Recently, I came across the concept of the Capability Life Cycle in organizational behaviour — a perspective that sparked a broader question:

Can and should risk management evolve alongside the organization’s capabilities, rather than react to their decline?

Think of the Capability Life Cycle like a product life cycle — but applied to a specific internal capability or function. It typically moves through these stages:

1. Founding / Development – New capabilities emerge in response to opportunity or necessity (e.g. a fintech initiative or digital onboarding system).
2. Growth – The capability gains internal buy-in, funding, and operational maturity.
3. Maturity – The capability becomes embedded and optimized, but innovation slows.
4. Decline or Renewal – The capability either loses relevance or is reimagined and adapted to new conditions.

Now apply this to risk management in Canadian banks, insurers, or credit unions. Many frameworks were developed during a time of regulatory stabilization following the 2008 financial crisis. Those frameworks have matured — some might say ossified. Yet the world they operate in — cyber risk, geopolitical shifts, climate finance, GenAI — continues to change rapidly.

Here’s the challenge:

Disruption or uncertainty may force a change in how risk is managed — but can risk management proactively adapt over time?

This isn’t about compliance checklists or audit cycles. It’s about ensuring that risk management itself doesn’t become a mature capability in decline. It must be a living function that aligns with the business strategy, the pace of innovation, and — crucially — with the evolving behaviours of the organization.

A few takeaways for Canadian financial services leaders:

🔍 Look outside traditional risk functions for inspiration
Organizational behaviour, behavioural economics, and even marketing offer models that better reflect how people and systems actually behave under uncertainty.

🔄 Think in life cycles, not permanence
A great risk framework in 2018 might be a liability in 2025. Capabilities need ongoing investment, feedback loops, and the occasional reinvention.

🧭 Build for adaptability, not just resilience
Resilience helps you survive a disruption. Adaptability helps you evolve before the disruption hits.

💬 Ask the hard questions

• Is our risk culture aligned with how our business is actually evolving?
• Are we over-relying on historical metrics to define emerging risks?
• Is our framework enabling strategy — or inhibiting it?

The Canadian financial services sector is at a pivotal moment. Open banking, evolving customer expectations, and systemic digital shifts mean the very nature of financial risk is changing.

So let’s ask ourselves — is our risk capability evolving too?

A Key Component of Trust Is a Willingness to Be Vulnerable: Are You in an Environment That Supports This?

The genesis of this post is a conversation I had with my wife a couple of weeks ago regarding general office behaviour at her work as well as office culture overall. The conversation was about a feeling we have that there may be an erosion of trust and the acceptance of being able to be open and honest, being vulnerable so you can develop trust. Trust is often considered the foundation of strong relationships whether its in the workplace, in friendships, or with family. Personally, I typically associate trust with reliability, integrity, and consistency. But I believe one of its most powerful and often overlooked ingredients is vulnerability.

What Does It Mean to Be Vulnerable?

Vulnerability is the courage to show up and be seen, even when the outcome is uncertain. It’s admitting you don’t have all the answers, asking for help, or sharing when you’re struggling. It’s being honest about your fears, your mistakes, and your hopes.

Far from being a weakness, vulnerability is a profound act of strength. It invites connection, fosters empathy, and builds trust. When someone is willing to be vulnerable with us—and we respond with compassion—we create a bond that’s deeper and more resilient.

But Vulnerability Requires the Right Environment

Here’s the catch: vulnerability only builds trust in the right environment. If you’re in a culture that punishes mistakes, mocks uncertainty, or demands perfection, being vulnerable can feel like stepping into a trap. In such environments, people learn to hide their true selves, and trust erodes.

So, I am asking you, are you in an environment that makes it safe to be vulnerable?

Here are the Signs of a Trust-Supporting Environment

A culture that supports vulnerability—and therefore trust—often exhibits the following characteristics:

• Psychological safety: Team members feel safe to take risks, voice their opinions, and admit mistakes without fear of ridicule or retaliation.
• Leaders model vulnerability: When leaders share their challenges and admit mistakes, it signals permission for others to do the same.
• Failure is seen as learning: Instead of blame, the focus is on growth and improvement.
• Feedback flows in all directions: Honest conversations aren’t just tolerated they must be encouraged.

If these elements are missing, the price is high: team members withhold ideas, avoid risks, and disengage emotionally. Over time, innovation slows and relationships fracture.

How to Cultivate a Culture of Trust

Whether you’re a team member or a leader, here are ways to build an environment where vulnerability—and therefore trust—can thrive:

• Go first, share your own uncertainties or past failures because this invites others to do the same,
• Respond with empathy, because when someone opens up meet them with support, not judgment,
• Celebrate honesty and recognize when people take the risk to speak truthfully or admit fault,
• Create rituals of reflection by making space for regular check-ins that allow for open dialogue.

My Final Thought

Trust isn’t built by putting on a strong front, it’s built by letting others see the real you, and that only happens when vulnerability is met with compassion, not criticism. It’s not easy, it takes work, and it takes time. It does not happen overnight. So ask yourself, does your environment support vulnerability? And if not, what can you do to affect change towards that environment?

I’ve spent thousands of hours reading research articles on leadership—specifically, the intersection of corporate governance and risk management. While research directly addressing this connection was limited, I found plenty of insights on leadership and risk management individually. Over time, I gathered golden nuggets of wisdom that shaped my thinking and deepened my understanding of the role leadership plays in an effective risk management function.

Eventually, I realized I had collected enough to share with the risk management community. The challenge was figuring out how. Should I write a paper? Start a blog? Host discussions? I wasn’t sure about the best approach—I just knew I needed to start somewhere.
Earlier this week, I came across my Risk Management Conference presentation, and it struck me that its core message still holds relevance today. My key takeaway back then? A Risk or Compliance Manager’s role isn’t just about enforcing policies and procedures—it’s about building relationships within the organization just as fast (if not faster) than enforcing the rules.

Why? Because risk management isn’t just about identifying risks—it’s about influencing behavior, decision-making, and company culture. And that doesn’t happen through policies alone. It happens through people.
If I were to update this presentation today, I would emphasize why relationship-building is key:
✅ Influence Over Authority – Risk managers often don’t have direct authority over business decisions. Unlike some functions that operate with clear-cut mandates, risk management is about influence. You need to shape how people perceive and act on risk, which requires building trust and credibility. If you’re seen only as the person who enforces rules, you’ll struggle to make a real impact. But if stakeholders trust you, they’ll involve you early in decision-making rather than after the fact.
✅ Proactive Risk Awareness – One of the biggest challenges in risk management is that risks are often identified too late—after they’ve already materialized into issues. When people trust you, they’re more likely to bring concerns forward early, giving you time to address risks before they escalate. This is especially important in fast-moving organizations where risks can emerge rapidly. The stronger your relationships, the more likely employees will view you as a resource rather than a last resort.
✅ Collaboration Over Compliance – Traditionally, risk and compliance functions have been seen as rule enforcers—people who say “no” rather than enabling the business to say “yes” in a responsible way. However, the most effective risk managers shift this perception by embedding themselves within the business, working alongside teams to integrate risk awareness into decision-making. When you focus on collaboration over strict compliance, you create an environment where people see risk management as a value-add rather than a barrier.
✅ Stronger Culture of Risk Awareness – Policies and procedures are important, but they only go so far. Real risk awareness is built through conversations, relationships, and shared understanding. When employees feel comfortable discussing risks without fear of punishment or bureaucracy, they make better decisions at all levels of the organization. Risk culture isn’t dictated—it’s cultivated through ongoing engagement.
A Shift in Mindset
When I first started in risk management, I thought my role was primarily about ensuring policies and procedures were followed to the letter. Over time, I learned that while policies are necessary, they don’t drive behavior—people do. The key to effective risk management isn’t just about having the right framework; it’s about having the right relationships.
If I were giving my presentation today, I’d focus even more on this mindset shift. The most successful risk managers aren’t just compliance experts—they’re trusted advisors who understand the business, build strong relationships, and influence decision-making at all levels.

I’d love to hear your thoughts. How do you balance enforcement with relationship-building in your organization?

As a risk and compliance manager, over time, I’ve found developing an informal network at the companies I’ve worked for has been invaluable. While formal processes and structured compliance programs are essential, it is often the informal relationships that provide the early insights and collaboration necessary to manage risk effectively.
Why is an informal network so valuable? First, risk and compliance management is not a siloed function—it touches nearly every department, from finance and IT to operations and HR. Having an informal network allows for the flow of information in a way that a structured reporting system sometimes cannot. Colleagues are more likely to share emerging concerns, regulatory shifts, or operational challenges in casual conversations than in formal meetings. These early signals can help risk and compliance teams act proactively rather than reactively.
Second, trust is a cornerstone of effective risk management. By building relationships across departments, compliance professionals can create an environment where employees feel comfortable raising potential issues before they become full-blown problems. A strong network fosters a culture of openness and cooperation rather than fear of repercussions.
Third, an informal network enhances agility. When an unexpected compliance challenge arises, having established relationships across departments makes it easier to find solutions quickly. Instead of navigating bureaucratic red tape, you already know who to call for guidance or immediate action.

So, how can you build an effective informal network across company departments?

1. Engage Beyond Your Department – Attend team meetings outside of your immediate compliance function. Volunteering for cross-functional projects or committees provides natural opportunities to connect with colleagues in different roles.
2. Be a Connector – Introduce people across teams who could benefit from knowing each other. When colleagues see you as someone who facilitates communication, they will be more likely to turn to you when they need compliance guidance.
3. Leverage Common Spaces – Casual interactions in break rooms, hallways, or company events are excellent opportunities to engage with colleagues informally. A simple “How’s your project going?” can open the door to valuable insights.
4. Build Rapport Over Time – Relationships aren’t built overnight. Regularly check in with colleagues, whether it’s a quick chat about a shared interest or offering to help with a challenge they’re facing.
5. Use Technology to Stay Connected – With hybrid work environments becoming more common, digital connections are just as crucial as in-person ones. Utilize company chat tools, virtual coffee meetings, or internal social platforms to maintain and strengthen your network.
6. Be a Trusted Resource – Share relevant insights, industry updates, or compliance tips in an approachable way. When people see you as knowledgeable and helpful rather than purely as an enforcer of rules, they will be more inclined to keep you in the loop.
   Building an informal network doesn’t mean bypassing formal processes—it means complementing them with a human approach. In the fast-evolving landscape of compliance and risk, relationships can often make the difference between catching a risk early or dealing with a crisis too late.
   By proactively developing connections across departments, compliance professionals not only make their jobs easier but also contribute to a stronger, more resilient organization. A well-connected risk and compliance team is an effective one—so start building those bridges today.