1. Identifying the real risk

?A short musing on risk management

The art of risk management is identifying the right risks and framing the risks right.

Done well, it unlocks creativity and strategic thinking in an organisation.

Yes, budget overruns, contract failures, resources shortages, delays, your business in the newspapers and workers compensation claims are risks and all suck. But the reality for a large organisation is that these things are likely to happen or are already happening and there are systems and processes in place to manage those events.

However, as someone responsible for the strategy of an organisation it is worth asking... what is the real risk we are trying to avoid? What will really take us away from overall objectives? What is the beyond business-as-usual case?

I came across this question working on a government program that was going to issue hundreds of millions of dollars’ worth of contracts to a range of small, medium and large business participants. This was a new type of contract intended to kickstart an emerging market.

My role was to design a process to ensure that people entering into contracts with the government were fit to deliver on those contracts. Working through the design process, I became concerned that I couldn't provide sufficient assurance on all stakeholders requesting large amounts of information about the business and understanding its situation to make a proper assessment. The administrative burden for participants and internally was untenable.

While going through the risk identification process, the risk management lead at the time introduced me to the concept of the ‘Oh S*!t Moment'. That moment that would be outside of business as usual. The thing that isn't just something that might happen but you want to make 100% sure it doesn't happen.

Thinking it through I realised the risk was not one contract failing, we had processes to manage that. The real risk was that the market would lose confidence the contract as an instrument and stop investing in the market. There could be many causes, one of which was that if a large percentage total contract value failed. One contract failing was really just another business-as-usual case that we would need to manage anyway.

This revised perception and framing of the risk changed my thinking on the treatment approach and design of the system. Having let go of the concern for one contract failing and viewing it systemically, we could streamline the process to focus on high value contracts and participants that could affect the system while providing a streamlined process for small and medium contracts and participants.

In other words, identifying the right risk and framing it right meant, we could take a strategic choice to take on greater risk as an organisation. We could look creatively at our process to focus on the the high risk participants and gain efficiencies on the lower risk participants, knowing that we were still protected against the real downside.

So next time you are running a risk identification workshop, you may want to ask yourself, what is the "Oh s*!t moment'