The Evolving Role of the Risk Analyst

RIMScast

chevron_right

00:00

Limits of Legacy Tools like KRIs and RCSAs

Andréia critiques disconnected GRC systems and excessive complexity in RCSAs and KRIs.

Play episode from 12:10

chevron_right

Transcript

chevron_right

Transcript

Episode notes

Welcome to RIMScast. Your host is Justin Smulison, Business Content Manager at RIMS, the Risk and Insurance Management Society.

In this episode, Justin interviews Andréia Stephenson, BSc SIRM, Enterprise Risk Analyst at London Metal Exchange, about her shift from a Bachelor of Science in biology to a risk analyst and risk professional. Andréia speaks of her passion for data and the importance of communicating at all levels of your organization. She regards working for different organizations with good leaders as a way to learn risk frameworks and gain foundational knowledge. She shares views on how risk analysts can influence risk culture. She also tells how she uses AI as an assistant.

Listen for thoughts on building a risk-aware culture by asking leaders the right questions.

Key Takeaways:

[:01] About RIMS and RIMScast.

[:17] About this episode of RIMScast. Our guest today is Andréia Stephenson, BSc SIRM, Enterprise Risk Analyst at London Metal Exchange. She will discuss her career and the evolving role of the Risk Analyst. But first…

[:43] RIMS-CRMP and Some Exam Prep Courses. From December 15 through the 18th, CBCP and RIMS will present the RIMS-CRMP Exam Prep Boot Camp.

[:53] Another virtual course will be held on January 14th and 15th, 2026. These are virtual courses. Links to these courses can be found through the Certification page of RIMS.org and through this episode's show notes.

[1:07] During the interview with Andréia, you will hear her reference the RIMS CRO Certificate Program in Advanced Enterprise Risk Management, which is hosted by the famous James Lam. Andréia is an alum of the program.

[1:23] You can enroll now for the next cohort, which will be held over 12 weeks, from January through March of 2026. Registration closes on January 5th. Or Spring ahead and register for the cohort held from April through June of 2026. Registration closes on April 6th.

[1:39] Links to registration and enrollment are in this episode's show notes.

[1:46] Justin shares that RIMS suffered a tremendous loss in December. Chief Membership Experience Officer, Leslie Whittet, with RIMS for almost three years, tragically passed away due to injuries she sustained in an accident. She was walking her dog when she was struck by a truck.

[2:18] Some of the RIMS staff, including CEO Gary LaBranche, knew Leslie from years prior. We are all shocked and saddened. Leslie was a remarkable association leader with 30 years of experience.

[2:33] Gary LaBranche had the privilege of working alongside Leslie Whittet at the Association for Corporate Growth for nine years. For the last three years, Justin has had the pleasure of working with her at various RIMS events and seeing her weekly on our remote calls.

[2:50] Leslie was always a source of positivity, inspiration, and creativity. She was just a wonderful person who will be deeply missed. Her memory is certainly a blessing.

[3:03] RIMS will celebrate her memory at the Chapter Leadership Forum in Orlando in January. If you have any questions, please contact Josh Salter, jsalter@RIMS.org. Tributes are pouring in on LinkedIn and various networking groups.

[3:22] If you have memories and photos you'd like to share, we encourage you to do so to honor her memory.

[3:29] It wasn't easy to speak these words or read them, so I want to take a brief moment of silence to honor Leslie before we go any further.

[3:44] On with the show! Our guest today is Andréia Stephenson. She comes to us all the way from London, where she's an Enterprise Risk Analyst for the London Metal Exchange.

[3:57] You may know her a little bit from some promotional videos we've done on social media, promoting the James Lam CRO Certificate Course. In getting to know her, I was struck by how enthusiastic she was about her role as a Risk Analyst for years.

[4:14] Many risk professionals begin as risk analysts; others, like Andréia, can make a thriving career of it. She's here to share some tips on how to do that, where ERM fits into the mix, and where she believes the role of the risk analyst will be going in the near future. Let's get started…

[4:36] Interview! Andréia Stephenson, welcome to RIMScast!

[4:47] Andréia may sound familiar to you because she did a testimonial on LinkedIn for RIMS for the James Lam CRO Certificate course. Justin says she was great to work with. That's how she and Justin met, and that's why she's here.

[5:19] Justin notes that his voice is lower from "shouting" during the ERM Conference. Andréia looks forward to the RIMS ERM Conference 2026.

[6:09] Andréia shares an overview of her career. She started at O.R.X., an operational risk data exchange association, where she learned all the principles of risk management. It gave her a strong background in operational risk.

[6:36] From there, she went to London to go into a second-line risk management function as an analyst at a wealth management investment firm, then she went to a small investment bank, then to another wealth management firm, and now, to the London Metal Exchange.

[7:00] They were all analyst roles, primarily operational risk, but also enterprise risk management. Risk has been part of her life for the last 10 years. The foundation was set by O.R.X. She holds the company close to her heart.

[7:28] Andréia loves data. It's incredibly important for driving analysis. She says any analyst who doesn't love data is not an analyst! Data structure and data quality are very important for risk analysis, or any analysis. You need to love data to be able to do good risk management.

[8:13] Andréia says that working in different organizations is important for risk management. It helps you connect the dots between the components of a risk management framework.

[8:28] When Andréia started at O.R.X., she understood all the components, but she didn't join the dots until she went into the industry, hands-on, in the deep end, trying to figure out an RCSA, a KRI, or a KPI. Then, all the components of risk management started to make a bit more sense.

[8:53] Andréia has always been fortunate to have worked with several exceptional leaders, each of whom had a kind of superpower in risk management that influenced her approach and understanding of risk.

[9:07] Andréia's first manager at O.R.X. was tough and meticulous. She had a deep understanding of corporate governance and the boundaries between the risk types: strategic, financial, and non-financial.

[9:22] At the time, Andréia didn't really appreciate how valuable the discipline was. She didn't understand yet. In hindsight, it gave her a strong foundation. Another CRO she worked with taught her the importance of communication in risk.

[9:46] Aside from his technical ability, he understood stakeholder management at every level of the organization and how to translate the risk concepts for different audiences and build alignment.

[10:00] Then she had a head of risk who was incredible with data, with an exceptional ability to quantify risk using analytics and evidence. Having a science degree, numbers were not Andréia's strongest area, but working with someone who pushed her helped her to become stronger.

[10:25] Andréia thinks that working in risk in different organizations can help you build those thoughts.

[10:32] Andréia has a Bachelor of Science degree in biology from the University of Bath in England. She's happy she decided not to pursue biology and took the risk road, instead.

[10:55] Justin tells of recently having Kellee Ann Richards-St. Clair on the show. She's on the RIMS Strategic and Enterprise Risk Management Council. Kellee Ann started in Chemistry.l She moved into Energy and Power and became the de facto ERM Manager for her organization.

[11:15] Kellee Ann and Andréia channelled other areas of knowledge to apply them to risk. For Andréia, the statistical side of biology has been helpful in risk management. James Lam states in his CRO Certificate program that risk is probability and statistics. Risk management isn't easy.

[12:19] Andréia believes that legacy tools and practices fall short when they are disconnected from the organization's purpose, vision, mission, and strategic objectives. GRC systems have different modules: an RCSA module, a budding issue module, and an incident module.

[12:49] Andréia hasn't seen a system that can connect the dots well. Risk practitioners don't always know how to connect the dots, either. An RCSA becomes isolated from the risk itself because people don't understand the context of those risks.

[13:17] Working with business senior leaders to understand the context of your organization will help you to provide more valuable use of those tools and practices.

[13:32] Andréia explains RCSA. It stands for Risk and Control Self-Assessment. It's a thought process. You sit down to understand what's most important to you, how much you care about it, and what you have in place to protect what's most important to you.

[13:55] Andréia says the way we try to document that thought process is quite heavy. The industry requires that process to be complicated. Andréia recommends simplifying it.

[14:20] To simplify it, have a process that's more sensible. The industry requires you to do assessments for inherent risk and residual risk. First, determine if a risk is important to you. If it's not important, why are you assessing it?

[15:09] Andréia thinks the industry makes it difficult by requiring organizations to assess risks in a certain way, when it doesn't actually make sense. Managers have to have the courage to say it doesn't make sense for the organization, let's try a simpler approach.

[15:34] Andréia uses screens, but sometimes pen and paper will do. Having that brainstorming session with the business really helps in trying to understand the purpose of what you do for your organization and where you fit in the strategic purpose of the firm.

[15:51] What is most important to you, as opposed to thinking of everything that could go wrong? Risk is not only about negative outcomes but also about opportunities.

[16:09] Quick Break! RISKWORLD 2026 will be held from May 3rd through the 6th in Philadelphia, Pennsylvania. RISKWORLD attracts more than 10,000 risk professionals from across the globe. It's time to Connect, Cultivate, and Collaborate with them. Booth sales are open now!

[16:31] General registration and speaker registration are also open right now! Marketplace and Hospitality badges will be available starting on March 3rd. Links are in this episode's show notes.

[16:44] Let's conclude our Interview with Andréia Stephenson!

[17:14] Beyond documenting risk, Andréia thinks a risk analyst can shape an organization's risk-aware culture by asking questions. The quality of the questions they ask helps drive culture.

[17:31] When an analyst consistently probes assumptions, highlights all the inconsistencies they find, or asks what this means in practice, that behavior encourages others to think more critically about risk and about what they are doing.

[17:50] Good questions change behaviors. They prompt people to pause and reflect rather than to operate in autopilot, which we all sometimes do.

[18:04] Andréia says analysts can contribute by making risk information simpler, clearer, and more accessible, looking for ways to simplify their reports and focusing on the most important things, day-to-day, for their objectives, and having a less bureaucratic process.

[18:41] Andréia suggests having the courage to speak up when processes don't make sense in the second line of defense to help as much as possible the first line.

[18:51] Risk analysts can influence and change behavior by building truthful and meaningful relationships with people, caring about the business, listening to the business units, taking their feedback to heart, and helping them to change the difficulties they encounter in risk.

[19:19] Andréia works in the second line of defense. She works with a lot of first-line business units. For them, it's a burden when the risk team, the CRO, or the processes change. The risk analyst needs to help them minimize that burden. It's important to be conscious of that.

[19:57] Andréia says when she goes into a new organization, the first thing she does is to understand the current state. What risk practices do they have? How do they operate? After a month, she has figured out how the organization is and how they make decisions.

[20:17] When she has a suggestion, Andréia puts herself on the line for it. More often than not, it has worked out positively because she had good managers who could listen to her ideas for improvement.

[20:41] If something doesn't make sense, you have to be true to yourself and say this process is lengthy, or this document is enormous; let's try to simplify it. Never be afraid of providing views for improvements, so long as you have one and have thought about it.

[21:16] Andréia believes in passion for what you do. You need to be passionate, and if you're not, find your passion. For Andréia, it has always been to be a professional analyst and risk professional. That passion, in turn, drives your curiosity.

[21:40] Look for ways to improve and learn. Working hard is really important, even with AI. Working hard drives good results. Data literacy is very important. Understand the basic principles of data and the basic tools that allow you to do data analysis.

[22:04] Think, pause, and reflect. What does that data mean? What do those patterns mean?

[22:10] Andréia stresses communication. She says she's still working on her communication skills. She is very direct at work. Sometimes that directness can seem abrupt. If something doesn't make any sense, she will put her hand up and say, This doesn't make any sense!

[22:41] Having the soft skill to be able to communicate at all levels of the organization is important. That will set an analyst apart.

[23:33] Andréia says AI is everywhere. She uses AI all the time for work and for her personal life. In her experience, AI is most powerful as a sounding board, a thought partner, and a colleague. It helps you explore ideas, structure problems, and challenge assumptions.

[24:07] The analyst is the one who provides context and judgment. AI can help you generate lots of possibilities, but it can't decide what makes sense for your organization or for you. A critical mindset is very important.

[24:25] Analysts need to treat AI as an extension of their thinking process, not as a replacement for it. You are the Quality Control. You are always the one accountable for the output. AI doesn't understand your business, your culture, or your strategic priorities, but you do.

[24:48] There's always the risk that if you rely on AI without applying your own insight, the output will sound sort of right but not add any value. It may be technically correct, but contextually useless.

[25:12] If analysts don't know how to extract, refine, and apply what the tool gives them, it won't move the needle in a meaningful way.

[25:21] Analysts should work in different places, understand what a good framework is, get certifications, work with risk professionals, work to think about problems you haven't come across before, use critical thinking, and use AI to help perform the mechanical parts of your job.

[25:51] Always rely on your judgment, your relationships, and your understanding of the business you are in.

[26:04] Justin shares that philosophy. He uses AI as a sounding board, to help him if he's stuck on an idea, to help him expand it. If he likes it, he'll go with it. He takes the output as a template and refines it.

[26:31] Andréia says it's almost like having an assistant. If it gives you something different than what you asked for, you can restate your question.

[26:41] Justin's daughter is getting into advanced math in middle school. He doesn't remember a lot of it. He's asked ChatGPT to help him come up with math questions for his daughter. It has been invaluable for that.

[27:20] Andréia uses it for formulas in Excel. She says, You still have to know what you want. You can prompt it to help you remember how to do something. Justin says you need the foundational knowledge.

[27:45] Andréia says foundational knowledge is what will set people apart in their profession, whatever profession it is. She would much rather know what she knows than have AI do something and not feel comfortable with it. The foundation is really important.

[28:08] Special thanks again to Andréia Stephenson for joining us here on RIMScast! Keep an eye out for her on LinkedIn in those super cool CRO Certificate Program promotional videos.

[28:21] Remember, we have two more cohorts coming up, one in January and one in April. Links are in this episode's show notes.

[28:29] Plug Time! You can sponsor a RIMScast episode for this, our weekly show, or a dedicated episode. Links to sponsored episodes are in the show notes.

[28:57] RIMScast has a global audience of risk and insurance professionals, legal professionals, students, business leaders, C-Suite executives, and more. Let's collaborate and help you reach them! Contact pd@rims.org for more information.

[29:15] Become a RIMS member and get access to the tools, thought leadership, and network you need to succeed. Visit RIMS.org/membership or email membershipdept@RIMS.org for more information.

[29:33] Risk Knowledge is the RIMS searchable content library that provides relevant information for today's risk professionals. Materials include RIMS executive reports, survey findings, contributed articles, industry research, benchmarking data, and more.

[29:49] For the best reporting on the profession of risk management, read Risk Management Magazine at RMMagazine.com. It is written and published by the best minds in risk management.

[30:03] Justin Smulison is the Business Content Manager at RIMS. Please remember to subscribe to RIMScast on your favorite podcasting app. You can email us at Content@RIMS.org.

[30:15] Practice good risk management, stay safe, and thank you again for your continuous support!

Links:

RIMS-CRO Certificate Program In Advanced Enterprise Risk Management | Jan‒March 2026 Cohort | Led by James Lam

RIMS-Certified Risk Management Professional (RIMS-CRMP)

RISKWORLD 2026 Registration — Open for exhibitors, members, and non-members!

Reserve your booth at RISKWORLD 2026!

The Strategic and Enterprise Risk Center

RIMS Diversity Equity Inclusion Council

RIMS Risk Management magazine | Contribute

RIMS ERM Special Edition 2025

RIMS Now

RISK PAC | RIMS Advocacy | RIMS Legislative Summit SAVE THE DATE — March 18‒19, 2026