In the wake of the 2008 financial crisis, regulators focused on enterprise risk management and the need for companies to make it part of their daily operations as well as strategic decision-making. But getting employees to discuss the issue is no easy task.
In fact, Frank Fiorille, director of risk management at Paychex, a $2 billion provider of payroll and human resources services, says when raising the issue with a group of managers, one is more likely to hear crickets than a discussion of risks. So how to elicit constructive feedback?
Fiorille’s solution was to devise a sport-themed workshop at Paychex’s annual operational leadership conference at which several risk concepts were introduced. Then, amid props including Fiorille spinning a basketball on one finger, the 230 attendees voted anonymously, using response technology, first on their COO’s musical tastes, and then on specific risks in areas such as operations, finance and strategy.
Paychex has close to 100 offices throughout the U.S., Fiorille notes, so getting feedback from managers in various geographies who oversee different products and processes can provide warnings about emerging risks. Some votes may be skewed by politics or other factors, but once Fiorille’s group gets the data, they can “put it under the microscope, run it through our models, and do a deep dive to flesh out where the risks really are,” he says.
Paychex has since conducted more than a dozen workshops, each with a different sports theme, that collected responses from 1,200 employees, or 10% of the company.
In addition to providing a window into risks “around the corner,” the data from a wide range of employees have given Fiorille’s office much greater visibility into Paychex’s operational risks. The data also provide independent validation and support of the key risks reported to the company’s board and in regulatory filings.
Not surprisingly, Paychex employees have raised multiple flags regarding regulatory risk. “This was something we were already looking at, but after the workshop it was moved further up the priority list in terms of its probability and impact,” Fiorille says. “We may do more to make sure we’re watching that risk appropriately.”