assurance or reassurance; living with risk

I remember some time ago reading an article about my other life viz a local politician/county councillor. It was at the time of one of the all too frequent and tragic child protection misadventures. The point being made in the article was that it is not sufficient for councillors simply to ask if appropriate systems were in place to ensure that such a tragedy would not happen in their patch, it is necessary to look directly at the systems themselves.

I was reminded about this last week when I attended an event at the BMA in connection with Cambridgeshire Community Services’ (that’s another life I have; I’m a NED at CCS) planned conversion to a Foundation Trust next year. There was a powerful presentation given by Eileen Walsh, Director of Assurance at the Oxford Radcliffe Hospitals, and she repeated that message in spades. Eileen quoted from the HM Treasure Orange Book:

‘assurance is an evaluated opinion, based on evidence gained from review, on the organisation’s governance, risk management and internal control framework’

It is not an opinion based on what somebody’s told you but one based on evidence. Simply accepting what someone else says is reassurance and often, but not always, is not enough.

Click here for Eileen’s full presentation.

So where’s the equivalent in the ‘real’ world? When I was employed in a part of the Danaher empire, absolutely brilliant and single-minded about eliminating waste and maximising performance, one of the questions which it asked about its managers related to their willingness to ‘go to the gemba’. Wikipedia tells us that gemba is Japanese for the ‘real place’ and the expression describes how good managers don’t just accept what’s told to them, they go and see for themselves.

I do a lot of business performance coaching these days. I’m not a life coach and never will be but I help people who run smaller businesses to get more out of them. And I do a lot of this through asking questions and it concerns me that the answers which I often get, from people who should know better, are simply restatements of what my contact has been told. They have been reassured about something but they haven’t gained assurance. I sometimes seem too pushy but I insist: don’t just tell me, show me; you should do the same.

If you’ve got a good team and/or you’ve got good systems which have been subject to rigorous audit you can accept reassurance most of the time. But don’t assume and if the issue’s big enough and the information is important enough you’ve got to go to the gemba and see for yourself.

In the end it’s about risk. If the likelihood is high and/or the consequence is substantial you need more than reassurance. You need assurance. It’s as true in the private sector as it is in the public sector. If you’re going to bet the company’s money on a new investment you’d better make really sure that the information you’re using is good. Don’t just ask for reassurance; assure yourself.