Dr Sarah Gordon

“Risky stuff”​

So often an organisation or a team lets out a groan of boredom when someone mentions that a risk assessment is required before a task is undertaken. 

“What’s the point?  It is only a tick box exercise.” 

“We are never actually going to do anything about those risks identified within the assessment.” 

“I see no value in doing this stuff.  It is just a waste of time.”

Yet, the world’s regulators and leaders in governance keep enhancing the requirements of this thing called “risk management” within their guidance and policies.   Why?  Because when done well and applied to the real world - it really works.

The purpose of risk management is to actively try to take charge of the uncertain aspects of potential threats or opportunities which, should they occur, will impact on the achievement of your objectives.  It is about trying to control the future.  It is about making decisions based on incomplete datasets.  It is about navigating through a world of uncertainty.  Anyone being doing this recently?  Thought so…

We all manage risk on a daily basis.  The fact that we as humans are still around suggests that we are quite good at it.  However we each perceive and manage risk in a slightly different way.  This diversity of approach is great, however can be problematic when we need an organisation to move forward rather than pull in all directions at once. 

Risk management within an organisation is therefore the mechanism of formalising how the organisation as a collective makes a decision.  It provides a framework through which our own personal predispositions to risk can be aligned and translated, resulting in a decision-making approach that is cognisant of the skills and perspectives we bring to the table. 

Many different risk management frameworks, standards, guidelines, principles and processes exist.  It is critical for an organisation to design and feel comfortable with its own approach that should be tailored specifically for its needs.

In its simplest form, the risk management process consists of four steps (See fig. 1).  It is through this that we can ask ourselves the question: 

Based on the context in which we are trying to operate and the objectives we are trying to achieve, and the risk (positive or negative) that we face, and our ability to control them, is it possible to achieve our objectives in the manner that we desire? 

If yes = great!  Carry on.  You have everything in balance.

If no = you have two options:

1. Pile more money, time and effort into managing your risks.

And / or

1. Move the goal posts.  If you cannot achieve your objectives, then change them.  What is the point in trying to achieve something that is impossible (or conversely, something that is waaay too easy for you)? 

Being able to ask this question at every level in an organisation, no matter how senior or influential we are, is key to the development of a healthy culture.  What’s more, is taking action based on our answer to the question.  Empowering individuals to justify the need for additional resources or push back on objectives is invigorating and builds trust and respect throughout the team.

Who would have thought you could get all of that from “risky stuff”?!