Risk Awareness & Risk Management are Not the Same Thing.
Updated: Jun 15
Most Organisations Do Not Have a Risk Awareness Problem.
They have a Risk Information Management problem
Some organisations invest considerable effort in risk management, many less so.
Risk frameworks are established. Governance forums are created. Risk owners are assigned. Review cycles are scheduled. Reporting packs are produced.
Yet despite that, many organisations experience the same recurring challenges:
Multiple versions of the truth
Inconsistent risk assessment
Fragmented reporting
Escalation by exception rather than design
Unclear ownership across organisational boundaries
Significant administrative effort
Limited visibility beyond local registers
These issues are often interpreted as failures of risk management.
In reality, they are frequently failures of risk information management.
Risk Information is Rarely Static
In practice, risks move.
A project risk may become a programme risk.
A programme risk may become a portfolio concern.
An operational issue may become a corporate risk.
A departmental dependency may affect multiple services.
As organisations become more complex, risks increasingly cross organisational,
governance and management boundaries.
The challenge is not identifying risks. The challenge is managing risk information as it moves between accountable parties and organisation-wide visibility.
The Limits of Independent Registers
Traditional risk registers are designed primarily for risk recording.
They are less effective at managing the relationships between risks, governance structures and organisational accountability.
As a result, organisations often compensate through manual processes:
Meetings
Email exchanges
Spreadsheets
Governance forums
Narrative reporting
None of these activities are inherently problematic.
The challenge arises when governance depends upon them.
As organisations grow, visibility becomes fragmented and assurance increasingly depends upon individual diligence rather than systematic control.
Governance Is Also About Movement
Many governance frameworks focus heavily on assessment.
Far less attention is given to risk movements.
Yet governance fundamentally concerns questions such as:·
Who owns this risk?
Should it be managed elsewhere?
Has responsibility changed?
Has it been escalated appropriately?
Why was it transferred?
Who made that decision?
Can the decision be traced?
These questions are not about risk assessment and scoring.
They are questions about governance, accountability and organisational control.
The Need for Connected Governance
Organisations increasingly require risk information to operate as part of a connected governance system rather than as a collection of independent registers.
Such a system should support:
Clear ownership
Structured escalation
Controlled transfer of responsibility
Traceable decision-making
Consistent reporting
Organisational adaptability
Sustainable administration
Most importantly, it should achieve these objectives without creating unnecessary barriers for the people responsible for managing risks.
A Different Perspective
The challenge facing many organisations is not how to record risks.
It is how to govern risk information as it moves through increasingly complex organisational structures, and to understand how the overall risk profile is moving in the cotext of the organisation's stated appetite for risk.
Addressing those challenges requires more than a better register.
It requires an operating model capable of supporting governance, accountability, visibility and assurance across the wider organisation.
I have spent the past 3 months responding to this challenge. Designing an integrated risk governance and oversight system operating model for connected risk management and governance, without the ERM level overheads. The brief was strict:
No additional platform infrastructure
Organisationally more easy to adopt
Familiar to those who manage risks
No per-seat licensing or maintenance costs
Easy procurement route to acquire
Configurable to the organisation's structures
Operated within the organisation's existing estate
Administered sustainably by the organisation itself
Enterprise risk platforms can and do meet many risk governance needs. But they also bring materially greater costs, ongoing licencing and maintenance, with longer procurement and implementation cycles, and long-term supplier dependencies that many organisations simply cannot justify. Who knows where the design will go next.
Comments