1. An appreciation of the need for risk management before and during the voyage
2. The ability to recognize hazards, such as icebergs, in its path – and to do so early, not at the last minute
3. The intelligence to assess and evaluate them as dangerous, with a need to take actions to avoid a disaster
4. The ability to avoid the iceberg. If there is sufficient notice (see #1), the ship has to be sufficiently agile (maneuverable) to either change direction to go around the iceberg or stop before getting to it
5. Preparation and training, so that all of the above can be applied effectively and without delay

Is your organization more agile than the Titanic turned out to be?

1. Does it recognize, not only with words but with actions, that risk management is critical to the achievement of organizational objectives?
2. Does this belief extend from the board down to every decision-maker, so business decisions are made with the information necessary to be successful?
3. Are there measures to ensure that every decision-maker has sufficient guidance to know which risks he/she should take? Risk management is not about avoiding risks: it’s about knowing how to take the right risks
4. Do decision-makers have sufficient risk-related information to make informed decisions? Is the information current, timely, reliable, and in a useful condition?
5. Can your organization move quickly and with agility when new risks appear, risk levels change, or opportunities scream for your attention? Or are your process, culture, organization, and systems going to keep your feet mired in molasses? Is your organization as slow as a leviathan like the Titanic, or nimble like a frigate?

Norman Marks, CPA, is vice president, governance, risk, and compliance for SAP's BusinessObjects division, and has been a chief audit executive of major global corporations for more than 15 years. He is the contributing editor to Internal Auditor’s “Governance Perspectives” column.
normanmarks.wordpress.com/