Approaches to anchoring in organizations

Relevant literature and generally accepted standards emphasize that risk management should not only deal with deviations from targets in the sense of potential losses, but also with potential opportunities. This connection gains weight if one follows Lombriser & Abplanalp, who reduce the value of the overall company not only to discounted future cash flows, but define it as the maximum benefit that can be provided to the various stakeholders in the future. If risk management systems are to support this approach, they must extend beyond strategic and operational management processes. An anchoring in normative management (policy, constitution, culture) is indispensable so that risks are managed and not just documented.

Added value of risk management

Proactive risk management to protect what has been achieved and to create added value requires appropriate behavior on the part of employees at all levels. This must not be understood as a claim to prevent risks from the outset. The controlled acceptance of risks is the basis for the perception of opportunities, success and the sustainable safeguarding of the company's continued existence. Rather, employees must be sensitized and empowered with targeted measures that are appropriate to the target group and level, so that risks are controlled or handled with an appropriate appetite.

People as a success factor

In order to avoid measures based on the watering can principle, functions and responsibilities must be clarified in advance under the primacy of the task in accordance with the concept of "man-technology-organization" (Ulich, 2005). The internationally recognised model of the three lines of defence (cf. IIA, 2013) can be used as a recognised aid.

The main target group for awareness and training are employees and management from the operational units (first line of defence). They are on the front line of day-to-day business and are responsible for success and failure. Employees from the second line of defense (also called assurance function), support the first line in risk management with models, frameworks, process design and execution, and quality review. Internal audit forms an independent third line of defense and provides additional assurance. The model of the three lines of defence not only supports the allocation of competencies and responsibilities, it is also a suitable tool for the target group-oriented sensitization of management and employees.

Depending on the demand for individuality of measures, a multitude of target groups for sensitization and training quickly emerges. Clustering can optimise the relationship between individuality and target group size. One possible approach to differentiation is to ask questions such as: For whom is the focus on dealing with risks on a day-to-day basis in day-to-day business? Who needs in-depth risk management system and process knowledge? For employees without a dedicated role in risk management, the focus is usually on the day-to-day handling of risks. To date, however, the established risk management literature provides only a few approaches for developing the necessary human factors. Only the Austrian risk management standard family ONR 49000:2014 puts the topic of human factors more in the foreground. Brandes & Brandes aptly express the situation in this regard:

"Risk management is pretending that when you're driving a car, you can get a better handle on the risks by delegating them to a co-pilot with a special computer on his lap instead of leaving them to the driver." That's where risk management quickly becomes more complex than the complex risks themselves." (Brandes & Brandes, Simply Managing, 2014)

Development of human factors

Suitable and proven information on the development of human factors for dealing with risks can be found, for example, in the High Reliability Theory (cf. Weick & Roberts, 1993). It has emerged from the study of organisations that have a high hazard potential but nevertheless produce fewer accidents than would be statistically expected. According to the researchers' findings, the safety of these systems is fundamentally based on "heedful action" (heedfulness). "Heedfulness" is described as the interplay of fault tolerance, aversion to simplification, sensitivity to operational processes, striving for flexibility and respect for specialist knowledge and skills. Civil and military aviation put the results of these studies into practice early on by means of human factors training (crew resource management). Regarding the application in average companies, critics often complain that this type of training is unsuitable. This criticism was taken up in 2010 by Brandl (Brandl, 2010). He asked the question whether only

The controlled taking of risks is the basis for the perception of opportunities, success and the sustainable safeguarding of the company's continued existence.

human lives must be in danger in order to counter the "shoals of human reaction and action" in a targeted and prudent manner. Under the term "Company Resource Management " he shows that the same reaction patterns, perception errors and communication breakdowns can have their dangerous effect in aviation as well as in companies. Based on these considerations, it is obvious that the same measures can also contribute to a reduction of errors and the reduced occurrence of risks in leadership and employee development.

Basic principles from High Reliability Organizations that can be adapted for companies

Cognitive and interpersonal skills, which are trained with Human Factors Training, can be applied adequately and adapted to companies without special hazard exposure without great effort:

"Situational Awareness" supports the recognition of "weak signals" (cf. Ansoff & McDonnell, 1990). This involves being able to comprehensively grasp and assess the situation around oneself at an early stage, to understand backgrounds and to be able to assess consequences. By training "decision making", well-founded and structured decisions can be made in an efficient manner, which also brings advantages for management work. Especially in unclear or challenging situations, the targeted use of teamwork and know-how is indispensable through "Cooperation/ Teamwork". Active leadership with "Leadership & Management skills" supports the compliance with external framework conditions, the claim of good governance as well as the efficient use of resources. The basis of the human factors elements is a situation-appropriate communication basis "Communication".

Measures to teach these skills should be designed individually for each company in order to maximise the benefits. In terms of target group-oriented application, measures that are appropriate to the target group and can be implemented with little additional effort are of central importance. It is imperative that the primary function of first-line employees remains in the foreground. Human factors training should support employees not only in dealing with risks, but also in achieving goals and in everyday tasks. For this to succeed, the wider and closer environment must be analysed individually and comprehensively before planning any measures. This includes regulatory and market conditions, corporate goals and values, organization, processes and resources.

Implementation example

As a possible anchoring approach, a training and awareness-raising concept with modules that build on each other can be applied:

Employees and specialists without a specific role in risk management (e.g. employees without risk and control responsibilities) are only informed about the risk culture that is practised and about the principles and

It is imperative that the primary function of the first-line employees remains in the foreground.

The focus is on the company's own role and the principle of acting on one's own responsibility in line with corporate goals and values. The focus is on the individual's own role and the associated principle of acting on one's own responsibility in terms of corporate goals and values. Even at this stage, the integration of human factors components offers added value in terms of behaviour. The information conveyed can be additionally anchored through e-learning, for example, and kept present through periodically recurring communication measures throughout the entire period of employment.

Managers often take on the role of control officers or even risk owners. They can be trained in risk identification, analysis and control as part of regular management training and management events.

The focus is on one's own role and the associated principle of acting on one's own responsibility in terms of entrepreneurial goals and values.

lysis, evaluation and management. Awareness-raising and training sequences that are directly integrated into practical examples and presentations significantly increase the practical relevance, but also increase the demands on trainers and instructors. The integration of the human factors aspects shown enriches leadership training and promotes a differentiated examination of risk situations in everyday life. By applying and reflecting on what has been learned in a familiar environment, a sustainable learning effect that can be implemented in everyday life can be achieved.

Employees with an assigned second function in risk management (e.g. risk coordinators, members of risk management boards, etc.) support technical and management staff along the entire risk management process and thus assume a hinge function between the first and subsequent lines of defence. This target group is often rather small, but in addition to the topics already mentioned, it should also be trained in the general conditions of risk management. For economically meaningful training, a thematic bundling of topics is indispensable. Depending on seniority, the emphasis can be placed on system, process and methodological knowledge, the interaction of different functions or the handling of risks. Human Factors Training also offers valuable support in dealing with risks. The benefit of the training measure can be further increased by imparting knowledge in the classroom system. The exchange and deepening of knowledge in learning and working groups makes it possible to coordinate risk understanding and culture across divisions.

Conclusion

Sensitized and empowered employees increase the quality of risk management throughout the entire process by practicing mindfulness in the sense of "heedfulness". By actively managing risks, they help to

If it is not lived, then it is useless.

with using resources efficiently, recognizing opportunities early on and ultimately taking risks in a goal-oriented and conscious manner with the right appetite.

"Thought is not yet said, said is not yet heard, heard is not yet understood, understood is not yet agreed, agreed is not yet applied, and applied is not yet retained " (Konrad Lorenz (1903-1989)

The measures described above alone do not provide comprehensive protection. The profitable application and maintenance of human factors requires continuous communication, the establishment of risk management as a management tool in everyday life, and the promotion of an open error and risk culture with concrete measures. Management and leadership must be allowed to take responsibility for successes, but also for the associated risks and failures. A management environment designed in this way is the only way to ensure that risks are handled responsibly and, ultimately, that opportunities can arise from risks.