If there's one thing we must all have become more aware of over the last few years, it is the importance of managing risks. Covid-19, Brexit, economic ups and downs, supply chains have all meant that organisational resilience has been tested like never before. But what is risk management and how can you improve without all the jargon?
In just a few short paragraphs, I'm going to introduce you to some key concepts in risk management to help you and your business navigate the uncertainties thrown at us every day.
R: Risk
A risk is an event in the future that may or may not happen. They are usually bad things, the opposite of opportunities. They are things that will knock you off course and might prevent you from achieving your goals.
You might talk about risks with colleagues by saying "there is a risk that [xx thing will happen], meaning that [yy business activity is disrupted] and so [zz business objective or target is missed]". Each risk is a little story that has meaning to the story-teller and the audience.
Risks have:
A cause [xx thing will happen], e.g. computer systems crash
A risk event [yy business activity is disrupted], e.g. customer data is corrupted
A consequence [zz business objective or target is missed], e.g. sales targets are missed
It is important to distinguish a risk from a general worry. "Things might go wrong" is not a risk, risks are pretty specific things. Being precise about risks helps you identify and manage them better.
Each risk is a little story that has meaning for the story-teller and the audience
I: Impact
What impact will have the risk have? Will it cause a major disruption that the whole company has to spend weeks sorting out, or is it something that nobody will remember happening six months later?
There are risks everywhere, so being able to put a rough estimate on the scale of the impact that might happen if the risk materialises is vital in prioritising action.
But read that sentence again "...if the risk materialises...". Not all risks happen, so even if the impact might be huge (like a meteor smashing your distribution centre), the likelihood of the risk event happening needs to be thought about too.
Impact and likelihood are the inseparable sisters of risk management, they go everywhere together. A high impact / low likelihood risk and a low impact / high likelihood risk probably deserve the same priority in risk management action.
S: Say it
Risk management isn't something you do every quarter when reviewing a risk register or before a management meeting. We manage risks every day, every minute of every day. So while very few people like talking about all the things that might go wrong, they are spinning around our heads every day.
Speaking up about risks you see is a critical business skill that everyone should be encouraged to develop. By saying the risk out loud, talking about it, writing it in emails, pointing at it, the more likely you are to avoid it happening in reality. Risks are not inevitable events, the more people who are thinking about them and doing something about them, the lower the likelihood of them occurring.
What is the worst thing that could happen? As I explained in a previous blog post on decision making, conducting a 'pre-mortem' to talk through the worst case scenario and how to avoid it is a positive way to engage in risk management.
Having a common way of talking about risks (a cause, a risk event, a consequence) in your business will help everyone understand what others are talking about.
K: Keep going
So you have spotted your risks, described them, thought about their impact and likelihood and started talking about them. Now what? Keep going!
Simply identifying and talking about risks isn't enough. Prioritise action by thinking about their impact and likelihood. Then plan actions that could reduce the likelihood of the risk event happening (target the cause) or reduce the impact if the risk event does happen (target the consequence). Give people responsibilities to manage the risks, put actions into work objectives, encourage accountability for action. Reward people when nothing goes wrong.
Good risk management is just good management.
S: Strategy
What's the point of risk management? It helps improve the chance that you'll be able to achieve your strategic objectives. Risk management is a vital part of strategy implementation, so your risk management approach should link to your strategy processes.
The temptation when working on strategy is to think all about growth, beating competitors, creating an engaged workforce and keeping investors happy. You want to create a positive vision of the future, so sweep the risks under the carpet. Avoid this temptation at all costs. Not just because the first risk to materialise may undermine your whole strategy, but because good risk management can flip risks into opportunities.
R: Risks
I: Impact (and her sister Likelihood)
S: Say it
K: Keep going
S: Strategy
600 strategy is here to help you navigate risk management
From working with clients to develop risk management policies and roll out the use of a risk register, to diving into risk management planing for specific strategic risks, to developing processes to build risk management into strategy reviews, 600 strategy Ltd can help you navigate this topic. And we will always do so in an engaging and fun way - there is nothing worse for good risk management than people who are just going through the motions.
If you want to find out more on what we can offer, get in touch for a conversation. We don't do the hard sell and are always happy to share our thoughts ahead of a piece of work.