Risk culture: Who’s watching the board?

Vera Cherepanova discusses ethical leadership, from boardroom blind spots to the ethical implications of AI and investor short-termism, this conversation is a call to action for those who want governance to matter. She highlights the importance of boards fostering ethical reflection and embedding values into strategy, especially amidst ESG policy changes and the new US administration's executive orders. Cherepanova notes three types of corporate responses to ESG challenges: withdrawal, green hushing, and public resistance. She stresses the need for boards to ask good questions, formulate great questions, and recognize their role in defining organizational values. Cherepanova also introduces a new board ethics and compliance assessment tool to help boards structure their ethical frameworks.

Ben discusses the current state of risk management, emphasizing its disconnection from organizational decision-making. He highlights the need for good decision-making, advocating for a shift from traditional risk management to a focus on decision quality. He introduces the concept of "benevolent subversion," a guide with 22 practical techniques to embed good decision-making in organizationsand stresses the importance of management accounting in understanding business contexts and combating fraud effectively.

This episode discusses the Ivy Business School's leader character framework, emphasising the importance of character in leadership and risk management and how elevating character to the same level as competence and commitment can ensure better decision-making and financial oversight, especially during such uncertain times. Dr Mary Crossan explains the framework's development post-2008 financial crisis, highlighting 10 dimensions of character like integrity and humility. Bill Furlong, with a background in capital markets, shares how the framework can help address compliance issues by linking character imbalances to suboptimal judgments. He also stresses how critical the accountant’s role is in governance, oversight, and the smooth functioning of the economy. Dr Corey Crossan, from Oxford University, details university programs integrating the framework, noting significant improvements in leader effectiveness and well-being. The framework is seen as crucial for navigating today's challenges and enhancing organizational culture and performance.

In this episode, Richard and Rachael discuss the evolving risk management landscape in healthcare, emphasising the need for a dynamic approach to risk appetite. Richard highlights the importance of aligning risk management with patient safety and financial sustainability, suggesting that risk appetite should be applied to areas like estates and finances rather than just patient safety. He also addresses the challenges of cyber risks, advocating for proactive prevention and response measures.

This month, we discuss the evolving landscape of cyber risk management, focusing on healthcare and broader industry implications. James Parker, a cyber professional, shares insights from the 2017 WannaCry ransomware attack on the NHS, highlighting the lack of cyber skills and awareness among staff, and the slow prioritisation of IT projects. Lutz Naake, a partner at EY, emphasises the importance of identifying critical IT systems and implementing proper controls, noting the challenges companies face in cyber risk management. They stress the need for shared language and understanding between cyber professionals and business leaders to effectively manage and prioritise cyber risks. The conversation also touches on the impact of emerging regulations like the EU's NIS2 directive and AI Act on cybersecurity practices.

The discussion explores the intersection of AI and healthcare at MIT's Jameel Clinic. Ignacio Fuentes highlights their work in clinical AI, particularly in oncology, and drug discovery, including a new protein folding model. Frank Schuler emphasizes the role of accountants in building trust and managing AI risks in healthcare, suggesting future audits of AI systems. They discuss the importance of ethical decision-making, data quality, and regulatory frameworks. The clinic's global network of 43 hospitals aims to validate and implement AI models, enhancing early disease detection and clinical efficiency. The conversation underscores the need for collaboration among accountants, doctors, and policymakers to navigate AI's transformative impact on healthcare.

The podcast discusses the integration of AI in healthcare across the Middle East, driven by initiatives like Saudi Vision 2030 and UAE AI Strategy. Yasir Ghani highlights the Emirati genome program, which uses AI for personalized and preventive healthcare. He emphasizes the challenges in implementing electronic health records, with 60% of healthcare organizations struggling. The conversation also covers the importance of cybersecurity, supply chain risks, and the need for robust risk management strategies. Additionally, Ghani discusses the evolving board composition in the UAE, with a focus on diversifying skills and expertise, and advises ACCA members to be strategic, proactive, and tech-savvy in their careers.

The discussion focused on fraud in the UK's NHS, highlighting its complexity and the need for robust risk management. Alex Rothwell, CEO of the NHS Counter Fraud Authority, detailed the extensive fraud landscape, identifying 124 types of fraud and corruption. Key risks include internal insider fraud, collaboration with external entities, and supply chain fraud. The NHS faces an annual fraud loss of £1.3 billion out of a £160 billion budget. Rothwell emphasized the importance of strategic intelligence assessments, proactive risk management, and international collaboration to combat fraud effectively. He also discussed the role of AI and machine learning in enhancing fraud detection capabilities.

In this episode we speak with Nick Sanna, founder of the FAIR Institute and President of Safe Security, about using the Factor Analysis of Information model, the only international standard for quantifying and accounting for cybersecurity and operational risks, including pervasive third-party risks as the world witnessed with the CrowdStrike incident. Nick explains how healthcare organisations in particular could be using this at scale to better assess and manage potential cyber incidents, considering the high-profile cyber attacks at United Health and the UK's NHS and, indeed, our current research on risk management in the healthcare sector.

This episode discusses the why, how, and what of incorporating behavioural insights into corporate strategy and risk management. Our guests, David Grosse and Sandro Boeri, two seasoned experts who have been working on how to optimise such crucial information for many years, share their thoughts on how ACCA members can put this into practice.