To cope with the challenge of creating consistent and workable processes for managing operational risks, organizations need to adopt a "risk management culture" that emphasizes at all levels the importance of managing risk as part of each person's daily activities. The goal of creating a risk management culture is to create a situation where staff and managers instinctively look for risks and consider their impacts when making effective operational decisions.
Reasons Why Adoption of Risk Management Doesn't Occur
While few service delivery organizations would argue against managing risks, many find it difficult to fully adopt the discipline associated with a proactive risk management process within operations. Often they might undertake a risk assessment at the start of each project but fail to maintain the process as the project proceeds.
The following reasons are frequently given to explain this approach:
- Pressure of time, combined with the feeling that nothing will
be done about reported risks.
- Staff often feels that identifying risks may give the wrong
impression to management and may result in retribution against
- Concern that a visible focus on risks will present a negative
impression to executives and shareholders.
The root cause for these beliefs is that managers themselves often do not understand the value that risk management delivers. As a result, they are reluctant to assign adequate resources for risk management activities. Conversely, where resources are limited, they might sacrifice these activities first if the budget or schedule comes under pressure.
It is therefore especially important to ensure that all stakeholders appreciate the importance of managing risks in order to establish a culture where risk management can thrive. The following steps have been found to be effective in establishing risk management as a consistent discipline:
- Obtain management sponsorship.
- Seek advice and mentorship from a risk manager who has personal
experiences and knowledge about potential failures.
- Educate all stakeholders about the importance of managing risks
and the costs or lost revenues that can result from
- Train a core set of risk managers to act as role models and
provide mentorship for others. An effective training approach is to
combine a workshop on the theory of risk management with real
exercises based on day-to-day operations activities.
- Invite all stakeholders to operations management reviews (OMRs)
where top risks are reviewed.
- Ensure that top risks are included in status reports and
circulated to service managers and key stakeholders.
- Seek feedback from stakeholders on the effectiveness of the
risk management process and review the process regularly to ensure
that it continues to add value.
- Introduce a recognition scheme for individuals who effectively
identify and/or manage risks.
- Ensure that the operations staff considers risk management
activities when scheduling and making key decisions.
- Make the systems used in risk management easy to use and
accessible. A key requirement is to record risks as soon as they
are discovered so they can be analyzed and managed.