Empowering fee earners to take control of risk

By Louise Fleming, Partner, Aretai Consulting 

My first challenge is how do I get you to keep reading to the bottom of this page when the subject matter is controlling risk? Who cares about controls? Risk managers, compliance managers, finance managers, HR teams, internal and external auditors, and the regulator? Of course, they should and
do care about controls, but they represent the second and third lines of defence
and beyond.

The part of the business in which controls matter most is where business originates - the front office, or first line of defence. The fee earners who take risk for the business in order to generate revenue must have primary responsibility for controlling or managing that risk.

The lines of defence model referenced above is well recognised by regulators, auditors and risk managers and has served as the blueprint for risk and control in many organisations since it was first published over a decade ago. In this model, much focus is put on the second line of defence (the management control functions) and
the third line (internal audit).

These groups have an essential role
to play in risk governance and management. But, there is also growing consensus that, whatever control infrastructure you put in place, it is the decisions of those taking risk on behalf of the organisation that businesses need to focus on.

Risk is defined as a combination of the probability of an event and its consequences. The objective is not to eliminate it, but to mitigate or manage it
to an acceptable level - a level that is in
line with the organisation's risk appetite.
So, how does this work in practice?
How can you persuade your fee earners
to own and manage risk?

The answer is education, and the following four steps are a good start.

1. Purpose and objectives. Ensure everyone has a clear understanding of the purpose and objectives of the business. The question 'what are
   we here for?' needs to be able to
   be answered throughout the firm.
   The answer should encompass the needs of all stakeholders (including equity partners, staff, clients and
   the wider community).

2. Personal and firm risk. Equip decision makers with both an awareness of their personal risk preference and an understanding of the risks faced by the firm in achieving its strategic objectives.

3. Knowledge and information. Empower fee earners with the knowledge and information to optimise business decision making in the context of (1) and (2), providing them with a clear sense of where the boundaries and therefore their freedoms lie.

4. Control functions. Protect those taking risk on behalf of the business with control functions that support them in delivering performance objectives.

Empowering fee earners

In the face of risk, the temptation is to put in place lots of red tape to prevent partners and their teams from making the 'wrong' decisions, but it is far better (and appropriate) to start with the premise
of 'I trust you'.

Pricing and its impact on profitability
is a risk facing all professional service
firms in today's market. In this context,
let's examine controls over write offs as
an example.

If the firm stipulates a control that all write-offs have to be signed off by another partner, then the default position is ask
a friend and ask no questions.

An alternative approach would
be to ensure that all fee earners are
familiar with the firm's profitability model (knowledge) and have access to the
tools to see the impact of the proposed write-off on their profitability (information).
They are empowered and (in theory at least) will only take on work that is profitable or that is part of a profitable client relationship.
The control would then be to monitor
write-offs by partner and take action
where these are higher than expected against profitability targets.

Protecting fee earners

The role of risk and internal audit is increasing in professional service firms. Firms are building 'protection' for their business by strengthening and clarifying
the role of control functions and investing
in internal audits (the second and third
lines of defence).

In addition to compliance, firms are appointing risk management experts, and forward-thinking firms are taking a risk-based approach to internal audit
rather than focusing only on file reviews.

The most progressive firms are taking an approach that starts with educating and supporting those responsible for taking risk. An approach that equips and empowers fee earners to protect and enhance the value of the firm has to be a good place to start.

Louise Fleming has 20 years experience working with professional and financial services firms in business and risk management (www.aretai.net)