and mourning. Her five-stage model is the framework for walking through traumatic events, especially the death of someone close or the personal loss of bodily or mental function (e.g., amputees, PTSD, etc.). The five stages of grief in her framework are: denial, anger, bargaining, depression, and acceptance. These stages of the grief process do not necessarily occur linearly; different people go through the stages at different times and durations, sometimes simultaneously. The goal of therapy is to allow the grief process to occur naturally and completely in order to reach acceptance. So, for families, this may mean that some members may need more intense therapy, some may need a few sessions, and the whole family may benefit from group sessions to heal together and help each other through.

When it comes to organizations and the need to change, the process is no different, though the trigger is different. An event, and the subsequent need to act, may be acknowledged sooner by some than others. Some may become angry or depressed about the need to change; some of these may resist the change or end up leaving the organization because of it. Some may try to bargain for less change as what is being asked of them is more than they can accept. So, the risk management function needs to listen to this all and put their attention in the places that require assistance in the way that they require it. One-on-one conversations are as important as team meetings to work this out and reach a reasonable conclusion.

2) Seeing the self (or culture) for what it truly is

It is not uncommon for root cause analysis to be shallow, especially when people are used to a certain way of acting. Culture plays an important role in this. Sometimes, the expressed intention of the culture and the actual manifestation of it do not align. This divide tends to widen over time. As we get busy meeting day-to-day objectives, we sometimes lose the large picture; one day we look up to see we are a larger organization being operated by basic processes that are in danger of becoming unsupportable as we continue to grow.

For example, we may be exceptionally customer-focused in the moment, which is commendable, but have we forgotten how to care for the customer for their long-term well-being? Do we protect them and care for them as we would a valued friend through our processes and results? Do we spend time, money, and resources on superficial initiatives or short-term bandaids, or do we rationally and intentionally work to fix the backlog of improvement opportunities to better ourselves and the overall effectiveness of our intended excellent customer service?

So, is our root cause analysis also feeding our strategic trending analysis? That is to ask: do we look to fix the problems as they come, or do we find the trends to address that cause real improvement, efficiency gains, and ultimately enable innovation?

The risk management function should stay as objective as possible and continue to ask questions while working through root cause analysis. Like Lt. Columbo, the TV detective who knew “whodunnit” right from the start, he continued to ask questions about small things that didn’t add up until the murderer revealed themselves out of desperation and having no other defense. In this way, keep peeling the onion back until others see the problem and cannot refute it. It will take some people longer than others to come on board.

Identifying these direct root causes and exposing the ongoing trending big picture allows the team to address the immediate needs while enabling transformation into a continuous improvement mindset. This is much like the behavioral therapist who helps the patient identify triggers for bad behavior and replace the response over time (see the works of Albert Ellis and his Rational Emotive Behavioral Therapy (REBT) behavioral modification model for further information on helping yourself and others to affect positive change.

3) Expressing the root cause and gathering support

You may not have everyone on board with the need to change before you are able to clearly articulate the root cause of an event. But do it anyway, be directionally correct, lead through the planning process, and be open to refinement as more people provide consensus to move ahead.

A modified way of looking at organizational change, still based on the Kübler-Ross model, is by considering the change curve, and the four ways people generally approach change due to their personality types.

Invert the grief curve and you have the Change Consensus curve. As we move right along the X-Axis, we find more people coming on board to accept the change, with their concerns addressed. This occurs until enough people accept the change (at the crest of the curve), and then the momentum brings the change to a conclusion.

The different core groups of individuals that make up this graph are:

  • Early Adopters (approximately 10%) — These individuals understand the need for change, are less risk averse, and will assist in establishing a general direction.
  • Slightly Cautious (approximately 30–60%) — These individuals will provide reasonable concerns and assist in selecting the best path forward to address those concerns. The path ahead will be generally accepted with their satisfaction and voiced approval.
  • Significantly Cautious (approximately 20%-40%) — These individuals may have valid concerns or may just need to understand the reasoning behind the change more intimately to provide buy-in. Listen to them as the change is being implemented and address any reasonable concerns in the schedule, communications, or actions taken to effect the change.
  • Naysayers (approximately less than or up to 10%) — These individuals are change averse and may or may not have valid reasons for that. Do your best to communicate that the change is proceeding no matter what while looking to convert these individuals to the Slightly Cautious team. You may not get 100% buy-in for change, ever. After you take reasonable steps to bring these naysayers along, stop. You can only do so much and you have better things to do. Those who continue holding back destructively may either have personal reasons for it or may not aligned with the culture as it has matured without them.

4) Accepting the need to change and navigating the ship to port

As you move over the crest of the Change Curve, you must continue to communicate and adjust the details of the change and its messaging until others with reservations are also satisfied. Once enough people are on board, the “naysayers” have the choice to participate or not. Outside of reasonable concerns with the change, if you have clearly articulated the change, you must move ahead with the majority, or delays and other complications will get in the way.

So, in a nutshell, proceed like this:

  • State the problem as clearly as possible and the options to resolve it. Leverage your early adopters as advocates for change and the identification of the top options.
  • Vet the options and gain consensus. Use your slightly skeptical team to vet the issues and incorporate their solutions. This will bring credibility to your change effort for others and this group will become advocates of the change.
  • Continue to refine as reasonably required to address concerns of the Significantly Cautious group. Make sure that others’ concerns are transparently communicated to the organization to show how to work with the change group to reasonably address problems and build trust and support for the change.
  • While you try to address every reasonable concern, you may need to cut the chord at some point. If the change is well in motion with overall consensus and there is still minor resistance, decide whether to address it in public, address it in private with a manager or HR, or ignore it if it becomes toxic to the change. Naysayers must decide if they are getting on board or need to leave due to irreconcilable differences.

5) Maintaining accountability and affecting real change

Like a good therapist, whether leading personal or group therapy, there needs to be accountability for the roles within the change. Build success factors and ways to demonstrate success within the process. When the meeting is over (a therapist might say, “We have to stop…but before we do…”) reinforce the next steps and expectations for the next session. Measure and communicate results and progress. Celebrate successes: both peoples’ accomplishments and reduction in risk to the organization. Through multiple wins, the Change Management process will mature. It will be better understood, accepted, and effective with cultural support through transparency and positive reinforcement (see “The Behavior of Organisms” by B.F. Skinner). Conducting formal lessons-learned sessions will also assist in finding ways to serve your organization better and establishing closure, which is a key goal of the healthy grief process.

Conclusion

For my ERM friends who, like therapists, are exposed to the underbelly of human psychology and deal with the drama and emotions of everyday operations, you need someone to talk with as well. Without taking care of yourself, you will be pulled into the toxicity.

Risk Managers, I recommend you find others in your field who “get you” and talk it out regularly. You will get some great insights from peers as to how your program can be improved and you can approach it with a clearer mind. Lastly, I’d recommend, “Toxic Emotions at Work: How Compassionate Managers Handle Pain and Conflict” by Peter J. Frost, a great read about those empathic people who keep things running and can be pulled into chaos and despair, and what they can do to protect themselves from it.

Risk Management professionals, and other change managers, executives, and leaders, act as therapists specializing in organizational change and well-being. Knowing a thing or two about psychology and how to navigate human relationships is key to success. While, like professional therapists, they have administrative work to handle and are constantly keeping their own practice in order, they aim to assist the organization and those within the organization to consider the best course of action to orient themselves to and embrace behaviors that enable soundness, profitability, and growth.

Stay well and stay focused. You are probably not told this enough, but you are truly valued by your organization, even by the skeptics. Take care of yourselves and keep going!

enterpriseriskmanagement #ERM #psychology #well-being #CRO

© 2024 — Eric Bonnell

--

--

Eric Bonnell
Eric Bonnell

Written by Eric Bonnell

Enterprise Risk Executive, Expertise in Operational Risk Management, Privacy, Crisis Management, and Program Management in Banking and Financial Services

No responses yet