Risk Management, Leadership & Organisational Resilience with Frédéric Gielen

Speaker A: M hello and welcome back. Today's guest is Frederic Gillen, executive partner at Reply. Frederic has spent more than three decades at the intersection of risk regulation, transformation and financial stability. From his earlier career at RT Anderson and Erstin Young to leading financial sector assessments and the World bank group to building and scaling Advantage Reply across Europe. His vantage point spans regulators, ports and large scale transformation programs. What makes conversation particularly valuable is perspective. Friedrich doesn't sit inside one institution, he works across many. That cross organization lens reveals patterns leaders rarely see from within. In this episode, uh, we explore organization resilience not as a framework, but as a lived reality under pressure. We examine where governance looks strong yet fails, how escalation distort truth, and why small behavior shifts often precede major breakdowns. If you enjoy this conversation, please follow, review and share Riskmasters. For more insights and resources, visit AVTM.com I'm Julien A. And this is Riskmasters. Today it's my pleasure to welcome Frederic Gillen. Um, Frederic, welcome. On the show I think we are going to talk a lot about resilience and uh, your experience around consultancy.

Speaker B: Thank you very much Frankie for having me.

Speaker A: You worked across quite a number of global institutions. You advised regulators, uh, clearly now you oversee a large consultancy as well across several European markets. Ah, and you've probably, I've seen quite a lot of themes that most executive will only experience perhaps once, if at all, in their career. And so uh, it's the opportunity for us to come back into that helicopter view you benefit from that most people don't have. Uh, and with that, the first question I will have for you is what does advantage point reveal about resilience that uh, leaders inside organization often miss?

Speaker B: I think, I think what you get um, from that vantage point is um, pattern, pattern recognition and that, that really changes everything. And I think you probably derived from that three insights. If you look at organizations across the board. The first insight is that resilience is rarely lost in a dramatic decision. It erodes through mostly rational trade offs. So each choice makes sense locally. Uh, you may decide that you want to accelerate the onboarding. Uh, you rely on vendor attestations, you defer a core system replacement. No single decision is reckless. But collectively the perimeter of what the organization actually controls quietly shrinks. So the first, uh, insight is that it's not a dramatic decision that causes the resilience to erode. The second insight in terms of pattern is about um, the ecosystem. And I think when you look at cross firms, you see that most organizations underestimate how much of Their operational reality sits outside of their formal parameter. Um, one of my colleagues in Avantage published recently a piece on do you still have the keys to your own house? And I think that's certainly the second point, that if I look cross industry, uh, that comes to mind. The third one is that frankly, um, leaders, I included, um, inside organizations will tend to overestimate the protective value of frameworks. We have policies, we have committees, we have dashboards. All of this creates a feeling of, um, preparedness. But resilience is not the presence of documentation, is it? It is the behavior of the system under stress. Uh, what the vantage point reveals is that resilience is not really a technical problem, it's a design choice. It's about how much redundancy and transparency you are willing to tolerate before stress forces the issue. And I think in a single organization, if you're a leader in one organization, you really get to observe this in comparative form. So, long winded answer. But,

Speaker A: but fundamentally three core insights that have a, uh, really strong impact on strategy and organizational design, don't they? And I think we're going to explore that further as we go. Uh, and so when you think about it, where do early signs of fragility get normalized rather than challenged? Right. Where do they disappear? In a way it becomes, well actually we are within the parameters you mentioned. So everything is fine.

Speaker B: Probably in the space between, uh, temporary and acceptable. Uh, you start with a control, exception, uh, trade off, um, and that quietly becomes the new normal. And that's what's striking, uh, from a cross firm point of view, you

Speaker A: no

Speaker B: one believes that they are lowering the standards. They believe they are being pragmatic. And again back to my first point. Each decision in itself is rational. It's just the accumulation of all of that that creates the fragility that you don't see under normal circumstances, but you can feel it pretty badly under stress.

Speaker A: Yeah, it's again, uh, and it kind of aligns as well into what I'm observing as well across organizations. Um, and I'd like to explore that a little bit further to see if they are salient points from what you've observed that drives that pattern quite systematically. Let's come back to that. And across jurisdiction and regulatory environments. Uh, do failure pattern, um, look different on the surface, yet similar underneath? Do you see any nuances there? In a way they actually uh, permeate.

Speaker B: That's an interesting question. I think on the surface things are very different. I mean each in one jurisdiction. It might be, um, the trigger might be Capital misallocation. In another, it can be a cyber incident. So yes, there are variations of, on the surface of it, but if you look underneath, the structural patterns are very similar. Even if you think about COVID we typically are exposed due to the same vulnerabilities and concentration risk, fragmented accountability, um, and overconfidence built on past stability are we, we served, you know, we survived a crisis, we did dwell in a crisis. And we tend as organizations to build a level of overconfidence. Uh, you know, nothing can happen to us. So I think for me, under the surface, the same vulnerabilities are there. Concentration risk, definitely fragmented accountability, that works well under normal conditions, but again, doesn't work at all under and overconfidence.

Speaker A: And you might have answered partly, at least the next question. But what do leaders consistently believe about their organization's resilience? That really doesn't hold true under stress, so it disappears.

Speaker B: I think two things, probably more. But two things come to mind. First, that documented capability equals operational capability. And you and I have seen data, we've seen institutions that walk into a crisis with a beautifully documented recovery, uh, plan, or BCP, and then they spend the first 24 hours debating who has the authority to invoke it. Ah, there is a fundamental gap between the documentation and the implementation. And the second believe that collapses. Um, is that escalation functions, um, as designed on paper. If you look at most frameworks, um, and documentation about, you know, that deal with resilience, things are linear, they are timely. But under stress, it doesn't happen like that. Information slows, accountability becomes cautious. Um, stress doesn't test policies, stress tests behaviors. And I think that's. These are two things that do not hold under stress. And I think we simply don't have. For most leaders, we're just not exposed to that enough. And therefore we tend to underestimate those two issues.

Speaker A: I think it makes me think of two things. One, I actually had added at your office, uh, a remarkable presentation by ADAB Banks, uh, the former city of Merckx. Right. And I will invite, and I've been inviting people ever since to actually really read about the Merck situation because for me it's a perfect example of what you just outlined and how everything disappears in front of you. In fact, you can't even access your policy anymore because your network is not here anymore. Uh, and, uh, uh, one test I've done on that is as I presented to conferences on resilience, especially a couple of years ago, just after, uh, the presentation at your office I asked the audience how many of them had prepared for such scenario and there were about 80 to 90 organizations represented. So it was quite a fair, a big pool of financial services. The answer was none, not a single one. Ah. And when I ask why, to the audience people say, yeah, but it's difficult to convince people that's going to happen to us. And when you remind them that Merck spent hundreds of millions, if not billions every year in technology and really had very advanced setup, it still doesn't. I think it comes back to that overconfidence point. They don't see why it will happen to them and then immediately they try to rationalize away from the problem.

Speaker B: Very true. And I, uh, spent most of my time in financial services a little bit outside. And I have to say I think that as an industry we can learn from others in that regard. We're certainly not leading the pack when it comes to those issues.

Speaker A: Well, I see consultancy as well, by the way. Interestingly enough, I've seen consultancy coming and asking about how can we get ready to that and run scenarios around it. So it's very true, very true. I think it applies everywhere practically. Um, and as we're talking about behaviors, which leadership behaviors look strong and stable in, uh, stable periods. Right. They can really become a liability, uh, during a disruption.

Speaker B: I'm going to be a bit contentious here.

Speaker A: Go for it.

Speaker B: I think paradoxically, um, decisiveness, it's a contentious point. Um, why under normal circumstances, in a stable environment, decisiveness without dissent is admired. You do things at pace during disruption. The risk is that it suppresses exactly the weak signals that you need the most to hear. So I would call that one out. But I know that there will be people out there who probably disagree with me and might have a point.

Speaker A: Well, actually I touching on that, on my future book, sir, and I completely agree with you in that point because it kills psychological safety and prevent the organization from seeing exactly what you just said, which are, uh, weak signal. That is usually the start of a much bigger problem. Um, but it's a balance, it's a balancing act, isn't it? You need to make decisions.

Speaker B: It's not binary, of course, of course,

Speaker A: um, and we have good intentions around empowerment and accountability breakdown in practice. So where do you see issues there? Trying to do the right thing but doesn't work, Maybe

Speaker B: at the crossroads or intersection between authority, um, incentives and this is where the problem lies, personal risk. So you have a lot of organizations, um, where the leadership says you are empowered, but when the stakes are high, the Protection around decision making becomes less clear. And this creates two, certainly from what I've observed, two opposite distortions. Some people then tend to over escalate because there is too much personal downside of being wrong. Um, and then other tend to under escalate. They stay silent because raising a concern could feel reputationally, um, risky if it turns out to be inconvenient or premature. And I think what I'm observing is that both behaviors come from the same, um, root cause. And that's why I'm talking about personal risk. I think a lot of people in organizations, in financial institutions, in particular post crisis, calibrate to consequences, personal consequences and not slogans. So good intentions around empowerment, uh, and accountability. But in crisis, unless you fix that risk, I think you could end up with over and under escalation exactly where you don't want to be.

Speaker A: And just building on that because it makes me think of the regulatory framework. Right. And SSMCR in the UK is an example of that. Uh, how much do you think those type of framework play into what you just outlined? Do you have a view on that?

Speaker B: Uh, very much. I think, uh, the more. Very much. And I would illustrate that by the fact that you see a lot less problems of that nature in less regulated environment. So I think the regulation can distort that balance and lead to, um, and that's obviously kind of, you know, that's not the intent, but that's an unintended consequence of regulation and compliance thinking. Um, it can lead people a lot more in my view, to behave with that personal risk in mind. That's not the intent of the regulator, that's for sure. Uh, that's why I believe it's an unintended consequence. And there's quite a lot of good research around that around risk culture at the moment. I think post crisis, since we are, there is a lot more research in that space. A lot more. Um, and that's a, I think that's better taken into account by regulators and policymakers now than perhaps 15 years ago, but that that will still have to evolve.

Speaker A: I suspect that we see Probably SMCR version 1, 2 and 3 and probably same with others as well. Correct.

Speaker B: But assume, I think it would be also useful for us to look at other industries, aviation. I appreciate there was a lot of bad press with what happened in that industry in recent months, but there are other industries that I think have tackled that issue better than financial services and they have not tackled it through regulation, by the way.

Speaker A: Yeah, um, uh, there's uh, been lots of examples on the next question. So let's see what you think about it. But when transformation programs promise agility and simplification, where does friction usually reemerge? So why is that not delivering on expectation?

Speaker B: You know that I run a consultancy and you expect. But it's a fair question. It is a fair question and I think in one word, at interfaces, um, it can be an interface between legacy and new systems, between central governance and decentralized execution, uh, between first and second line ownership. For example, you have a new operating model. I mean lots of clients are trying to enhance their operating models. So implement a new operating model but you don't quite finish it. And uh, the underlying data architecture, for example, remains fragmented. Well, it's wrong to believe that friction disappears. Friction actually relocates and usually it relocates exactly where you don't want it to be. So that's what I'm saying at the interfaces. And unfortunately in a lot of transformation programs we uh, end up with a relocation of friction as opposed to a, um, reduction or mitigation of friction.

Speaker A: That's a very interesting insight and I think it makes me think of one thing I've observed comparing my experience working uh, for European banks. And ever since I moved in the UK 18 years ago, um, and what strikes me here is that notion that I've never seen a program actually finished here ever since I moved here. Because every single time a program finishes when some sort of MVP so minimum viable product is delivered seems to work and then for some reason the full program is never finished because there might be better ways of using the resources. But invariably what I've observed is the mvp, uh, delivers some enhanced functionality, but also it creates new friction as well. Why? Because it's not a finished product?

Speaker B: Yeah, I would not say that it's only in the uk. I certainly have seen that in the States as well and in continental Europe. Um, I agree with you. However, addressing this in a successful way is a lot more complicated than uh, one might think. And certainly, um, it requires a lot of effort and exceptional leadership on the part of the bank or the insurance company or the asset manager to carry that through, um, the last 20, 20 meters in this hundred, you know, if it's a marathon, let's say the last kilometer in the marathon or the last mile is the hardest one. Um, and we tend not to cross the finish line in most programs. I have to agree with that.

Speaker A: Um, and yeah, and it creates so many problems in my experience, but uh, as you say, not easy to sort out. And uh, from your experience across Financial institutions. And you probably touched on already on that. So I'd like to dig a little bit more. What cultural signals matter most for resilience yet remain least visible to senior leaders? Ah, so you were talking about suppressing those early signals. For example, earlier I would call out two.

Speaker B: Um, they're probably a lot more. The, the first one I would call out is, um, how bad news feels in the room. And I'm not talking about things that are very important, but that's not what I'm talking about here. I'm not talking about a whistleblowing policy. Uh, I'm not talking about whether a formal speak up channel exists, but I'm talking about whether raising an uncomfortable issue increases or decreases someone's perceived status in the organization. So it's a lot more subtle than a policy. And I think that's something that leaders don't really get to see. Another visible or invisible signal, um, and I know you've dealt a lot of that in your career, is how near misses are treated in some organizations. Only, um, realized losses trigger attention. Um, essentially the organization learns to wait for certain. I think a good organization, a resilient culture, elevates weak signals that we were talking about before they mature into events. And the paradox is perhaps there that the healthiest cultures are, uh, probably, or they feel slightly uncomfortable. Um, there is constructive friction. That's what I think you will find in resilient culture. Silence, by contrast, feels smooth. It's not conducive to resilience. So I would say bad news and near misses would be two things I would be looking for. Not a comprehensive list.

Speaker A: Ah, and just building on that and thinking about how it bubbles up. Right. Where do escalation pathways more often distort, delay or dilute critical information?

Speaker B: I'm not going to make friends with that one. Um, in my view, in the middle, typically in the middle. So not at the front line where issues are first detected. Uh, and not at the very top where in my experience, leaders are often genuinely receptive once something reaches them. I've rarely seen a member of a management board saying, I don't want to hear about that, you know, but the distortion happens in my view, in middle management layers. Um, and the research, the risk culture research in particular captures that quite well. Um, we were talking about compliance heavy cultures a moment ago. I think what you would find in the research is that these cultures create a subtle but a powerful incentive to smooth information upward rather than sharpen it. In other words, the signal gets managed before it travels and there Is a deeper dynamic perhaps there, that people don't want to raise something unresolved in front of a broad audience. In particular in culture that are, uh, where consensus is the dominant mode. So they wait, they refine, um, and they present something polished rather than something urgent. And unfortunately, by the time a risk reaches, um, senior leadership, it's been stabilized. Um, the urgency has been edited out, if you will. The slides are tidy. Uh, it sometimes astonishes me when to see beautiful slides dealing with a real crisis issue. I mean, why did we take all that time to prepare the slides? I want to hear about it, I want to manage it. In my view, timely is more important than ISO accurate, if you will, if you know what I mean.

Speaker A: Yeah.

Speaker B: Um, and maybe one last word on that. I'm definitely not suggesting that the editing process is malicious. Not at all. Uh, um, it's more protective behavior. Um, it's protective behavior in a system, in an institution that favors stability, uh, over candor. Um, and I think we see a lot of that. And I believe it is unintended. I really believe that.

Speaker A: I also think. And I completely. And I observe the same. Right. And I completely agree, firstly, ethnolocation. But if I add to what I'm also observing and things I've been exploring as well, is there is a disconnect between, I would say the roles and responsibilities in the middle and their role into what you just outlined as well. And the resources they have. Because practically the decision typically that leads to the situation is not made by that layer. It's made somewhere else, usually higher up.

Speaker B: Yeah, they end up with the problems

Speaker A: that they have and they don't have the resources to fix it either. Because the resource allocation is not done at level either. And that's something I've seen a lot, uh, uh, in my former life, uh, in risk management, where we had very nice, for example, risk ownership metrics matrices. Right. With lots of names in there. So practically you could see all the rights, status, control with the issues, et cetera, where they were and which department and who was supposed to own them. But regardless of who you were talking to, except at the top, everybody was telling you the same thing, which is, we understand the problem. Um, we have no resource to fix it.

Speaker B: Yeah, very true. That is true. That's a typical pattern.

Speaker A: Uh, and so you end up in that disconnect where people were like, well, now we are going to manage it out, because otherwise people are flagging back to us saying, what are you doing to fix it? Realistically, we can't do Anything about them, never mind they didn't make the decision that leads to that problem in the first place. So there is a problem of governance and decision making and resource allocation in addition to that. That explained at least partly in my view, why the mid layer is effectively in a very uncomfortable seat practically.

Speaker B: Very much so. Very much.

Speaker A: Um, and you mentioned silence, right? So what patterns do you observe around silence? You also mentioned overconfidence. So let's go there. Overconfidence or consensus that leaders rarely acknowledge.

Speaker B: I'm going to answer very shortly to that one. Uh, what are the most dangerous rules? So if I go into, um, if I'm the chief risk officer of an institution, what I don't want is, um, a room where everyone sounds confident and no one sounds unsure, uncertain. That to me is a dangerous room where there is consensus and uh, where nobody says, I don't know or I'm not sure that's consensus, overconfidence, and essentially a room where everybody agrees and nobody dares to say, I don't get it. That worries me a lot.

Speaker A: And I think it's a perfect segue to the next question then, right? Uh, where do governance structures appear mature? Because I suppose that will translate into what you just said on paper, yet fracture under real stress. So you move from everybody's inconsistencies to everybody screaming at each other practically.

Speaker B: Yeah, we talked about that right at the beginning, didn't we? You can have a perfect governance structure, very mature on paper, and that gets praised by regulators and supervisors, you know, clear charters, escalation matrices, the tree lines beautifully, ah, articulated, et cetera. And under normal conditions, that distributed framework works very well under stress. It can lead, um, to lack of accountability or worse, sequential decision making so slow things down. Um, I think that's one thing that I would be worried about when I look at the impact of mature governance frameworks from a resilience point of view. But I see, and that's in a particular segment of the industry, another fractured point, a weak link. Um, and you will be very familiar with it, we have a lot of large, uh, financial institutions, global or regional at least, where you have cross entity governance, that's the way they are run. But you also have legal entity governance. And certainly what I observe is that when stress hits, um, the legal architecture, so this legal entity governance and the operational architecture, so the group governance do not align. And this issue is compounded by the fact that supervisors are, with a few exceptions, very much focused on the legal architecture as opposed to the group architecture. I see a Lot of friction there. We've seen it in the crisis. We see a lot of emphasis in particular by the European Central bank. Um, on that topic. It remains a big question mark to me in terms of firms behave differently under normal circumstances and under stress. Uh, and I think we still haven't resolved this

Speaker A: and I can see many problems in a risk space around that. In fact, I was talking about risk appetite this week precisely around this topic where I was asking the person, how is the decision making process for certain function and how does it align cross functionally versus legal entity structure? And there is a very clear disconnect where the risk function tends to push a bit for, you know, that legal alignment as you just talked about. But this is not how decisions are being made and functions are being run.

Speaker B: Yes. And I think even more to the point, uh, perhaps sometimes you're in a much better position to manage risks on a global level than on a legal, uh, entity level. So the sheer quality of your risk management and therefore, um, the way you mitigate the risk of having a resilience problem can be uh, dampened by the fact that you have to focus a bit more on the legal entity, uh, architecture than you would otherwise do due to regulatory, legal, supervisory constraints. Totally understand the regulators and supervisors. I mean they've been burned during the crisis. You can't blame them for, for, for that. But I, I think as an industry we must be able to do better. This is an area where as an industry, stakeholders need to find a way to improve because we are so suboptimal in the way we do things today in that regard.

Speaker A: Yeah, very true. I mean all the organization I worked with are for, uh, they're overly complex compared to what they're doing. And uh, I'm not saying complicated by the way, because they are, they are overly complex which drive that level of uncertainty and they multiply the problems behind. And uh, as we're talking about governance effectiveness. Right. Let's dive a little bit more on the oversight function there. Uh, what forms of oversight Unintentionally slow adaptation and suppress early warning signals. And risk is very prone to that in my experience. Compliance as well, by the way.

Speaker B: I think it's a difficult one, Julia, that one, I think perhaps oversight that um, is primarily, um, retrospective. We see a lot of that in particular due to the regulatory burden imposed on oversight functions. And a lot of them tend to look in the rearview mirror. Um, I think that what I'm missing sometimes is oversight. Uh, that creates safety for early ambiguity. Um, it treats oversight that Treats a team that surfaces an unresolved concern adequately, positively and is not looking for certainty. In particular because you have a lot of oversight functions, very experienced people, and it can be executives or non executives, depending on where the oversight is placed. Um, I think we are missing a little bit of that foresight in the oversight or helping with the foresight. But that is a difficult question that you're asking there, probably one that deserves further analysis.

Speaker A: Uh, but I think the example you gave is exactly right. And now if I take a concrete become frameworky for a second. Uh, many risk event frameworks for example, have a tendency to do the opposite of what you just outlined. That would be best practice. Uh, and that's an example for me that drives the exact opposite of what you will want as an organization. Now it's not intended, it's not why it's being done, it's simply the way it's being designed. And because everybody seems to be doing the same thing as a result, you find the same problem in multiple places.

Speaker B: Yeah, I agree.

Speaker A: Um, and as organizations digitize and pursue innovation, where do governance structures struggle to keep pace?

Speaker B: That is a very, very good question. It's one where I don't have the answer. Um, I'm trying to understand that better at the moment. But it's still an evolving, I'm still trying to evolve my thinking around that. I would say it's with speed and with opacity. Yeah, I'll explain what I mean by opacity because I think um, it's a bit more specific than that. Probably not the right word in English. Speed. That's quite obvious. Um, you know, digital ecosystems evolve at a pace that is completely not aligned with the pace of our governance fora. So if you think of uh, I don't know, a cloud configuration, it evolves a lot and rapidly and it has a significant impact on resilience and things like that. And we have a, we have review cycles that are a lot slower than in uh, typical governance arrangements that the pace at which digital ecosystems evolve. So speed I think is one that I will, that we need to address. Opacity is. This is where I was thinking maybe that's not the right word. It's something that has to do with the explainability tension. So governance arrangements that we have in the industry, um, they assume traceable causality. That's typically what we are trying to evaluate in most governance for. But if you think about some of the more recent digital evolutions, in particular generative AI that we had to mention today, a traceable causality. It's not really, uh, obvious. So I think there is a bit of a tension between the more recent, uh, evolutions from the technology point of view. I've used generative AI, but I could use also SaaS, uh, solutions. Because opacity when it comes to those solutions is sometimes an issue. Opacity, I, uh, put all of that under that term, um, is an issue that our current governance for, uh, um is really struggling to address in my view. These are two. But evolving thinking and maybe the topic for yet another book by yourself later on.

Speaker A: Um, and here I'd like to move a little bit into more m. Some of the patterns we're seeing, uh, in resilience and sometimes the asymmetry and impact of certain small event that triggers massive repercussions later on. Um, so when you think about that, which model, if you have a view on that, right, which mode and early failures tend to create disproportionately large consequences later, if not dealt with in time.

Speaker B: Perhaps just one example without hesitation. Ambiguity. Um, it can be ambiguity in ownership, in data lineage, in an exit strategy for a critical third party. They always look minor at first. And I think you've hit the nail on the head with the first part of your question. Um, you have a process, it spans different functions. No one really owns it. Uh, you have a data set, it feeds multiple reports. No one owns the reconciliation. Um, you have a critical vendor. Uh, but the exit testing has never been operationalized understable conditions, none of that will trigger an alarm bell. Individual elements, et cetera. But ambiguity, ambiguity in order, shape and data that compounds. And when stress hits, uh, um, these small structural vagueness, they become very large systemic issues. And the more tightly coupled the systems, the more these, uh, design flows at the end of the day, the more they scale. But they don't scale linearly. They scale exponentially. Or yeah, let's say exponentially for argument's sake. So I think in my view, ambiguity is the root cause of a lot of issues in large organizations, in particular, um, organizations that have been around for a long time.

Speaker A: And uh, if I build a little bit on that, when regulatory change accelerates, for example, if I focus on regulation, because we talked about it before, what asymmetries do leaders underestimate the most?

Speaker B: I think they focus too much on, um, cost and deadlines and underestimate, um, capacity. In my experience, organizations run out of capacity before they run out of budget. And that's the asymmetry. I think regulatory speed can outpace the ability of the organization to absorb the change. And that has in my view little to do. Not nothing but little to do with cost and uh, with deadlines.

Speaker A: You say capacity and skills. What I've seen many times is the organization not having the skill set to drive the particular topic in uh, scope of that regulation for example. It can be a real challenge.

Speaker B: Yes, or might have it and typically has it in particular large firms. But regulatory change tends to always come and hit the same people in the organization.

Speaker A: Yeah, that's very true.

Speaker B: You're back to things like uh, the goal by Gold Rat, et cetera. The theory of constraints. You have a number of constraints in the organization and you can throw all the money in the world at it. Um, you just don't have the capacity within a short time frame. Obviously you can always deal with it if you had more time to handle it, to manage it. And uh, that's something that I see a lot and as a consultancy, not going to be very commercial here. Sometimes clients say well add more people, do this, do that. In a lot of instances it's not the solution. You need the organization to be able to absorb the external help. Um, or it's going to be throwing money out of the window for nothing. So capacity is in my view very important and sometimes not. It's not that it's not taken into account but it's not, it's, it's, it's not always the key um, element that people focus on and I think they should focus on that a bit more.

Speaker A: So uh, a thought for you which we'll not explore today because we don't have the time. Check the risk appetite framework of all the firms you work with and assuming they have a section on risk capacity to start with, which is already a big if because not all of them do check if they listed capacity in a way you just outlined beyond just financial uh, risk bearing capacity and all those things. From what I've seen they never do.

Speaker B: Very few, very few. That's very true.

Speaker A: Uh, and that's telling.

Speaker B: It's a very interesting, there is a very interesting paper by the ECB actually on, I think it was on BCBS239 regulator, uh, included in their paper in their expectations. One last point at the end saying one of the things we expect from new management board is to evaluate your capacity to absorb all that change, etc. I was very pleased to read that. I felt that's spot on.

Speaker A: Ah, it's again a topic for another book asic, perhaps yours. Um, so now I'd like To draw the conclusion to a close and stay uh, focused perhaps on one point for each of the last three questions. What is the hardest truth about resilience that leaders are least willing to hear? I know them. Go for it.

Speaker B: Um, that resilience competes with success. So you know leaders. I don't think any leader would reject resilience explicitly. They value it intellectually. You can talk about it. You can talk about the Challenger incident, you can talk about Fukuyama people. People will engage, definitely. But the harder truth is that in moments of trade off, resilience consistently loses to growth, to speed, to efficiency and to short term performance. So for me it's the uncomfortable truth, um, is that if your incentives do not protect resilience during periods of success, um, nothing will save you during periods of stress.

Speaker A: And perhaps you've answered the next one. But if leaders address just one recurring pattern, you observe what will make the biggest difference?

Speaker B: I will answer that a little bit differently. I think my comment on the uncomfortable proof is more to make sure that boards incentivize leaders to take resilience into account and that indeed boards are themselves. But in terms of leaders themselves within their own organizations. If there's one thing that a leader in an organization can do is to protect the integrity of escalation. If they fix that, many other issues become solvable because they will hear about those weak signals that we've talked about. No.

Speaker A: Excellent advice. And finally, looking ahead, how do you see the definition of resilience evolving over the next decade?

Speaker B: Over the next decade I hope it will become less of a control function. So I, uh, know I'm not answering to the definition, but at the moment it's still very much perceived as a control thing. I think if it becomes a leadership, um, thing capability, perhaps, um, that as an industry will have made a lot of progress. We need to elevate resilience to the same level as financial performance. Essentially, I equate it with the sustainability of your financial performance, the sustainability of the quality of the services you provide to your clients, et cetera. It's a leadership capability. And at the moment it still feel too much like a control function, a regulatory requirement. So it's more about the evolution of the perception than the definition itself that uh, I would focus.

Speaker A: Well, look, it's still uh, extremely valuable insight. So thank you so much for that. Freddy. Thank you very much for your time. It was very insightful discussion, lot to think about and provocation as well, which we love. So thank you so much for that. And we looking forward to seeing you again on the show.

Speaker B: Likewise.

Speaker A: Thank you. That was my conversation with Frederic Guilen. Perhaps the real question is not whether organizations understand resilience, it is whether they are structurally designed to prioritize it. When it competes with growth speed or performance, resilience is rarely rejected. It is traded away when tradeoffs feel justified. If you found this episode valuable, please follow review and share with Masters. For show notes, resources and our guest preparation guide, please visit idcub.com stay curious, stay reflective and join us next time as we continue explaining exploring the reality of risk leadership. Until next time, I'm Julien A. And this has been Risk Masters.