Five accountability issues a scorecard won't solve

Scorecards, metrics and incentives are sometimes seen as the holy grail of embedding accountability into a business. But do these initiatives really influence the right risk culture?

Accountability is increasingly positioned as a core strategic value for many organisations. And yet, creating a culture that nurtures and drives accountable behaviours is no easy feat.

Building risk accountability in 10 steps

Download this peer-contributed process.

Download

Following a recent collaboration between practitioners in our network, who gathered to share their experience of building accountability, we have aggregated five key issues that risk leaders need more than a scorecard to solve.

1. Defining "good" risk management

2. Articulating specific accountabilities

Most members feel that accountability should be embedded from the top down. This means setting accountability at the executive level first and cascading it down the business.

However, using scorecards for this purpose can encourage a "tick-box" mentality, rather than a culture of true ownership. An alternative approach, then, is to have executives write their own "accountability letters", outlining their specific areas of risk accountability.

The template for this letter, at one company, was provided by the second line — in the graphic below we provide a high-level outline of how it may be structured.

Even undergoing this process has encouraged a greater culture of accountability, as leaders must ultimately sign off on their letters.

Also, only a single "accountable executive" is allowed for any area or obligation. This means that leaders are forced to engage with each other to manage interconnected risks and obligations.

3. Anticipating leadership delegation

Another problem posed by scorecards is that they are often managed by anyone but the leader responsible for them. One practitioner, who previously implemented risk scorecards for their entire executive team, explained a similar scenario.

In theory, each executive was responsible for demonstrating that they had met all of their risk requirements, while the head of risk was responsible for signing off on the risk component of each scorecard.

In practice, however, the monitoring of myriad risk metrics was done by risk business partners in line one, while the scorecard review and sign-off was delegated to senior risk managers in line two. At the end of the annual process, executives had still not engaged meaningfully with risk.

This underlines a key point: scorecards must be supplemented by a range of additional steps and strategies to secure executive engagement with risk.

4. Monitoring behaviours, not actions

Selecting the right metrics for risk scorecards is also crucial to driving accountability and good risk culture. This doesn't necessarily mean choosing criteria that's easy to quantify though.

While training, filling in risk registers and performing risk assessments are all important, they can also inspire a "list management" mindset, an assumption that risk management is "done" as soon as these tasks are fulfilled. As a consequence, risk scorecards may end up having very little impact.

This begs a question: are there more culture-focused metrics you could consider in addition to completion rates?

One member described a "quadrant approach" to this challenge:

While three of the quadrants are made up of quantitative metrics, the fourth includes qualitative indicators, ensuring that there is some balance of the two within their risk scorecard.

5. Encouraging innovation

Linking scorecards and risk performance to remuneration can have a negative impact on risk innovation, as one risk leader in our network discovered.

They explained that scorecards began to discourage growth-focused risk-taking behaviour, as owners didn't want to put their bonuses at risk. The easy option was to "not do anything" in terms of new products, features or ideas.

Looking back on their approach, this practitioner concluded that "good" risk-taking behaviours could have been better integrated into scorecards from the beginning. This would emphasise the importance of a balanced risk management approach and ensure scorecards incentivised appropriately.

What's next?

While many risk practitioners hope to embed accountability for risk across their organisation, it's clear that there are multiple ways to approach this challenge.

Priorities around risk accountability and culture are regularly raised by our members through our bespoke assistance service. We will continue to facilitate peer-to-peer collaborations on the specific challenges they face in this area.

To discuss how we could facilitate peer collaboration to support you in your next challenge, book a discovery call with our engagement team or take a look at how to join here.