I recently started re-reading Stephen R. Covey's book "The 7 Habits of Highly Effective People."  I hadn't read the book in over 15 years and felt that it would be a good refresher at this point in my career.  Early in the book, Mr. Covey begins to dissect the "habits" paradigm moving from the ideas of dependence to independence and finally to interdependence.  Mr. Covey says this, "[I[nterdependence is a far more mature, more advanced concept.  If I am physically interdependent, I am self-reliant and capable, but I also realize that you and I working together can accomplish far more than, even at my best, I could accomplish alone" (51).

Reflecting on the concept of interdependence in business processes and internal controls, I wondered how often any of us consider our interdependent needs in the design and execution of key processes and internal controls.  Whether we are approving a purchase or reviewing financial data to make decisions, the process that got us to the decision point required many hands and brains to create.  Not many of us would argue that we aren't, at least, somewhat reliant on others in many aspects of our career; however, how many of us have designed organizational culture and processes with the concept as the central focus?

Off the top of my head, here are a few questions that came to mind in answering the question above:

If I asked you about risk, your first thought might be of insurance, security, safety, or a specialized person that deals with risk at your organization such as a risk management team.  It could even be about personal risks to you such as those faced when investing, parenting, or driving on the road.  If I asked you what might go wrong on a camping trip to Alaska, you would immediately tell me things like bears, lack of food, frostbite, injury, or getting lost.  If I asked you about the value a home alarm system, you will probably tell me that it deters break-ins, detects fires, and allows you to monitor your home.  

If I asked you about what risks you see at your job, you may not feel comfortable answering. Maybe the concept of risk at work is outside your normal job description. Regardless of your current professional stance on risk, the fact is that we are all able and capable of assessing risk in our organization, but we often don't feel like it is a vital part of our jobs.  You and I are always assessing risk and understanding our role in processes and organizations. We just don't know we are doing it all the time.  When you make a decision about signing a form, what are you doing?  When you decide to take one course of action against another, what are you doing?  When you train someone to do a job well, what are you doing?  In all of these cases, you are inherently understanding, assessing, and applying risk management principles.  

The ability for multiple individuals to provide input is one of the foundations to Gradient's approach to risk management.  Being a part of assessing risk is not simply a job left to the management team, but a process where many throughout the organization can play a role.  In fact, it is very important to receive input from a variety of perspectives throughout any organization.  Each person has different experiences, different abilities and personalities, and different ways of seeing the organization.  It is because of this that a good risk management process needs input from a variety of sources.

Gradient's risk assessment process solicits input from several levels down into the organization, summarizes that input, and allows the management team to utilize and act on that input.  At whatever level of your organization, here are a few key questions to ask regarding your organization and process risk.  I would encourage you to ask them regularly with your teams and organizational leadership.

· How often do I think about the risks to the processes, departments, and groups that I am involved in at my organization? Is that enough?

· Looking back on processes, have there been instances where a failure or process breakdown occurred? What risks weren't mitigated to allow that to happen?

· What risks do I think could occur in the processes and/or departments I am involved in? Do we have processes in place to minimize those risks? If not, what should we do?

· Do I ask questions to other leaders, my direct reports, and their direct reports about the issues, risks, or failures they see in the organization? Do I seek out input from others on their suggestions and observations?

· Does our management team understand and address larger organization-wide risks?

· Are key organization-wide risks connected to processes that help mitigate those risks?

· Does your organization, department, or team have a strategy for using data (electronic, KPIs, etc.) for monitoring and responding to key risks?

If you want to learn more about Gradient's enterprise risk management (ERM) services, please use the contact form on our site or email info@gogradient.com. You can also review the latest Committee of Sponsoring Organizations (COSO) ERM executive summary at www.coso.org. Thanks for reading!

I (Cal) recently read a book titled Humble Inquiry by Edgar Schein.  Schein defines humble inquiry as "...the fine art of drawing someone out, of asking questions to which you do not already know the answer, of building a relationship based on curiosity and interest in the other person" (2). I was struck how simple in words, yet difficult in practice this goal and statement is from Schein. In the business and consulting world, regardless of industry, I often find that the ultimate goal is to go in knowing the answers to most, if not all, of the questions that will be or could be presented. It is often the expectation of leaders to know all of the answers to all of the questions or risk the appearance of losing authority whether implied or explicit.  Schein notes that "we are biased toward telling instead of asking because we live in a pragmatic, problem-solving culture which knowing things and telling others what we know is valued" (10).  Is this really the best way for leaders to approach their job and the complexity of relationships within that job?

I believe that the answer is a firm "no."  As consultants, we are tempted to dispense advice and recommendations readily and willingly.  After all, we are typically brought into an organization to do just that.  However, one of the primary drivers of strong client relationships and support are the questions we ask and the relationships that we build.  Schein, a former consultant, even goes as far as to state the following "I learned early in my consulting that getting the questioning right was more important than giving recommendations or advice..." (4)  While he is directing his thoughts to consultants, the advice is very important to leaders in an organization, regardless of level.  In their book The Truth About Leadership, James Kouzes and Barry Posner tell us that "they [interviewees speaking of leaders they look-up too] tell us that when they are with this leader they feel empowered, listened to, understood, capable, important, like they mattered, challenged to do more, and other similar descriptors" (69).  I imagine the leaders referenced were excellent at Humble Inquiry.  To close, I would like to ask you a few questions that will hopefully be helpful in your leadership journey:

1. Do you seek to listen to understand before telling?

2. Would people around you rate you as a good listener? Would you be willing to ask them directly?

3. How well do you value the professional relationships of your colleagues rather than as a direct report, a peer, or a supervisor? Why did you answer the way you did?

4. What steps can you take now to improve your listening ability, question asking, and overall relationships with your colleagues?