Build a Qualitative Risk Management Process Using Your Whistleblowing System

For any company, risk management is an important part of assessing the issues that can arise within their organization and getting those issues addressed as soon as possible. There are many types of different risks that businesses can face, such as strategic, compliance, safety, financial, legal, operational, reputational, and even natural disasters. 

According to a Harvard Business Review study, there are three types of risks that organizations tend to face and it’s important to understand how to categorize each risk so that the company can confront them accordingly:

• Preventable risks, which tend to deal with employees’ behavior and actions.
• Strategic risks, which tend to involve more economic and investment risks.
• External risks, which most of the time, companies have very little control over. These kinds of risks include but are not limited to natural disasters, political shifts, and economic changes.

Having a risk management process is essential for a business so that it can deal with any potential risks and respond to them accordingly. Instead of avoiding such dangers until they blow up, seeing the warning signs can help companies mitigate and accept the potential hazards. Risk management also examines the relationship between risk and its impact on the organization's strategic objectives, to support strategic planning if these issues arise. 

What are the key tools to leverage in your risk management process to effectively identify and prevent risks?

Identifying risks through your people

There are many ways to identify what kind of risks your organization may face, but first and foremost, it is important to know what kind of risks your company can face depending on your industry. A financial services business will not have the same kinds of risks that a procurement company will face, nor will its employees be confronted with the same issues. There is one common denominator for any company: all the data you need to identify risks within your organization already exists, and your best source of information is your employees. In addition to providing them channels to speak up, a whistleblowing system can be used to map out the risks within your organization.

Data gathering for better risk management

First, you should collect existing information about the workplace and inspect it so that you can begin identifying the hazards. You can do so by looking at the incidents that have already occurred in the workforce, studying how the work is being done versus how it has been done and studying the risks that are associated with it.

This can be a tedious task if your organization does not use any platform to manage and store these incident cases. And even more so if you are a large and global enterprise, with several subsidiaries and/or suppliers around the world. 

Having a whistleblowing management system where all incidents reported by employees are securely lodged can save you a lot of time. Making sure that the interface of your reporting channels is as user-friendly as possible is key: giving your employees the option to create a safe and anonymous inbox to report, to have a mobile app available for reporting, or be able to save drafts before submissions are some of the features that can help you get valuable information that you can leverage. This will give you a central place to gather, identify and manage risks.

Conducting qualitative investigations

Once this is completed, you need to understand the root cause of the issue reported, ie. is it an internal or external issue for instance? Depending on the incidents, it could be important to speak to employees to understand how the issues arose, get their take on the event, and any ideas they could potentially have to avoid such issues in the future. A platform allowing employees and case managers to have secure two-ways conversations, with the possibility to exchange documents while remaining anonymous will give you better insights than a one-way reporting system. A great way to have such data at your disposal in your risk management process is to ensure that your reporting channel and whistleblowing platform are attractive and easy to use by your employees. 

When gathering information through your whistleblowing system, having the possibility to set up investigative workflows will help you. From assessing the risk, and categorizing it to defining its impact (low, medium, high), workflows will guide your team. They will systematize the treatment of risks and generate data that will later allow statistical analysis.

Analyzing your risk data and being proactive

Gathering data through your people can be leveraged and used to conduct qualitative analyses of your risk areas. By supporting your risk management process with your whistleblowing data, it becomes easier to anticipate new risks and treat issues at the root.

Creating a risk map

Once you have been able to identify the inherent risks, creating a risk map can help have a better understanding and vision of your organization. In being able to evaluate the risks and their potential frequency, you can prioritize the issues when they arise. Risk maps can come in different forms (square, round, etc) and tend to use colors (green, yellow, orange and red) to dictate the gravity of the problem. These tools help keep a visual of potential dangers. 

Mapping risks in your organization in its globality will allow you to identify trends and patterns across your organization, whether it be a repetition of similar incidents, a specific department or region receiving more reports, or a recurrence in periods where risks are higher than average.

You can refine your risk map by leveraging your whistleblowing data and crossing it with other data sources to comprehensively analyse risks. The easiest way to do this would be to send the data from your whistleblowing platform into your Business Intelligence software thanks to an API. This will allow you to build advanced analytics and gain an overview of risks by locations or department, compare it with turnover rates, etc. This advanced analysis allows you to detect new risks, their probability of occurring, and/or potential impact on your organization.

Example of a risk map

Proactively identifying risks

Risk management is a continuous process, and building trust with your employees will considerably help you to uncover and mitigate hidden risks within your organization by making them an integral part of your risk management framework.

By sticking to the use of whistleblowing for compliance, you’re missing out on the opportunity to benefit from it in other aspects. By removing the label of “whistleblower” and starting to talk about Trusted Conversations, we can go at the root of its concept and consider whistleblowing as “one type of conversation on the spectrum of what we call trusted conversations”¹.

Attractive communication channels, consistent feedback, clear frameworks, and leading by example will benefit both your employees and organization:

• Employees feel valued and recognized, encouraging them to have trust in their management and organization;
• In having these follow-up discussions, businesses have seen that there has been three times the increase in employee engagement. 82% more employees are likely to speak up, all while feeling safe enough to do so without the fear of being reprimanded and staying anonymous;
• More conversations and reports mean risks are picked up and managed early;
• Happy employees are more likely to increase their productivity, stay loyal to their organization and become ambassadors of the organization's good reputation.

Having a whistleblowing platform implemented does not mean it just needs to be used for speaking up, but you can also use it to go beyond the scope of what it was intended to do. You can make your workplace safer for everyone. Having a platform like Whispli at your fingertips for your business can help you understand what is going on within the company and help regulate and control the brand image.