Recently, the global consulting firm Protiviti teamed up with NC State University’s Enterprise Risk Management Initiative to publish their ninth annual report on Executive Perspectives on Top Risks. This study reports the opinions of over 1,000 board members and C-suite executives on risks facing organizations in 2021, as well as their expectations of the risks facing their organizations in 2030.
While I read through the report, one big theme stood out to me – the importance of risk management and the role of boards and executives in devoting time to analyzing, identifying, and mitigating risks. Risk management professionals may not have predicted the emergence of a global pandemic or the impact it would have on the economy and our way of life, but a risk management process could have served as an early warning system to the pressure points in an organization’s approach.
An active and ongoing risk management process can help organizations identify issues and, based on their risk appetite, take steps forward to mitigate the impact. The board and the executive team are the center of this process. They are responsible for helping the organization identify and side-step negative issues, but they are also responsible for identifying and taking advantage of positive opportunities as well. Missing a beneficial opportunity can cause harm just like a negative one.
Establishing a Risk Management Process
Establishing a risk management process is a significant undertaking for leaders in any organization, but the benefits can be significant. It is important to devote adequate time to build an effective risk management process and to maintain it. If you are just getting started here are some things to keep in mind:
Finding the right facilitator is important. The chair of the board or the Executive Director can be a great facilitator; but it is often wisest to find someone from outside the organization. Participants in the process may be more open if an individual outside the organization is leading the discussion. To gain the most benefit from the process, it must be independent and objective. All arguments need to be challenged and/or supported, regardless of the source.
Invite people from all levels to participate in the process. Like so many aspects of a business, those closest to the program, service, or community will have a different perspective on what is needed to be most efficient, most optimal, and what risks or opportunities are present.
Encourage discussion and emphasize there are no bad ideas. If a hypothetical risk assessment session took place two years ago and someone mentioned the world would be paralyzed by an airborne viral pandemic, that should have been taken seriously. It may have received a low likelihood score at the time, but, in retrospect, it should have been taken seriously. Thoughtful discussion about unlikely events can unlock real risks and provide helpful insight.
Develop a “heat map” to score risks based on a scale of relative likelihood and impact. Those items that score high on likelihood and impact are urgent risks and deserve immediate attention to mitigate. As you work your way down-scale to low likelihood and impact, you can employ different strategies to and timelines to deal with those risks.
Spend some time as an organization (including the board) discussing strategic risks on an ongoing basis. Revisit the initial work periodically to maintain the list of risks. This will include adding new ones, rescoring them, and implementing risk mitigation strategies as you move along.
Remember, risks are not only the bad things that can happen, they are also the missed opportunities to find and attract good things.
The Benefits of a Risk Management Process
The power of risk assessments is in their ability to tease out operational risks and issues from broad, expansive, macro-sized risks.
Above in the “no bad ideas” discussion, imagine how the conversation about the emergence of an airborne pandemic would have played out. That broad idea would have turned into a discussion on the consequences and impact on the organization. This likely would have led to tactical questions like, “What if we can’t operate the way we are used to?,” or “What if we can’t engage with our audience in person; how would we fundraise?”
A silver lining in the storm of 2020 is that we now have a glimpse of where the world may be heading. Even if the pandemic hadn’t happened, our society may have naturally ended up interacting more routinely by video and in smaller crowds by 2030. We may have invited our community to join a gala or fundraiser virtually, expanding the organization’s reach. And more of our workforce may have asked to work remotely by 2030.
Since the pandemic did happen, we are now developing strategies to retain the positive attributes of these virtual interactions. Would we have seen these opportunities if not for the pandemic? By using the process of risk assessment to draw out risks, perhaps so.
Preparing for the Coming Decade
The report from Protiviti and NC State University’s Enterprise Risk Management Initiative provides great insight into what is coming; the promise and excitement of positive forces, as well as risks that need to be considered. The best thing your organization can do with this information is to have a thoughtful discussion about the risks associated with how these things (and others) intersect with your path forward.
Those that aren’t thinking ahead and adapting to how the next generation will interact with their services, programs, and mission, will be at a clear disadvantage. The workforce will be different in 2030. The skills needed to be successful in 2030 will be different (and largely additive) than they are today. Where employees work will be different, what they do will be different, the information and tools they need to be successful in their jobs will be different, and how they engage and become connected to an organization will change.
Thankfully this won’t all come at once. We will pass mile markers along the way, but organizations must pay attention and prepare.
In Conclusion
Perhaps the most optimistic view of the last year is that many organizations are successfully navigating the most significant risk in a generation, providing some confidence that the tools and skills are in place to take on unknown and unexpected risks going forward. Early warning systems and planning will provide leverage for organizations to be even more successful in managing risks. No time like a pandemic to get started!
If you have any questions about establishing a risk assessment process at your organization, please reach out.
©2021 Clark Nuber PS. All rights reserved.
This article or blog contains general information only and should not be construed as accounting, business, financial, investment, legal, tax, or other professional advice or services. Before making any decision or taking any action, you should engage a qualified professional advisor.
Menu
≡
╳
