We’ve already addressed the issue of what is risk management and now it makes sense to discuss why risk management is important. After all, many people and organisations exist with no formal or planned consideration about effective risk management.
At its most basic, we live in a world full of risk and uncertainty. Things change and we can find ourselves unprepared for the unexpected. The optimistic amongst us may consider that an opportunity to express our agility whilst also saving money on formal risk management plans. The essential idea is that the best way to respond to potential risks is to plan to be adaptive, having good general contingency plans and resources available for whatever the organization faces.
On the surface, that seems simple enough, a business strategy even, but it also contains some traps. Firstly, having contingencies in place is an inefficient use of resources. They are a cost in themselves but without any risk assessment, without any specific risks in mind, it’s impossible to know whether the contingencies are sufficient or excessive. The second trap is the idea that because risks relate to uncertainty, then it is impossible to know anything at all about the internal and external risks you are facing, therefore you should not attempt to control anything about your operating environment. We might call this approach ‘helpless’ or ‘fatalistic’.
We would certainly not consider this as a basis for producing a product or service. No one could plausibly argue that the customer “will get what they get” because “we have no control over what we produce”. The entire point of an organisation is that they have a span of control in order to achieve a consistent kind of outcome. It is an integral part of the desire to deliver something dependable, that risks have to be managed. After all, risks are interrupters to our objectives.
Once an organization grasps why risk management is important in relation to what they are trying to achieve, they can set about identifying what is uncertain, why it is uncertain, what difference it makes to their planned outcomes, and then deciding what they can do about it. Risk action plans include reducing the frequency of negative events (we could call this ‘Probability Management’) and the undesirable outcomes that could follow (the label ‘Impact management’ is fitting for this).
A study by Booz & Co. in 2012 studied the total market value of businesses that were over $1Billion in size 10 years previously. 1,053 businesses fulfilled that criteria. They calculated the value of those businesses a decade later and did a deep-dive study on those that lost 10% or more of their value.
103 businesses fell into this “worst performers” group. Their conclusion was that in 81% of cases, strategic failure was the primary reason for this loss of value. They went on to point out that failing to grasp a changed strategic environment and lacking the agility to adapt, are both outcomes from failing to use Enterprise Risk Management to make the organisation more strategically resilient.
Risk management that only looks to tackle issues that have frequent but (usually) limited impacts like health and safety matters, or at the other end of the spectrum, addresses very rare but uncontrollable events like natural disasters, will be of minimal relevance when protecting enterprise value. For the risk management process to deliver the greatest possible benefits of risk, it must deepen people’s awareness about uncertainty and risk – and – be integrated into strategic decision-making.
To illustrate these findings from Booz, we can point to the Deepwater Horizon marine oil drilling platform disaster (the worst in history to date). On the day it exploded, killing 12 crew and releasing terrible pollution into the Gulf of Mexico, executives had flown on board to give out safety awards. The crew of the vessel were taught how to identify hazards such as bolts sticking out of the deck floor, but everyone was overlooking the greater risks of paying executives performance bonuses that meant they routinely dismissed the caution of engineers. Concerns about catastrophic failures were dismissed in order that production targets were achieved. Risk management was given lip service, but it wasn’t given ‘teeth’.
Unexpected events are sometimes perceived as bad luck or even dressed up in respectable risk language as unforeseeable “Black Swan” events. We would characterize this as mismanagement of risk. Business owners and investors alike should be confident that in the vast majority of cases, properly identified risks and thorough risk analysis, will expedite skilful probability and impact management.
Risk management is important because it protects value, lives, reputations, the environment, product and service quality and creates a sense of stability and cohesion within an organization, giving people belief that greater achievements are possible because uncertain factors are sufficiently controlled.
We know what you mean.
Download our free guide that shows the top 20 training mistakes when designing training.
