GRCReturnonInvestmentPresentedby:

JonathanCrispDirectorBarnOwlGRCSolutions

Theworldwelivein

WorldEconomicForum2021Report

RecentdatabreachesandleaksinSA

Whatwecandotoembedriskmanagementwithinourorganisationandmakeitasuccess?

“M&Aisamug’sgame,inwhichtypically70%–90%ofacquisitionsareabysmalfailures”[HBR,2016]

Misses–notproperenviroscan-Costoftheprojectexceeded$8bn(3xoriginalestimate),impaired$4bn

Mistakes-100%shareholdervaluedestructionof$190m

Malice–deeplyentrenchedandsystemicfraudandcorruptactors–biggestchallengeforaCRO

Misses-Impaired55%oftheacquisitionpriceofR20bn-

Mistakes–Xeroxgaveaway“Apple”toApple–missedriskinstrategy

Malice,Misses,Mistakes

Misses–Strategynotriskassessed.Blackberrypaidthepriceforonlyconsideringriskinexecution

Stuffafordsmissedtheboat?

Whathappened… Whatcouldhavebeen…

Outcome

Process

Source:*TheMoneyShow’sBruceWhitfieldinterviewedAurikBusinessAcceleratorfounderPavloPhitidis.https://ewn.co.za/2017/06/23/stuttafords-dies-on-1-august-the-159-year-old-icon-failed-to-evolve-lessons-for-small-businesses

Doorsclosedin2017forbusinessafter159years

“StuttafordsisSouthAfrica’sKodak”PavloPhitidis*

Bricks

Clicks“ClicksandBricks”

Profitabilityrestoredthroughrenewedcustomerrelevance

“Theycreatedawonderfulexperience.Butthingshavechanged”*

Adifferentlens…

TigerBrands–DFMwasaseriesofmistakes

Whathappened… Whatcouldhavebeen…

Outcome

Process

Withcontextawareness,considertheuncertaintyprospectsofalternatives

Asmaller,morereasonablypricedandprofitableslice

Bought:$190m(2012)

Sold:$1(2015)

"Didtheyreallydotheirhomeworkonthisone?”DavidShapiro,SasfinSecurities

“Weshouldhavehadacoupleofpeoplearguingthe‘no’sideoftheevaluation”WilliamSmithburg,CEOofQuakerOats

Statedtotalwrite-downwasR1.8bn

Source:https://www.biznews.com/briefs/2014/11/19/david-shapiro-analyses-market-movers-tiger-brands-redefine-arcelormittal;http://www.engineeringnews.co.za/article/tiger-brands-underestimated-the-challenge-of-operating-in-nigeria-2014-05-21/rep_id:4136;Decisive,Chip&DanHeath;Seriesofinterviewswithvariousseniorindustryplayers,pastandpresent

3ERRORS

Buying:inadequate

strategicanalysis

Operating:managementtalentissue

Selling:waitedtoolong

SouthAfricanscandalsoverthepastdecade

https://www.businessinsider.co.za/the-top-south-african-business-scandals-the-past-decade-2020-1

Planningfallacy:

Plansandforecaststhatareunrealisticallyclosetobest-casescenariosandthat

couldbeimprovedbyconsultingthestatistics

ofsimilarcases

9of10mega-projectsaredeliveredbehindschedule

9outof10mega-projectscostmorethanplanned

9of10mega-projectsdeliverlessbenefitsthanplanned

-BentFlyvberg,ProfessoratOxfordSaïdBusinessSchool

ITprojects

Classiccostoverruns

• Sydneyoperahouse1,400%

• Concordesupersonicairplane1,100%

• Tokyo2020Olympics600%

• SochiWinterOlympics500%

• Olympicaverage300%

• Boston’sBigDig275%

• EskomMedupi200%&ongoingdelays

• DenverInternationalAirport200%

• Channeltunnel180%

• Copenhagenmetro150%

• CapeTownstadium150%

Projects–planningfallacy

Reliantonheuristicsandintuition

Sociallyinfluenced

Hangry…

Greedy,fearful,corrupt

Riskaverse

Cognitivelylazy

Limitedinimagination

Probabilityinnumerate

Futureblind

Whydodecisionmakersgetitwrong

Socialforces

Authoritypressure

RolepressurePeerpressure

Groupthink

Socialforces:

Socialforcesdistortourdecisionmakingmorethanwerealise

Strategy!Gettingitwrongatforecasting

“Itwillbeyears-notinmytime-beforeawomanwillbecomePrimeMinister.”

MargaretThatcher,1974

“Whateverhappens,theU.S.Navyisnotgoingtobecaughtnapping.”

SecretaryoftheNavyFrankKnoxmadeastatementonDec.4,1941;theattackonPearlHarbouroccurredthreedayslater

“Icannotconceiveofanyvitaldisasterhappeningtothisvessel.Modern

shipbuildinghasgonebeyondthat.”CaptainoftheTitanic

“Remoteshopping,whileentirelyfeasible,willflop-becausewomenliketogetoutofthehouse,liketohandlemerchandise,liketo

beabletochangetheirminds.”TimeMagazine,1966

“iPhonehas‘nochance’ofgainingsignificantmarket

share”SteveBallmer,2007

“Whothehellwantstohearactorstalk?”H.M.Warner,Warner

Brothers,1927

Confidencedoesnotimplycompetence

“Atomicenergymightbeasgoodasour

present-dayexplosives,butitisunlikelyto

produceanythingverymuchmoredangerous.”WinstonChurchill,1939

“Ithinkthereisaworldmarketformaybefive

computers.”ThomasWatson,chairmanof

IBM,1943

Whydoorganisationsfail?

! IneffectiveBoards

! BusinessComplexity

! RiskBlindness

! IneffectiveManagementInformation

! UnhealthyCorporateCulture

! PoorCommunication

! InsufficientWorkingCapital

! InferiorDecision-MakingProcesses

Extensiveresearchhasestablishedthatthemajorityofcausalfactorsthatdrivebusinessfailuresareinternal.Reasonsinclude:

Anyoneofthesefactorswillleadtosub-optimalperformance,twoormoreofthesefactorscould,ifnotmanaged,causeyourcompanytofail

Whyriskmanagementfails

! 01.Poorgovernanceand“ToneattheTop”

! 02.Recklessrisktaking

! 03.InabilitytoimplementERM

! 04.Non-existent,Ineffective/InefficientRiskAssessment

! 05.Fallingpreytothe“herd”mentality

! 06.Misunderstandingthe“ifyoucan’tmeasureit,youcan’tmanageit”mind-set

! 07.AcceptingthelackoftransparencyinHigh-Riskareas

! 08.NotintegratingRiskManagementwithStrategy-SettingandPerformanceManagement

! 09.IgnoringtheDysfunctionalitiesand“BlindSpots”oftheOrganisationsCulture

! 10.NotinvolvingtheBoardtimeously

Thetop10biggestcompaniesinSouthAfricabymarketcapitalisation?

https://www.ig.com/za/trading-strategies/10-largest-listed-companies-in-south-africa-190725

GRCReturnonInvestment

! Integratedstrategy,performanceandsustainability(identifyandmonitorkeystrategicvaluecreationobjectivesandpotentialvalueerosionobjectives)

! Optimisethelevelofriskbeingtakentobestachievetheorganisation’sobjectiveswhilststilloperatingwithintheriskappetiteoftheorganisation

! Enhancedorganisationalresilience(avoidsurprises,calculatedrisktaking,avoidpenalties)

! Managementofreputationalrisk

! Enhancedclientsatisfactionandconfidence

! Enhancedinvestorconfidence(highermarketvalue)

! Enhancedaccesstocapitalandfinancialmarkets

! Betterorganisationalperformance

! Enhancedsocialandenvironmentalstanding

! Abilitytooperateinaglobalbusinessenvironment

Qualitativebenefits:

GRCSystem:ReturnonInvestment

! EmbedGRCthroughouttheorganisationanddriveownershipandaccountabilityforriskmanagementandperformance

! SimplifyandstandardisedGRCmethodologyacrosstheorganisation

! Processandcontrolrationalisationwithstandardisedriskandcontrollibrariesacrossbusinessunits

! Improvedqualityandconsistencyofdatacaptured

! Uptodatedashboardofyourriskuniversewithautomatedfollow-up

! Riskintelligentreporting:consolidated,drilldown,up-to-date,oneversionofthetruthreporting

! Vastlyreducedtimeandeffortspentonreporting

! Optimisedissueandfindingstrackingandresolution

! Maintainanup-to-dateregulatoryuniverse

! Increasedauditcoverage,reducedaudittimeandcost

! Compliancewithregulationsandstandards(IPPF(InternationalProfessionalPracticeFramework),ISO31000,COSO,GACP(GenerallyAcceptedCompliancePracticeFramework).

Quantitativebenefits(enabledbyasystem/software):

Whatasariskpractitionercanwedotoembedriskmanagementwithinourorganisationandmakeitasuccess?

! Beanenablerforthe“toneatthetop”tofilterdown

! Buildrelationshipsacrosstheorganisation

! Knowthebusiness–beatrustedadvisoraddingvalue

! Identifytherightrisksatalllevelsoftheorganisation

! Delivermeaningfulbusinessdecisionreporting

WhyRiskManagement!

“Riskevaluationandmanagementskillsarenowcentraltothelong-termviabilityofanyorganisation”.Moreover,riskmanagementnowconstitutesapremierdisciplinethatnoorganisationcandowithout.Youonlyhavetolookatthehigh-profileand

costlyexamplesofcompaniesthatrecentlyweredevastatedbysomeexpensiveflawintheirbusinessmodelbeingexposedtopublicscrutiny.Whattheywouldhavegivento

haveperceivedthefullextentoftheprobleminadvanceandactedonit”ClemSunter-2016IRMSARiskReport

“AmatureRMprogramisasafetynet.Itprotectsboardsandseniorleadershipfromaccusationsofnegligencebydemonstratingacleardedicationtouncoveringrisk.Italsoprovidestransparencyandassuranceofon-timeandon-budgetachievementof

corporateperformanceobjectives.”SteveMinsky–Co-authorRIMSRiskMaturityModel

“Ifriskmanagementisproperlyembeddedwithinanorganizationandastrongriskmanagementcultureadopted,wewillseemoreorganizationsbeingabletomaintainstabilityduringtimesofdifficultyandseizetheopportunitiesthatcometheirwayto

prosper”ChristopherPalm–IRMSAChiefRiskAdvisor2018IRMSARiskReport

WhyRiskManagement!

“…misconceptionthatthepowerisintheboardroom.Thepowerreallylieswiththenewmillennialsandthepowerofsocialmediaandthesmartphone.Millennialsdon’t

believeathingyousay.Youhavetodemonstratetheoutcomes.PeoplewhounderstandKingembraceit.Itisnotabouttickingtheboxestocomply”

MichaelJudin-Partner,JUDINCOMBRINCKINC

“Threesalientpointsregardingbusinessjudgment:1.Ifyouareconflictedyoudon’tdecidewhetheryouareconflicted,theotherpartydecides.2.Weliveinaknowledgeworld;youcannotactifyouarenotproperlyinformed;youneedtostresstestand

checkyourinfo.Youneedtoknowenoughandquestionwithanunderstandingmind.Howdidyoucometoyourdecision?Ifyoudon’tknowsayso.Betruetoyourself,Idon’tknow,behonest,goandlearn.3.Needtooperateinthebestinterestsofthe

organisation(alawfulorganisation).”MichaelJudin-Partner,JUDINCOMBRINCKINC

“Youcan’teasilyblameaboardmemberfornotknowingsomething.Butyoucanblameaboardmemberforcreatinga

culturewherehedoesn’tknowsomething.”GerryGrimstone–ChairmanofStandardLifeandBarclaysBankplc

“Theconsummateleadercultivatesthemorallaw,andstrictlyadherestomethodanddiscipline;thus

itisinhispowertocontrolsuccess.”SunTzu,Artofwar

“Itisnotpowerthatcorruptsbutfear.Fearoflosingpowercorruptsthosewhowielditandfearofthescourgeofpowercorruptsthose

whoaresubjecttoit…”AungSanSuuKyi–FreedomfromFear

“Thereareknownknowns.Thesearethingsweknowthatweknow.Thereareknownunknowns.Thatistosay,therearethingsthatweknowwedon’tknow.Butthereare

alsounknownunknowns.Thesearethingswedon’tknowwedon’tknow.”DonaldRumsfeld

“Honestyisthesoulofbusiness”OldDutchproverb

“Toexpecttheunexpectedshowsathoroughlymodernintellect”

OscarWilde–IrishPoetandPlaywright

Foodforthought!

“Youneverletaseriouscrisisgotowaste.AndwhatImeanbythatit’sanopportunitytodothingsyouthinkyoucouldnotdobefore”.

RahmEmanuel,theformerMayorofChicago

ROIinsummary

References

TheInstituteofRiskManagementSouthAfrica(IRMSA)–ChristopherPalm,ChiefRiskAdvisor

IntegratedBCMandriskexplained-SteveSimmonds,Director,SynergyGRC

Whyriskmanagementfails-MiraButler,ManagingDirector,MiraConsulting

WhyKingIVisnotanotherlayerofregulationbutcreatesadd-onvalue-MichaelJudin,Partner,JUDINCOMBRINCKINC

KingIV(CopyrightInstituteofDirectorsSouthAfrica)

ComplianceInstituteofSouthAfricahandbook

HelicysSolutionsLtd

https://www.barnowl.co.za/insights/demystifying-risk-management/

https://www.barnowl.co.za/the-essential-risk-management-guide/

http://www.barnowl.co.za/selling-enterprise-risk-management-erm-to-the-board-and-the-executive/

http://www.barnowl.co.za/insights/6-ways-risk-based-auditing-adds-value-to-your-organisation/

Reputationalrisk(videoclip)–WarrenBuffet,Chairman&CEO,SalomonBrothersING(1991)

ThankYou

JonathanCrisp–DirectorBarnOwlGRCSolutions

jonathan@barnowl.co.za

+27832601653(mobile)+27115409100(office)www.barnowl.co.za