Risk management

After a weekend of snow, it seems like a good time to talk about risk assessment and management. We’ve had to make a few decisions about Church access during this weather so risk management is significant.
I started working with risks back in the ’80s. We developed a Risk Assessment Checklist to help people understand the risks associated with their IT projects. One internal department asked to review this tried to veto it saying “we can’t suggest there’s any risk in using our equipment.” Fortunately we prevailed. The checklist was only a start of the process to ensure that risks were understood and, more importantly, managed effectively.

The HSE and other bodies have increasingly introduced “Risk Assessment” to our lives over the last few years. The motivation is excellent but the details and practicalities are rather weak. In particular, they concentrate on assessment only, not management.  To be fair, the documentation does cover actions to address risks but very often this isn’t followed. A good example of bureaucratic risk assessment was the Young Enterprise company a few years ago. They were planning an X-factor event in the school hall. One of the students said to me when we were looking at their plans “Don’t worry about Risk Assessment – the office is doing this for us” When I probed, they were content that the office had filled in the forms. What about anything the students should do to manage risks? We see a similar cavalier approach to risk management in lots of incidents.

So my approach to risk management is to be aware of the risks, to understand the potential costs if the risks occur and, most importantly, take action to keep the risks at an acceptable level. There’s a simple diagram that I find helps. This plots the probability that a risk will occur against the impact or cost if it does occur. It’s not a precise process! There’s a line on the graph to help with decisions about the actions – the responses – to address the risks. Any risk whose probability/impact is above or to the right of the line needs to be fixed – a response agreed to either reduce the probability or reduce the impact. Responses can include doing something different from the original plan to having a contingency plan to operate if the risk occurs.


Another factor worth considering is the cost of the response. There are often low-cost responses that can reduce significantly the chance of a risk occurring. These are particularly appropriate when the potential impact is extremely high. There are some good examples of these when driving. For example, driving along the sort of roads we have around here where drives to houses are concealed there’s a risk that a car will come out of one of these into your path before the drive can see you. Small chance but very costly if it does occur. The chance of this occurring can be significantly reduced by driving nearer the centre of the road than one would otherwise do so. Clearly, you have to pull over if someone is travelling in the opposite direction but there’s time for this. So I tend to drive near the middle of the road in these conditions and, for example, when passing parked cars, the doors of which may open without warning.


So Risk Awareness is the essence. Awareness not aversion. And getting sensible responses in place to match the assessed risks. So we cancelled a planned meeting in Church this evening. The potential risks were injury to participants caused by slipping on the slippery snow or ice; small attendance numbers because of the poor weather; lack of attention during the meeting by people worried about walking or driving home. The cost of a postponement response was very low: there was no time-dependence on holding the meeting and the work to communicate, while not insignificant, was manageable. So we postponed. I hope, by the way, that nobody struggled up to Church because they hadn’t heard!