The "Ah Ha" moment

Risk workshops, among other things, are a method for identifying and assessing risks and prioritising related actions. It is rare that anybody experiences an "ah ha" moment - where a lightbulb goes on and they achieve some extraordinary insight into the risk faced by their organisation. Most informed people have an intuitive understanding of their organisations risks and the value they get from a workshop is understanding the perspective of others and prioritising actions from a discrete list of risks.

In my experience the "ah ha" moment can be achieved when considering the associated controls and the gaps in those controls. Effective interrogation and challenging of assumptions can sometimes reveal the elephant in the room - the problem that everybody knows but nobody wants to talk about. And its rarely a process or a system or infrastructure or an audit function - things that are tangible and relatively easy to fix or implement. It's usually related to culture and goes to the heart of why the organisation cannot achieve its potential.