Risk management culture

Most well run organisations will have risk managed at four distinct levels which are; Corporate/Strategic, Programme, Project and Operational. To do this effectively, a framework for managing risk needs to be designed and implemented to address the following:

1. how risks are identified;
2. how information about their probability and potential impact is addressed;
3. how risks are quantified;
4. how options to deal with them are identified;
5. how decisions on risk management are made;
6. how all these decisions are implemented;
7. how actions are evaluated for their effectiveness;
8. how appropriate communication mechanisms are set up and supported;
9. how stakeholders are engaged on an ongoing basis.

But this is just the beginning because it’s all very well having a thorough framework documented and sitting pretty on the shelf with a tick in the box, but risk management needs to instilled within the people of the organisation. A healthy culture of risk management needs to exist and for this to happen, everyone involved needs help in appeciating and understanding risk within the organisation. I personally feel that this requires sponsorship from the top down and if leaders at the corporate level understand this too, they will take the time to ensure that risk is taken seriously and subsequently managed well.

Setting up a good risk culture is a real challenege and the UK OGC states that it involves at least the following:

1. strategic planning;
2. legal requirements;
3. agreements and contracts;
4. communication techniques and information management;
5. staff matters, including how staff can be motivated and involved;
6. education opportunities and continual professional development;
7. continuous improavement and/or analytical techniques;
8. how the organisation is monitored and evaluated;
9. resource management, incuding equal opportunities and delegation.

This subject is a big one and if you need help with some guidelines for a framework, a great place to start is the OGC’s Guidelines for Managing Risk.

If a need a list of generic pain points that risk management will address to support your case for better risk management, start with these:

1. increased certainty and fewer surprises;
2. better service delivery;
3. more effective management of change;
4. more efficient se of resources;
5. better management at all levels through improved decision making;
6. reduced waste and fraud and better value for money;
7. innovation;
8. management of contingent and maintenance activities.

Don’t forget the more specific pains that your organisation is already suffering, to build your case.

No matter where you sit within the organisation, if you see that risk is not being appropriateley addressed, take the initiative, pluck up the courage and set out to facilitate some change.

Visit www.consult-llewellyn.com