Risk Tip # 11 – linking control effectiveness measures to organisational outcomes

I have previously written in relation to the measurement of control effectiveness (Risk Tip #2- Control Effectiveness), but in this latest instalment of my Risk Tip series, I want to show why it is so important, not only in the management of risk, but also how it relates to the achievement of our organisational outcomes.

Let’s start at the very beginning

As you know from my first blog this year, – what is a risk?  I highlighted the limitations of the ISO 31000 definition of risk because I think it is confusing when it refers to a risk as the effect of uncertainty on objectives. I prefer this definition:

“A possible event/incident/issue that, if it occurs, will have an impact on the organisation’s objectives”

But, what is common with both definitions, is that there is an impact on the organisation’s objectives.

So how can we demonstrate that we are contributing to an improvement in our outcomes? Well, it all comes back, once again, to the common control.

Measuring what success looks like.

One of the most important aspects of a performance management framework is the articulation of what those measures are, and we do that against our critical success factors.

For this blog we are going to use a call centre company that has the following target performance measures for Reputation:

Below that, it has articulated a range of output performance measures for the objectives it has developed:

In addition, the company has also developed a series of outcome objectives understanding that just having output measures can drive certain behaviours:

From here, we can then identify the controls that we need in place to ensure that the achievement of these objectives is possible:

So, let’s see what happens when we get it right and when we get it wrong

To demonstrate the impact that can be had on the organisational outcomes by not ensuring the controls at the lowest levels are effective, we will compare two call centre companies.  As we can see from the below table, the conformance to the controls is vastly different in both:

Staff at Company B are less familiar with the product, so it will almost certainly take the majority of their call centre staff longer to resolve issues (if they can at all).  This will then lead to greater frustration for customers but because there has been little communication or conflict resolution training it is likely that there will be more calls that end in a conflict situation, which ultimately leads to:

The takeaway messages

There are two messages that I hope you have been able to take away from this Risk Tip:

• There is a direct correlation between the effectiveness of controls and organisational performance; and
• We need both output and outcome measures to have a truly holistic performance framework.