Risk management and parenting
I am a proud father of three fantastic boys, sorry, young men. An important job for which, sadly, there are no qualifications. Recently, it dawned on me that navigating parenting, much like risk management in financial services, involves evolving responsibilities.
When my children were little, my wife and I were responsible for their safety, e.g., crossing the road. As they grew, they learnt to cross the road on their own, and they became responsible for crossing the road. We limited ourselves to keep a discreet eye from a distance. A similar process took place with school journeys and with money. In terms of money, it reached a milestone when they left home and became responsible for their budget, even if we remain ultimately accountable for their financing!
These dynamic changes have an interesting parallel in the allocation of risk management responsibilities in financial services.
While the 3 lines of defence (3LOD) model is broadly understood and typically adopted, it doesn’t always help businesspeople understanding the scope of their responsibilities. In some ways this isn’t surprising – it’s sometimes forgotten that 3LOD is a model – an abstract description of reality. It’s asking a lot to expect it to solve all your problems.
We often see businesses setting up ‘line 1.5’ or ‘line1b’ teams. These are teams of people that sit in the wider business and support the delivery of its risk management responsibilities.
There are consultants and commentators that are negative towards these line 1.5 teams from a purist perspective. After all, this is not one of the 3LOD in the model and the risk responsibilities should be embedded in the business.
However, the starting point for a line 1.5 team can be from the best of intentions – increasing embedding in the business. True embedding, and the transfer of responsibilities, can be a challenge for risk and compliance functions – which can sometimes result in risk functions taking on too much for the business, and either struggling to deliver or becoming large and expensive. The consequences can lead to the worst of all possible worlds – processes that are expensive to run, risks that are not proactively managed at source, and functions that are not perceived adding value to the business. The approach is neither effective nor efficient. Equally, putting in place a line 1.5 team that ‘protects’ the wider business from engaging with risk and compliance is hardly an effective approach to embedding.
Like in navigating parenthood, the need for change is usually clear as the business ‘grows up’ in its approach to risk management. What is less clear is how to make that transition work. So is putting in place a line 1.5 team a useful step in the journey of embedding risk and compliance responsibilities more efficiently and effectively?
From our work, we have identified some pros and cons of a line 1.5 team compared to the purist alternative. The key ones are summarised in the table below.
| Pros | Cons |
| Support the delivery of business strategy in the short to medium term. | Perpetuating business expectations about handholding and risk management being someone else’s problem. |
| Bringing responsibility for risk management closer to the business. | A situation where the Risk Function is further separated from the business. |
| Allowing the business to pool resources and develop risk management capabilities in the business. | Potential overlaps between 2LOD and line 1.5 team, e.g., in respect of advice on regulatory issues. |
At Crowe we take a pragmatic view about these line 1.5 teams, rather than a purist perspective. We think that these teams can play a valuable role in helping to effectively embed risk management and transition responsibilities more efficiently and effectively. In approaching this change, it is important to have a clear set of objectives and direction of travel in mind – for example, do you see line 1.5 as a temporary fix to help embedding with less cost and initial impact than full embedding in the first line?
It is also important to clearly define responsibilities and accountabilities, to ensure that the wider business is clear on the scope and authority of both line 1.5 and line 2 functions – while ensuring that the overall priority is that the overall risk resource is right across the business as a whole, and that an effective risk culture is promoted.
Much like parenting, growth and maturity is never complete - but progress in the right direction can be made by approaching embedding in a pragmatic manner to reflect changing circumstances and to enhance risk management effectiveness and efficiency.
For more information, please contact Isaac Alfon or your usual Crowe contact.
