WIREDGOV

Blog posted by: Ruth Murray-Webster, Lead author, Management of Risk (M_o_R 4), 23 June 2022.

A major responsibility for directors in organizations – whether executive or non-executive – is to take risks in pursuit of value.

While it’s true – and important – that risk management can be about complying with regulations, avoiding fines, and not harming people, organizations still need to try new things to thrive. This requires collective agreement about the risk appetite of decision-makers.

I think this is one of the things that has been “nailed” in the latest Management of Risk (M_o_R 4) guidance: effective risk management can only exist in the context of an express understanding of the willingness to take risk.

The Covid-19 pandemic has put the language of risk – including data and human choices – on everybody’s agenda. Some organizations have claimed that a global pandemic was unforeseeable. This is nonsense: it was already on risk registers of institutions around the world and wholly knowable, though many chose to ignore it rather than prepare.

This fact raises the question of what other risks are organizations and society at large ignoring altogether, assuming that they have time to act. The urgency of the Covid-19 pandemic created an immediate response. The World Economic Forum global risk report (2022) says the number one global risk is related to the ability to respond to climate change. How are we thinking and acting in preparation for the impact of this on our objectives?

The realization of risks such as a global pandemic and the actual effects of global warming have made business leaders more aware of risk and the need for resilience when risk becomes a reality. That means understanding and embracing uncertainty and knowing how to respond.

Understanding our responses to risk

Identifying and managing risk is fundamentally based on individuals’ perceptions of what is risky and why. It is well documented that when it comes to risk, people have an irrational view that is coloured by their own experiences, expectations, and emotions.For example, someone’s perception of Covid risk is coloured by what has happened to them personally, such as losing loved ones, being admitted into hospital, not able to go on holiday or losing business. If a person has had the virus and is experiencing symptoms of long Covid, the precautions they will take are likely to be far greater than another person who hasn’t been affected at all, although they may be equally likely to pass on the virus to others now.

Addressing the “people” elements of risk in M_o_R 4

What relevance do people’s personal experience and perceptions have when managing risk in business? Company directors, like all people, make decisions based on their unique perceptions, but a process-only view of risk ignores that truth.

Consequently, the latest version of M_o_R contains an entirely new section focused on people. As part of that, it addresses the issue of decision bias and how to explicitly deal with this when applying risk principles and processes across strategic, portfolio, programme, project, product and/or operational perspectives.

A future vision for risk management

While many large organizations may have an established approach to risk already, transforming a culture to incorporate risk taking doesn’t happen quickly.

Therefore, what I’d hope to happen is that enough individual professionals and their organizations adopt the concepts in M_o_R 4 build greater awareness and the competencies that will lead to meaningful change.

Using the book as a source of knowledge provides a roadmap and common language around risk; it lays out both the challenge and a response to it, which can help organizations achieve the value they crave.