Thomas M. Bragg on Business Risk Management

I feel like I’m procrastinating. I finished my initial series on step one of the risk management process – identifying risk. Now the plan is to move into writing about step two – evaluating the risks. I’ll get there, but I’ve got one more topic I want to address. Let’s talk about the traits of world class business risk management…

.

I’ve been thinking about these for about a week now.  The idea was triggered by a comment exchange with Kristen on my last post. We talked about “formal” process vs. “formalized” process. Kristen is absolutely correct that risk management needs to be formalized – meaning done in a proper and regular form. But I don’t think it needs to be “formal” – using the definition “stiffly ceremonious, burdensome or onerous”. I know it’s semantics, but the difference in perception will be the difference between effective execution and just going through the motions.

.

That exchange about a specific trait got me thinking about what other traits would characterize world class business risk management.  Here’s what I’ve come up with.

.

Regular and Periodic

I think, first and foremost, a world class business risk management organization executes their risk management process regularly. It might be monthly, quarterly or annually, but risk management will be a regular and consistent task. These companies recognize that the situation is constantly changing. They appreciate the need to stay on top of new risks that may develop or existing risks that may become more probable.

.

Formalized Methods

Risk management must be formalized. What I mean by that is the steps in the process must be repeated consistently. When a task or process is performed on a regular basis, it will become formalized over time. And more than likely they will be written down, which brings us to the next trait..

.

Documented Process

Any company that has a world class process will have it documented. The owners and managers will understand that the methods need to be written down so they can be repeated consistently, communicated to others and continuously improved. The owners will also recognize that the results of the process need to be documented so they can be communicated, evaluated and referred to later.

.

Quantitative Methods

I’ll be the first to tell you that the numbers generated by a risk management process (e.g. the probability of risk occurrence or the potential impact of the risks) are not “real”. They are totally subjective and based on a team’s best judgment. However, just because the numbers may not be precise does not mean that they have no value. The numbers are necessary to successfully evaluate the risks and prioritize your plans.  As long as the methods are consistent, the resulting numbers can be used in comparison with each other.

.

Part of the Organizational Culture

A company that is world class gets that way for a reason – because they place great importance on what they are doing. World class business risk management will be performed by organizations who are passionate about the benefits of the process and have intertwined the concepts into the company culture.

.

Comprehensive

Business risk management can be (should be) applied to all aspects of business – strategic planning, marketing, operations, finance, IT, quality, human resources, etc.  World class companies will have some form of risk management implemented throughout.

.

Communicated

This trait may be redundant with some of the others, but I included it anyway because I think it is critical. The concepts of business risk management will be communicated regularly by world class companies. There are many stakeholders to risk management: employees, owners, investors, bankers and insurers to name a few. Each stakeholder group cares about at least some of the risks facing the business. World class organizations recognize this and make a point to talk about risk management methods, benefits and results regularly.

.

Well there you go. That’s my take on the traits of world class business risk management. Have I missed anything? I know there are a few of you out there reading this. I’d like to hear your opinions…