Effectively uncovering hidden blind spots and driving sound corporate decision-making requires risk managers to cultivate professional scepticism: a “trust, but verify” mindset that actively questions assumptions, mitigates biases, and relies on rigorous documentation.
Key Insights
- Professional scepticism acts as a risk manager’s superpower by fostering a “trust, but verify” mindset that uncovers hidden blind spots and improves corporate decision-making.
- To apply this mindset objectively, practitioners must actively mitigate their ingrained cognitive biases by using structured, objective-centric risk assessments.
- Fostering a psychologically safe culture and rigorously documenting all significant judgments are essential to prove that risk teams asked the right questions if corporate failures occur.
In a turbulent year of fake news, scandals, and geopolitical conflict, taking information at face value is dangerous. The Royal Commission of Inquiry on Lembaga Tabung Haji serves as a stark reminder: risk practitioners must verify if what they see is actually there. Trusting blindly compromises stakeholder confidence in a company’s stewardship, oversight, and value-generating ability.
To combat this, risk managers must exercise professional scepticism. This ‘trust but verify’ mindset is an essential attitude within enterprise risk management that enhances the practitioner’s ability to identify and respond to conditions that may indicate possible disconnects.
In a Tea Talk hosted by the Institute of Enterprise Risk Practitioners (IERP®) titled “Trust, but verify: The Risk Manager’s superpower”, Chairman of the Board of Governors of the IERP® Ramesh Pillai addressed this mindset. Drawing from practical boardroom experience, he explored how this approach improves corporate decision-making and ensures risk practitioners ask the right questions.
Why Risk Managers Should Practice Professional Scepticism
High-performing risk management teams rely on professional judgement and a mindset of professional scepticism. As Ramesh noted: “When we say we trust but verify, this is our risk management superpower.”
Originally developed in the accounting profession, this approach is an essential safeguard against hidden blind spots. It requires conducting critical assessments, staying alert for contradicting data, and questioning the reliability of management and third-party reports.
Ramesh stressed that adopting a sceptical mindset is a personal and professional responsibility that improves the quality of enterprise risk management and decision-making. However, a practitioner’s ability to connect the dots depends heavily on their competency. This creates a continuous loop where formal training and hands-on experience constantly reinforce each other.
Cultivating this mindset also requires the right tone at the top. The Board and the Chief Risk Officer must lead by example, establishing clear policies and procedures that promote a questioning culture. Constant guidance ensures risk professionals exercise this mindset consistently.
When applied effectively, professional scepticism allows risk teams to draw accurate conclusions and support the Board in discharging its oversight and fiduciary responsibilities. Globally and nationally, regulators now explicitly recognise its fundamental importance, even at the Board level.
Overcoming Biases to Exercise Professional Scepticism
No one is truly unbiased. Upbringing, culture, and professional experience constantly shape human worldviews. When assessing information, these ingrained perspectives often prevent practitioners from connecting the dots accurately.
Ramesh highlighted that acknowledging and mitigating these influences is critical. “There is no such thing as someone who is unbiased. The challenge is understanding which biases are at play. Being able to de-bias the situation allows us to exercise professional scepticism impartially,” he explained.
Within risk management, especially operational risk, there are five major categories of bias a risk practitioner can encounter:
- Action-oriented biases
- Social biases
- Pattern recognition biases
- Stability biases
- Interest biases
Furthermore, overcoming these hurdles sometimes requires counterintuitive strategies driven by heuristics. For highly complex issues, Ramesh advised giving Boards less time rather than more. “Where you have a very complex problem, the shorter the time you give someone to make a decision, the better quality decision you get,” he noted, recommending focused five-to-ten-minute deliberations over hour-long meetings.
Documenting Professional Scepticism
Professional scepticism is often demonstrated during risk reviews and business management meetings. Robust risk management documentation, specifically meeting minutes, remains critical. It proves teams conducted risk oversight competently and complied with organisational, legal, and regulatory requirements.
In recent national and international cases, judges have used minutes to decide whether to hold management or the Board accountable for corporate failures. Authorities scrutinise these records to verify that the risk team asked the right questions. Without rigorous minuting, proving proper oversight becomes impossible. “If there’s no proper documentation, it never happened… how do we ensure that we hold the line accountable? Document, document, document,” Ramesh stressed.
Best practice dictates that risk departments record all significant discussions with management and those charged with governance, noting the specific issues discussed and the participants involved.
Some key areas demanding rigorous documentation include:
- Significant judgements: Discussions regarding the organisation’s susceptibility to fraud or corruption, and related communications to the Board or regulators.
- Suspected non-compliance: The outcomes of discussions concerning potential breaches of laws and regulations.
- Basis for decision-making: The rationale behind conclusions, the reasonableness of assumptions in management’s proposals, and the identification of potential management bias.
Building a Culture of Professional Scepticism
Building a robust culture of professional scepticism requires more than just individual effort; it demands strong leadership and the right tone at the top. Organisations must cultivate an environment of psychological safety where risk managers feel secure challenging assumptions, presenting dissenting views, and asking uncomfortable questions without fear of backlash.
As the second line of defence, Ramesh shared that risk managers must balance a dual responsibility of supporting the company but also having the independence of mind.” Furthermore, demonstrating professional scepticism means applying the right tools to the right problems. Teams must understand when to deploy Risk and Control Self-Assessments (RCSAs) versus relying on risk registers. Ramesh pointed out that RCSAs are tailored for operational risk management, whereas risk registers are for enterprise risk management.
In the end, fostering this questioning mindset hinges on personal bravery and rigorous evidence assessment. Risk professionals must remain alert to inconsistencies and critically assess information. As Ramesh reminded risk practitioners, “You need to have the courage of your convictions to stand by your decision. And at the end of the day, it comes down to documentation, documentation, documentation.”
