Risk registers - Management tool or trap?
Dr Costas Chryssou
Feb 13, 2022
tamegon Innovation and Growth Advisory Firm
Effective risk management, is critical to the success of any business or project and it is one area that demands a great deal of the management team's time and attention.
Risk management is the process of identifying, assessing, prioritising and responding to risk factors in order to minimise the negative impact they may have on an organisation....
One of the most common techniques used for recording, analysing and capturing responses to risk factors is the risk register. Risk registers provide the platform for capturing identified risks – also confirming that the perceived risk is a risk and not a business worry or a constraint; evaluating the risk's size – its impact, probability and proximity; and identifying a risk response – looking at the alternatives and deciding whether it is worth taking pre-emptive action, for example. If the cost of management action exceeds the beneficial impact then we just need to monitor the risk and plan our post-maturity actions (mitigation after the risk event); otherwise we need to plan for managing the risk and develop an appropriate risk management strategy – risk avoidance, risk reduction, risk transfer, or protect against the risk.
Although risk registers can be valuable in providing a thorough process and a single place for identifying and capturing risks, sometimes they can also act as a management trap.
Risk registers may for example encourage the impression that risks are static and that we just need to only identify and capture risks at the initial stages of a project or propose management responses and then re-visit the business risk register occasionally. They also tend to contain a large number of risks, often badly stated, that should not be in the risk register in the first place, overwhelming the business and risk managers with too many items to be able to actively monitor and respond to.
From my experience, risk registers can become more effective in assisting an organisation to monitor and respond to strategic and operational risks by
- making sure the risk is well understood stating clearly for all risks the ‘cause’, the ‘condition’, the ‘consequence’, an appropriate agreed ‘management action’ that addresses the cause, consequence or both, and a 'risk owner'.
- eliminating 'generic' risks – risks such as ‘a project might be late’, ‘business resources may not be available’, and ‘project requirements may be wrong’. These should be addressed by using organisational standard operating procedures and project management methods, particularly during the planning process.
- treating as business or operational assumptions risks that have low probability and low impact, and keeping them out of the risk register document. These business assumptions should be monitored and elevated to risks (and to the risk register document) only if a change has occurred affecting their probability and/or impact that changes their significance above a specific threshold level that needs to be determined from the outset across the organisation.
- treating as critical success factors risks that have high probability of occurrence and high impact. If such risks, critical to the success of the business strategy or a change management project, exist then they should be dealt with outside the risk register document elevated to business priorities.
- defining and standardising across the organisation what 'low probability, 'high probability', 'low impact' and 'high impact' actually mean in the organisational context, based on the organisation's actual past experience, enabling risk managers, risk owners and the business to use the same terminology making communications clearer.
By putting into practice the above points, I have found that organisations are left with a reduced number of well-articulated risks that are more effectively monitored and acted upon according to the risk management strategies and actions that have been agreed by the organisation and the person that has the responsibility to do so.
Costas Chryssou
MBA, PhD
Founder and Managing Director
Sign up for our
articles
Sign up to our newsletter
