Train Wreck

Education: That which discloses to the wise and disguises from the foolish their lack of understanding

Here at Honestly Lay Bare we like to think that we bring you the very best in the world of internal controls, internal audit, risk management and corporate governance.

Once in a while we come across something that really makes us think.

Recently we were reading the Irish Sunday Business Post (we read widely!) about how weak controls may cost Iarnród Eireann - or in English, Irish Rail, the national railway system operator for Ireland.

Have a read of part of the article first ...

A consultants report into procurement controls at the state rail company, Iarnród Eireann, has estimated the risk of losses arising from weak internal controls at up to €5 million yearly.

The evaluation of procurement practices at Iarnród Eireann by consultants Baker Tilly described the potential impact in relation to the financial risks as ‘‘super critical’’.

It had particular concern over the payments made for ‘‘higher volume, lower value’’ transactions made routinely by Iarnród Eireann, where the annual spend is in the region of €40 million to €50 million per annum in the divisions under review.

Fine Gael senator Paschal Donohoe, a member of the Joint Oireachtas Committee on Transport, which examined the report last week said Baker Tilly had clearly identified the probability of the risk as ‘‘almost certain’’.

The report put the financial risk to Iarnród Eireann of non-compliance or collusion in the region of 7. 5 per cent to 10 per cent of the €40 to €50 million spend every year. This amounted to a risk of up to €5 million yearly. ‘‘It will be a bit rich for Iarnród Eireann to come looking for a fare increase in the context of this waste," he said.

As Honestly Lay Bare read - and re read - the article it struck us that this article represents the greatest failing of modern day risk management.

How so you ask?

We as professionals interested in the proper practice and execution of risk management have lost the battle as to how our outputs are used by people less passionate or, dare we say, less educated.

It is as if a doctor has decided that he will only do the operation and forget about the post surgergy consulation; it is as if the engineer has built the building but never checked to see whether it was safe to enter.

Go back and have a read ... OK ... perhaps don't ... just keep reading here and we will explain.

What disturbed us the most was the definitive tone of the article and the conclusions it drew from a report which - by its very nature - is an interpretation rather than a categoric statement of the underlying facts.

Let's break it down (we sound too much like MC Hammer for our own liking there!):

estimated the risk of losses arising from weak internal controls at up to €5 million yearly.

This is where those risk management matrices really fall down. Someone has read the consultant's report and seen that one of the bands says up to €5 million and jumped on that without cross referencing it to the probability of that event occuring.

Also this statement implies that weak internal controls is a singular beast - rather than a complex interrelated structure of events where even one operating well may prevent the loss of any money.

And this is one of our pet hates of these types of articles ... there is no mention of that risk that is all encompassing yet nearly impossible to measure. Reputational risk.

Perhaps the consultant's report didnt consider a state owned railway operator to have a reputation worthy of measuring. We will never know.

The evaluation of procurement practices described the potential impact in relation to the financial risks as ‘‘super critical’’.

Aaah the next thing that we love.

The adjective ridden importance label. Note the procurement practices are SUPER critical. Not critical as in this patient is in a critical condition - a universally recognised term to mean that the person is hovering at St Peter's door.

Equally the article fails to give full balance to the other risks relating to the procurement practices.

For argument's sake, what would happen if we managed all the procurement practice financial risks but we purchased rolling stock of such poor quality that the health and safety of Irish Rail's staff and customers was at risk everytime a train pulled out of the depot.

It had particular concern over the payments made for ‘‘higher volume, lower value’’ transactions made routinely by Iarnród Eireann, where the annual spend is in the region of €40 million to €50 million per annum in the divisions under review.

You would HOPE that a consultant assessing the risks of an organisation would have concerns over transactions in the region of €40 million to €50 million per annum!

Once again the article fails to acknowledge that reviews of this nature - BY THEIR VERY NATURE (sorry for the screaming!) - should focus on areas of big spend.

Fine Gael senator Paschal Donohoe, said Baker Tilly had clearly identified the probability of the risk as ‘‘almost certain’’.

For Paschal's sake we are glad that the probability was CLEARLY IDENTIFIED. Of course, it was clearly identified ... that is what word processors (and indeed typewriters and anything else back to Gutenburg) do! The clearly identify things that the author wants the reader to notice.

What is missing here is that we actually don't know what the risk is that is almost certain (another adjective ridden label ... but we won't go there). Is it the risk that all of the procurement spend is at risk. If that is the case - this is enormous.

But ... somehow ... we don't think that that is the case.

The report put the financial risk to Iarnród Eireann of non-compliance or collusion in the region of 7. 5 per cent to 10 per cent of the €40 to €50 million spend every year. This amounted to a risk of up to €5 million yearly.

Aaah don't you just love this ... the article assumes that non-compliance and collusion is the same risk.

Actually last time we checked ... it isnt!

You can educate people around non-compliance but the malicious aspects of collusion are very difficult to identify and measure.

‘‘It will be a bit rich for Iarnród Eireann to come looking for a fare increase in the context of this waste," he said.

And this is our favourite - the report is talking about risks that have not happened.

Yet a politician has extrapolated a hypothetical situation into reality and argued against a fare rise that would otherwise fund the correction of the many deficiencies that the report has highlighted.

**

So ... what does all this prove?

In this one article we can see the very heart of the issue with risk management advice - it is, like beauty, in the eye of the beholder.

Until such time as there are universally agreed measurements that will always be its curse.

And articles such as this will continue to be written.