Sexual abuse and misconduct (SAM) risk has an unusual combination of characteristics that means everyone wants to manage it well, it is essential that it is managed well, and yet it is really difficult to manage.
The consequence is that there is almost always a gap between how well a SAM risk manager is able to manage SAM risk and how well they would like to be able to manage SAM risk.
The inherent characteristics of SAM risk that make it so important to manage well include:
- Organizations that look after minors or vulnerable adults cannot avoid SAM risk. To do so, they would have to stop looking after minors and vulnerable adults.
- There will always be some adults who find minors or vulnerable adults sexually attractive and too many adults are more than capable of making bad decisions. SAM will never be completely preventable.
- SAM causes its victims terrible harm.
- The financial, operational, and reputation damage caused to organizations that fail to manage SAM risk effectively can threaten their viability.
Recent developments in the SAM risk environment have made effective SAM risk management even more important.
- Retrospective statute of limitation changes in many States have provided victims with the ability to make claims for abuse that were previously time-barred. The way organizations deal with these changes impacts how likely and how well they will achieve their objectives in the future.
- Prospective changes to statutes of limitation mean victims will be able to seek redress in the future for much longer after they are abused. Higher expectations for SAM risk management and longer timelines mean the ability to demonstrate sound SAM risk management now and in the future will be almost as important as actually managing SAM risk well.
- The consequences of poor SAM risk management have become more significant as the value of SAM settlements has grown. Where a settlement of $250,000 was considered a big settlement 15 years ago, $25,000,000 is now a big settlement, with the largest known being $40,000,000.
- SAM risk is no longer just the risk that an organization fails to prevent SAM. SAM risk crystalizes when trust in an organization is impaired because they are perceived not to be managing SAM risk well.
The developments mean SAM risk is more likely to crystallize and more likely to threaten the future of an organization if it does.
SAM risk is hard to manage well for a number of reasons. For example, in a recent survey, BOKRIM identified that:
- Very few SAM risk managers manage risk as their primary responsibility. Almost all SAM risk managers have different primary responsibilities, like legal or finance.
- Few SAM risk managers are able to spend more than 10% of their time managing risk. Risk management is just another thing on their plate.
- Few SAM risk managers have formal risk management training. SAM risk managers learn risk management ‘on the job’.
- Though there is plenty of information – far too much in fact – on SAM risk, there is very little reliable, practical, or contextual information to guide well-informed SAM risk management decision-making.
- SAM risk management practices have never been measured for effectiveness, so approaches vary widely. Even entities following the same rules use different controls in widely different ways.
So, while every SAM risk manager wants to manage SAM risk well, they are having to manage an unavoidable, unpreventable, and potentially existential risk in the face of multiple priorities, limited time, and too little reliable information. And then there are our cognitive biases.
We all have them. They are the experience, impulses, gut feelings, and rules of thumb we use when making decisions. They aren’t a fault but a feature; they are what protected us from saber-tooth tigers. But when risk management (important decisions about uncertain future events) meets too little reliable information, cognitive biases fill information gaps in what decisions we think we need to make and in making the decisions we decide we need to make. The problem is that there are many cognitive biases, they vary widely, they impact different people differently, and they are reliably unreliable at supporting effective decision-making. Their impact of cognitive biases on risk management can be profound.
Successful SAM risk managers understand and address the real characteristics of SAM risk and overcome the challenges that make SAM risk management difficult. They are able to develop the practical information they need to manage SAM risk effectively, whatever their resources and constraints. They know how much SAM risk they are managing, how well they are managing it, and when and how to adapt to change.
For these SAM risk managers, there is no gap between what they are able to do and what they would like to be able to do in terms of protecting minors and vulnerable adults from SAM. They can credibly demonstrate externally how well they are managing SAM risk. They can credibly demonstrate internally how they are minimizing the total cost of their organization’s SAM risk.
If you would like to know how much SAM risk BOKRIM estimates your organization is managing, please answer the 5 questions below. The only private information we ask for is your email address, so we can send you the estimate of how much SAM risk you are managing.