Your risk function has a seat at the table. Why does it still have no influence?

The complaint that risk has no seat at the table is now largely out of date, and repeating it is the reason the underlying problem never gets addressed. In most institutions, risk, compliance, legal and security are all present in the governance of significant decisions. The seat exists. The difficulty is when it is offered.

A survey of risk professionals at large United States companies found that around half became involved during the initial strategy or design stages of major initiatives, and only nine per cent were included from the start across all of them (PwC, 2023). The remainder had a seat and arrived too late to influence design. The survey is dated and geographically narrow, but the pattern it describes will be recognised by anyone who has run a second-line function.

Why the timing determines the outcome

By the time a proposal reaches an approval forum, the architecture has been selected, the vendor has been chosen, the budget has been committed and a delivery date has been communicated. The decision has not merely been taken. It has been resourced.

At that point the range of available responses collapses to two. Approve, or impose a delay that somebody now has to pay for in money and credibility. That is not influence. It is the power to obstruct, granted at the single moment in the lifecycle when obstruction carries its highest cost.

The dynamic then becomes self-reinforcing, which is the part worth attention. A function whose only observable behaviour is objecting at the end acquires a reputation for blocking. Functions with that reputation are engaged later on the next initiative, precisely to reduce friction. Each cycle makes the next one worse, and nobody in the sequence behaves unreasonably.

The structural cause

This is not a failure of individual judgement or seniority. It follows from two teams being measured on different things.

A business sponsor is measured on delivery against a date and a budget. A control function is measured on whether the institution stays within its risk appetite and satisfies its supervisor. Both sets of incentives are legitimate, both are rational to follow, and they collide at the approval gate because that is the first point at which the two measurement systems are forced to interact.

Early involvement is not a courtesy. It is the only point at which a control function can change a design at a cost the sponsor can absorb.

The strongest objection

The case against is that early involvement slows everything down, and that a second-line function embedded from the outset in every initiative becomes an expensive bottleneck that reviews work which will never proceed. Most initiatives that are discussed are not pursued, and staffing a control function to engage with all of them is not affordable.

There is a sharper version. Early involvement can compromise independence. A function that helped design a control environment is not well placed to provide objective assurance over it afterwards, which is the boundary the Three Lines Model exists to protect (Institute of Internal Auditors, 2020).

The answer to it

Both objections are sound and neither argues for the status quo, because the status quo is not independence. It is exclusion followed by an approval ritual.

The independence objection applies with force to internal audit, which should not design what it later audits. It applies much less to the second line, whose role is to set standards and challenge, and which is expected to be involved in design in most supervisory frameworks. Conflating the two is how second-line functions end up behaving like auditors and arriving at the end.

The bottleneck objection is answered by triage rather than by delay. Early involvement does not mean reviewing everything; it means being told early enough to decide whether to engage at all. The cost of being informed is very low. The cost of being informed late is the one being paid now.

The test to apply

Attendance is a poor measure of influence, and maturity models rarely capture the difference. A better indicator is a single number: the median elapsed time between a decision starting to move and the control function first hearing about it.

Most organisations have never measured it. It is hard to game, because it is observable from calendars, project initiation documents and procurement records rather than from self-assessment. The distribution matters more than the average, since a function consulted early on routine matters and late on contentious ones has a good median and no influence where it counts.

If that number is large, the problem is not the seat.

References

Institute of Internal Auditors (2020) The IIA's three lines model: an update of the three lines of defense. Lake Mary, FL: The Institute of Internal Auditors.

PwC (2023) Risk in focus: PwC global risk survey. PricewaterhouseCoopers.