Stories make it easier, in my experience, to explain a concept. So if you are sitting comfortably, its storytime (fictional).
A young couple is fast asleep when they feel a tug on the bedsheets.
"Mommy, daddy, my tummy hurts and I don't feel well!" Sob.
"Come here. Let me feel your forehead. Oh, it's quite hot. Darling, get the thermometer. We need to check his temperature."
"Here it is."
"Son, you have a temperature. Where does it hurt?"
"Here," pointing and then doubling up in pain.
They look at each other and decide to take him to the doctor. They don't want to wait until the morning to see their regular doctor so they dress, bundle the boy up, and drive to the hospital.
A doctor is found quickly and checks the boy out. He decides some tests are needed, including (to the child's distress) taking some blood.
The doctor leaves them in the care of a nurse, telling them that he will get the results to them as quickly as possible.
An hour passes. Two hours.
Finally, the nurse appears.
"Here's the doctor's report. I know it's quite long but you can see from the Table of Contents that the Executive Summary starts on page 2."
The father takes the report and starts to leaf through it.
"OK, it has his picture on the cover so we know it's the right report. But, that looks like an old picture. Let's see what's in the Executive Summary.
"His weight is 45 pounds, which the doctor notes is average for his height and age. I guess that's good. His temperature is a few degrees above normal. We already knew that. His white cell count is …"
The father stops talking except to mumble to himself as he reads on. Every so often you hear a muttered "So what?"
Finally, he throws the report down and accosts the nurse.
"Is our boy going to be all right? Why is his fever high and why does he have stomach pain? What can we do to help him?"
There's a huge difference between reporting facts and providing the information your audience needs.
For risk practitioners, can you answer these questions?
- Do you know what decisions your executive team and board are trying to make?
- Do you know what information they need about what might happen, information they could use to make more intelligent and informed decisions?
- Are you helping them be more successful or are you only helping them avoid harm?
For internal auditors:
- Do you know what your executive management team and board are trying to achieve?
- Do you know what they need from you to have assurance that risks to success are being managed at acceptable levels?
- Do you only provide assurance on controls rather than risks to objectives?
- When you assess the adequacy of controls, is it clear what potential effect they may have on specific objectives?
For everybody, do you know what your customer wants from you?
Are you informing him or her what they need to know — will their child (the organization) be OK, what do they need to know about the condition of risk management and internal control, and, what do they need to do about it?
Are your providing
actionable information?
I welcome your comments.
