☛ Want the latest procurement and supply chain news delivered straight to your inbox? Sign up for the Supply Management Daily
10 October 2013 | Paul Snell
You cannot manage risk solely through processes and governance, according to whistle-blower and risk management expert Paul Moore.
Speaking at the CIPS Annual Conference in London this morning, Moore - who was dismissed from his position as head of group regulatory risk at HBOS after he raised concerns at the financial services firm - said policies and procedures were only part of the solution.
He told delegates that human nature is the area that needs to be addressed.
"You can have the best governance processes in the world but if they are carried out in a culture of greed, unethical behaviour and indisposition to challenge they will fail," he said.
"I have spent so much of my existence spent looking at what look like great risk systems, but they are a veneer. Process isn't the answer, it is part of the answer.
"There was more struture and process at HBOS than you could swing a cat at. There was too much process, too many policies, too many forms. That is not the solution to the exercise of great judgement and risk management.
"Process without culture does not work, and it is often a distraction."
Moore, who turned whistle-blower and exposed a myriad of issues at HBOS, said most risk management is about exercising good judgement.
"Risk is always thought about in the negative, but it's not," he said. "Risk and opportunity are two parts of the same coin, and I have spent much more of my professional life trying to simplify risk management process and refer it back to judgement. Judgement and common sense is a vital part. Technical stuff only takes you so far."
But, he added, organisations still have yet to work out a way people can speak out and "be a discordant voice" in business.