Niall O’Toole, Director, InfraRed Capital Partners.

Andrew Putwain: How do you determine what good risk management practice looks like?

Niall O’Toole: I look at a standard risk model. First, you identify the risks, which may be internal, external, or even connected. Then, once you understand where the risks are, you can assess likelihood versus impact and plot them on a matrix. Once you know where they are on the matrix, you can create mitigation approaches – such as avoiding high likelihood and high impact.

This process isn’t something you do one time; it needs to be continually monitored. It might include things such as exception reports, highlighting areas of concern, and issuing alerts or notifications.

Then, it's about how you react to those issues. For instance, having documented guidance telling you what to do in specific circumstances is paramount. Good practice for assessing new risks not previously encountered is typically undertaken by carrying out detailed business analysis of a process or system. This is then followed by a systematic analysis of risks by categories – for example, legal, operational, and/or cyber – and then identifying what controls are in place. The different mitigation strategies are then considered in line with the risk appetite.

This gives us a reference point, which we can communicate back to stakeholders to explain why some of these notifications or alerts are in place, what we considered at the time, and why it is or was important.

Andrew: What are the most significant operational risks currently stopping teams from achieving their innovation objectives?

Niall: There are many – and the most common ones typically revolve around process robustness and data security. By that I mean not only cyber risk from external intrusion, but also internal security and permissioning concerns. Sometimes these issues conflict with one another, so it's key to delve into that world and understand what you’re working with.

"We try to provide a single source platform, where people can go to find the information that’s relevant to them."

One of the biggest issues we encounter is siloed knowledge. For example, you might not always be aware of what’s happening with your colleagues or the decisions they’re making, but it still could affect the work you’re doing. One of the things we do is try to provide a single source of truth – a single source platform – where people can go to find the information that’s relevant to them, so they can be confident that the detail is accurate and timely (within InfraRed’s ‘need to know’ boundaries).

Another big operational risk is data robustness. Without robust data, you get ‘non-believers’. They won’t use a system because they don’t have confidence that the information they’re seeing on the screen is accurate. This is where exception reports and risk analysis comes in. You need to help data creators understand the value of their data whilst making their process as efficient as possible – and convincing consumers of the tangible benefits of better processes. Ultimately, you want to convert stakeholders to the new way of thinking.

Andrew: How difficult are these processes – and how often do they work?

Niall: There are some simpler use cases – on face value, at least – where we’ve had success. For example, we've seen positive outcomes with something as straightforward as changing a project name. We’ve been able to standardise a lot of reference data in our platform and eliminate redundancy.

"Our ethos is that you create the data once and then ensure it’s available downstream."

However, I'd be lying if I said we had a 100% success rate. Many of the processes are iterative, and you need to prove to people that there is consistent value. Our ethos is that you create the data once and then ensure it’s available downstream. However, this takes a lot of time and effort; we’re still working on it.

Another difficulty crops up if you’re asking people to do more work than they originally did. In those cases, there needs to be processes to show them that when they create a data point in one area, other downstream teams will benefit too.

Andrew: Is innovation the key to achieving that single source of truth you’re describing – and why or why not?

Niall: I’m biased because I think innovation is a great enabler, and it’s the remit of my role. But you do have to acknowledge that bringing in new systems won’t inherently solve your problems. The systems must be well-supported, and people need to be incorporated into the journey. It’s a multifaceted process of technical development and stakeholder engagement.

Since we identified that issue early on, we were able to implement a data stewardship hierarchy across the business. This means we have senior individuals who are heavily involved in owning data within the organisation and colleagues across the business who reprioritised their work to spend time with us and help us get to where we are today. Overall, we made contact and collated direct feedback from about one third of the organisation. The outcomes and tangible results were shared in many different forums, from mail campaigns to town hall presentations.

Without this process in place, we wouldn’t have been able to put a brand-new system in place and expect everyone to think it was great and use it. If people can’t own, champion, or contribute to the system's evolutionary development, they won’t engage – which means you won’t achieve that robustness I mentioned earlier.

"Stakeholder engagement shouldn’t be an underestimated element. It’s a key piece of work that needs to be completed alongside technical innovation."

Everyone needs to be in on the journey, and it’s my team's remit to make sure everyone is as happy as possible. You need to work extra hard with those stakeholders that are already happy where they are and not looking to move elsewhere. You need to explain to them why the new system is beneficial – and if they throw additional problems or complications at you, it’s your job to ensure their concerns are addressed and their needs are met.

Again, it’s a multifaceted process. Stakeholder engagement shouldn’t be an underestimated element. It’s a key piece of work that needs to be completed alongside technical innovation. If someone isn't in on the journey, you may find out later that they’ve been squirrelling away their master data, which you need for the rest of the business.

We have global offices and external contributors to our technology platform, so there’s a lot of work that needs to be done to engage and sell them the concept.

Andrew: What is the best way forward when it comes to mitigating risks, and what is your main objective? For example, is it streamlining systems, enhancing efficiency, and/or enabling scale?

Niall: We've been on a transformation programme for just over two years, and our remit is to drive efficiencies by leveraging technology. That’s our key focus – and we’ve been developing a single source of truth platform to cover our deal lifecycle, and bringing people on board to collaborate on it.

"We've overcome the biggest hurdle to risk mitigation by creating [a] backbone of data architecture, through which all of our business processes can be appended."

We've overcome the biggest hurdle to risk mitigation by creating this backbone of data architecture, through which all of our business processes can be appended in a systematic manner. This means we can now start to witness new efficiencies around the robustness and ownership of data sets (through our data stewardship network), timeliness of information, informed decision-making, and new insights added by the interactive reporting layer.

However, there is still much to be done. When I reflect on the start of our journey – where we had disconnected, duplicated, and outdated data sets – I really feel that we've mitigated both historic and future risk. As we look ahead, toward potentially more advanced technologies, having well-structured data will best position us to react quickly, capitalise on new opportunities, and eliminate the risk of falling behind our peers.

Niall will be speaking at the Fund Operator Summit | Europe 2023 on 19 September in London.

For more information, including how to register, please click here.

 

Please Sign In or Register to leave a Comment.