Building a World-Class Risk Management Program: Lessons from the Marketing Playbook

To Build a World-Class Risk Management Program, You Need to Run It Like a Business

What makes the difference between a successful business and failed one? In short, sales. Sales are the fuel on which all businesses run, regardless of size or level of maturity. To make a sale, you need something to sell, and someone to sell it to. Without sales, there are no clients, and without clients, there is no business. It’s as simple as that.

Think of your risk management program as a suite of products that needs to be sold. Your key internal stakeholders are your primary target audience, but your customer base encompasses all employees with any current or future program responsibilities. To win stakeholder buy-in, you need to convince them of the value of your product offering. You’re not only competing for a share of the corporate budget, you’re competing for finite time and attention against other corporate initiatives. It’s not a one-time transaction; to reach world-class status, you need to retain the interest of your “customers” and keep them invested and engaged.

Here’s the tricky thing about selling: people don’t like being sold to. It’s the raison d’être for marketing: Sales are made not by selling, but by generating awareness and demand. Effectively selling your risk management program to internal stakeholders requires taking a page from the marketing playbook.

1. Marketing Lesson: Understand Your Program's Brand Reputation

What’s in a brand? Marketing jargon aside, a brand is simply what you stand for. Brand and logo are often conflated, but a logo is really just visual shorthand, a symbol that represents the essence of the brand. What you feel when you see the logo is the brand reputation. If you think about the world’s most beloved consumer brands, the ones that stick in our minds are those with which we have strong emotional connections.

Consider the internal brand of your risk management program. In this context, your brand is both mission and ethos. It needs to reflect your organization’s overall brand and the specific value you’re providing to individual stakeholders. But what you want your brand to be and how it’s perceived are often worlds apart. Ask yourself this: How do your employees feel when they think about risk management? Do they know the program exists? Do they understand the value proposition? Do those values resonate with them?

More often than not, risk management is associated with lengthy policies, detailed emails, and complex jargon—the buzzkill of the organization. To go from buzzkill to benefit, you need to change the way you engage your audience and forge deeper emotional connections by harnessing the power of storytelling. Stories frame the context for communication by making information specific and relevant to an audience, tying together scattered pieces of information and imbuing the cohesive whole with meaning. A story serves as a mechanism to focus your ideas, clarify your words and images, and produce an engaging experience for both you and your audiences.

2. Marketing Lesson: Know Your Audience

To rewrite your brand story in a way that resonates with the end-user, you need to understand the end user. Risk management isn’t necessarily in their job description. In some industries, such programs aren’t even mandated. You’re asking them to put in extra hours above and beyond their day job— and you’re likely not the only one. Why should they care about your cause? What’s in it for them?

Developing a series of personas is an effective exercise to metaphorically step into their shoes. Personas are archetypes of distinct groups of people—in this case, representative of all the key groups of your program stakeholders. The number of personas you develop depends on the complexity of your environment, but three to five is a good starting point.

To understand the perspective of each persona and how they might respond to certain messages or ideas, we consider a number of personal questions about their roles and responsibilities, concerns, challenges and how the program adds value to them. Ideally, interviews are conducted with representative stakeholders, rather than answering the questions based on guesswork. The goal is to get to the root of how the responsibilities they’re tasked with affect them at the individual level. If, for example, their responsibilities take them away from their day-to-day responsibilities, how do you then encourage them to carve out the time?

These personas then become touchstones for the engagement strategy you use at each stage of program deployment, and a mechanism for mapping individual user value.

3. Marketing Lesson: Communicate Value

Once you have established your key personas, you can develop customized communication strategies around them. Don’t fall into the trap of communicating arbitrary deadlines without considering the value proposition at the individual level. Every interaction should intentionally connect the call-to-action with tangible ROI.

How you talk about the program should change based on who you’re targeting: The key points you hit should be tailored to the persona, what matters most to them, and what value they’ll get out of it. What motivates a senior leader on the management team is unlikely to be the same as what motivates a functional leader.

Your tailored communications strategies should also take into account the way different groups of people consume information. Do they prefer to communicate over email, or are they active on an instant messaging platform like Yammer or Slack? Are they visual, auditory or kinesthetic learners? What’s the right cadence of communication to keep them interested? Leveraging the right communication vehicles in the right way can help you engage them more effectively.

4. Marketing Lesson: Generate Demand

Every program participant can be mapped against a continuum of engagement, ranging from unaware—no knowledge that the program even exists—to program evangelist—leaders who endorse and promote the program to other audiences. The end goal is to systematically move them up the chain, mapping the opportunities and barriers between every stage for each of your personas.

Most participants will fall into one of the first three camps: unaware, draftee, or enlisted. The most critical juncture is between the draftee and enlisted stages, which is where participants often languish. They become good corporate citizens, doing the bare minimum required, but they keep their criticism of the program close to the vest. Not only do they stay reluctantly engaged and dissatisfied, significant program issues may not be exposed until it’s too late. You want your people to move through these two stages as quickly as possible.

You can’t focus on everyone, so your best bet is to concentrate efforts on the program stakeholders with the most responsibilities and the greatest influence internally. Actively engage these influencers with an explicit strategy based on their persona and demand stage. The goal is to move these participants up the demand model, but not necessarily to make them all evangelists. You only need a handful of evangelists to generate the energy for change and motivate the masses to action.

How Invested Are They?

""

Unaware
Does not know that your program exists.

""

Draftee
Has been mandated to participate in the program, does not see its value.

""

Enlisted
Is a willing participant in the program but does not ask for it or endorse it.

""

Loyalist
Proactively participates in the program and sees its value.

""

Evangelist
Endorses the program to other audiences.

5. Marketing Lesson: Words Matter

Risk managers can get stuck in the language of their own discipline. But the jargon, technical terms and acronyms that may be the shorthand of your team don’t translate to a broader audience. And consider that language that works in one context may not work in another. The word “resiliency,” for example, has no equivalent in multiple other languages.

For better or worse, risk management is likely one of many company initiatives competing for the spotlight. If you want employees to prioritize your program, you’ll need to make it more memorable than the rest. Story structures are powerful tools for learning and retention. Research of the human brain shows that long-term memory is a function of our ability to link new information with the associative memories we already have stored. Research also shows a link between emotional impact and memory recall. A good story will link new ideas to familiar concepts and intentionally elicit an emotional response.

SPOTLIGHT: Concepts in Practice 

What does a world-class business continuity program look like in action? Here are seven best practices gleaned from real-life case studies:

""

Be a Brand
Design a visual identity for your program brand to serve as an internal rallying cry and invoke a positive emotional response. Take a positive spin on what you’re trying to accomplish instead of relying on fear marketing.

""

Be a Destination
You need a place to direct people to serve as your “point of sale.” Bring your brand to life on a website or portal that is attractive, user friendly, clean and jargon free. The way you set up your destination can also help you track critical program metrics.

""

Be Timely
How do you get people to go to your destination? Through regular communications. Rather than hitting them annually with a massive missive, atomize the actions and messages throughout the year and break them into a series of communications to stay in front of your audience regularly.

""

Be Memorable
All those internal initiatives start to blur together, especially when brand style guides are universally applied. Stand out from the rest of the pack by getting a little creative. Look for opportunities to bring humor or playfulness into the design.

""

Be Interactive
Don’t overlook the value of a good game. Leverage nontraditional methods to collect better information and provide training in a fun, effective way, in a shorter period of time.

""

Be a Teacher
Create a scalable education and training system. Pass on the tools and knowledge and deputize your influencers and evangelists to train people and deliver your key messages.

""

Be Measurable
Getting to the next stage of program maturity is dependent on proving your success. Establish KPIs that can be easily and regularly measured to document program progress.

How BDO Can Help

BDO can help you elevate the internal brand of your risk management program, drive higher engagement with key stakeholders and transform naysayers into brand ambassadors.  

Explore Risk Management Services

Related Resources

Article

Enterprise Risk Management for Today’s Threat Landscape

October 25, 2024
Article

Enterprise Risk Management for Today’s Threat Landscape

October 25, 2024

Ready to uplevel your ERM program? Download our eBook to learn more.

Read More

Article

Six Questions to Ask in a Post-Mortem Review After a Cyber Incident

August 1, 2024
Article

Six Questions to Ask in a Post-Mortem Review After a Cyber Incident

August 1, 2024

The CrowdStrike outage underscored the importance of having robust contingency plans, oversight of critical third parties, and mechanisms to evaluate not only the business operational effects but also the financial damages of such an event.

Read More

Article

Critical Incident Response: Managing a Cyber Disruption and Preventing Future Business Interruption

July 25, 2024
Article

Critical Incident Response: Managing a Cyber Disruption and Preventing Future Business Interruption

July 25, 2024

Millions of computers around the world running cybersecurity software from CrowdStrike have been affected by a faulty code update. To

Read More

Article

The Evolution of Risk Data: Do You Know the Risk Leader’s Role

July 10, 2024
Article

The Evolution of Risk Data: Do You Know the Risk Leader’s Role

July 10, 2024

As the world of risk continues to evolve, organizations will need to adapt with it. Read the insight to learn how BDO can help you and your team take on these challenges and turn your risk data into new opportunities.

Read More