Risk managers should encourage employees to openly raise risk management related issues. This is possible by spending a considerable amount of time every day communicating with their colleagues and staying up-to-date on the latest developments and emerging risks or failures in the internal control system.

Share the risk manager’s contact information with employees or provide a confidential hotline for communicating risks through the internal company website or via the phone. Risk managers should motivate and encourage staff to be proactive about identifying and preventing risks. One of the risk managers we have interviewed started a table tennis tournament to build rapport with other business units and to have regular conversations in an informal setting with other managers. Another risk manager we have interviewed created daily performance and incident reporting meetings to encourage ongoing discussion about potential threats and opportunities. Anything that creates a vision of an approachable and helpful risk manager works.

We, for example, have created a risk management page on the company intranet with a message form to allow people to anonymously send messages to the Head of Risk about any emerging risks. Over the course of three years it was used exactly zero times! Was it a waste of time? Of course not. Because even though no one felt comfortable using the online form, dozens of employees approach me to ask for feedback, comments, opinion or share information about emerging risks or a potential issue.

Risk managers may consider introducing a rewards programme for active participation in risk management activities. It is important to encourage a “no blame” culture and communicate it throughout the company.