RASCI Template
RASCI Template Share on facebook Share on twitter Share on linkedin Share on email Share on whatsapp The RASCI matrix is a visual business tool used to define the…
Every business has risks that are inherent to them, some are easily foreseeable while others fall into unknown territories. Organizations and projects need to create a risk management & control process that ensures that the business has awareness of key risks and takes the appropriate action, whether to accept, mitigate, transfer or avoid it. There are major challenges in making risk management decisions, this article aims to emphasize the importance of risk control and the creation of procedures & guidelines to ensure the company is well covered.
What is Risk Management & Control and Why is it Important?
Risk management & control is a proactive approach to determining, defining and potentially resolving issues that may occur throughout a project or operation. It provides an organization with means to accept, mitigate, minimize and potentially avoid events that may occur based on the entity’s risk profile. Even when risk is accepted or mitigated and the problem still occurs, a risk management & control approach may give the team enough information to make a more informed and faster response to the challenge at hand. Below are a few examples of risk control and monitoring cases and approaches that can help enhance the risk control process:
- A confidential document has reached the media with the potential to cause a material impact on the business. Before the incident, Elliot02 Inc. built a procedure to assess the likelihood of an event of this nature occurring. It also set-up a monitoring and procedural capabilities to catch and react to the issue before it got out of hand. This has given the company the means to respond faster and limit the cost to the organization.
- Before a critical software infrastructure outage, an organization may want to respond to the following questions: What happens if software X has an outage? Who is impacted by the outage? Are there alternative software/tasks that the employees can use/do while the system is offline? What are the steps taken to resolve the issue? What is the maximum accepted time-off (MAT) for the software? Who should be notified? What is the potential economic cost? What is the potential reputational cost?
- Prior to a security breach, an organization may want to respond the following questions: What happens if there is a security breach? What is the extent of the breach? Who is impacted by the breach? What are the steps taken to resolve the breach? Who is the point of contact (POC) for security breaches? Who should be notified? Have they been notified?
- Before a human resource disruption, an organization may want to respond the following questions: What happens when a key employee is not available (vacation, time-off, etc)? Who takes charge of the tasks? Have they been trained to do the task at hand? What should be prioritized? Does the employee in charge of the new tasks have enough non-essential available time to cover for the new priority tasks?
How to Implement Risk Control Processes With Limited Resources?
Most companies have challenges in making risk management decisions due to limited resources that are available to the whole business, this in turn leads to less robust or non-existent risk management & control practice. To ensure that your business is better positioned, here are a few things to consider:
- Hire an external source to analyze the company’s risk control processes and provide a tailored assessment of your company’s current risk control processes and how it can improve. Remember that a risk control process is not simply a document that details what to do on certain occasions. It is more like a complex machine that needs to have all of its parts and engines properly taken care of for the entire machine to work. Therefore, employees not only need to be trained but also reminded of the importance of their risk awareness; software needs to be properly updated, maintained and checked after to avoid any breach, and; management needs to maintain awareness of the issue so the mindset is translated to employees and the whole machine have a better chance of working flawlessly
- Groups with very limited resources may need to depend more on the team’s expertise. For certain risks, this may be the most effective course of action regardless, however, it is important to note that it leaves a lot of discretion to the individual’s experience & knowledge and the way they perceive the company or issue at hand which can magnify the problem. For example:
- A server comes across a very hostile patron, should they try to de-escalate the tension, ask the manager to resolve, or something else? What if that solution does not work, what would be the second or third step?
- A key SharePoint website goes out of service. Does the team know the stakeholders involved, how to reach-out to them and how to tailor their responses to each stakeholder (E.g. external clients, internal clients, directors, analysts etc)? Does the team have a guideline to follow to ensure that the troubleshoot goes smoothly?
- Use prior mistakes as a basis for future guidelines. Mistakes are if anything a learning opportunity for all businesses.
- Use online guidelines provided by the government or industry experts to facilitate and decrease the amount spent in this process. If you are lucky enough, the government of your country may already have some guidelines and processes outlined in a website. Those outlines or mock-processes can serve as a basis for your procedure or even if you already have a procedure, they can be enhanced by a comparative analysis with the government’s document. If your government does not have such documents, use another country’s if that page is open for you. For instance, the Canadian government has this guideline for Risk Management.
- Talk to your employees and ensure that they are engaged in the risk control process since they are usually the first line of defense when a risk arises. Traditional computerized training is not as effective as one may think, often employees get bored due to the training not being interactive enough or too simple, or even too long. So, the best policy is to reinforce such training by having the person’s supervisor, manager, or senior colleague talking to them and reinforcing the topic.
Follow Government Guidelines & Base Your Requirements on Government Requirements
In some areas, governments around the world provide base guidelines, recommendations and/or requirements to support the company’s risk control process. Ensure that your business is in full compliance with the requirements and that it uses government’s guidelines and recommendations to decrease the time spent creating your risk profile and emergency procedures.
Determine the Audience & Degree of Importance to the Business
Companies need to determine the audience & degree of importance that a risk has to the business. When applicable, management should involve the relevant parties and provide the training necessary to minimize risk. Involved parties should be trained to understand and determine and use the resources available to them. In cases such as cyber security, all employees may need to be trained in that area to some degree. Training and awareness need to be assessed on a need-to-know basis to ensure that individuals do not get overwhelmed or that it harms the organization.
Company Prioritization
Companies have limited resources, therefore they should learn to prioritize the areas in which disruption has the highest impact. In some cases, a disruption is expected to happen regardless of how well the business tries to protect itself (e.g. legal matters, cyber-attack procedure). In such a cases, the business should look into having a point-of-contact (PoC) for that segment and perhaps even a department to assist in mitigating or limiting the cost associated with that risk. Assessment of the cost to mitigate in comparison to the risk of the cost should be analyzed before opening a new department or creating a new team for that area.
Create a company/sector-wide general guideline
Companies should look into creating a company or sector-wide general guidelines (when possible) to assist managers and their teams. Some software or department may require a higher level of specialization when creating emergency procedure guidelines. This means that the team involved in that area (e.g. SAS team, SAP team, mergers & acquisition team) may need to personalize their risk control guidelines. Companies should encourage these teams to use the baseline and templates provided within the company/sector-wide general guideline. This can potentially decrease the time spent creating specialized emergency procedures and allow the team to have a baseline of what is expected.
Too Much Risk Management can be its own Risk
Risk management provides organizations with a framework and tools to reduce or offset risks. At times, risk management can be pushed too far, creating further challenges in making risk management decisions, leading to major inefficiencies. For example, too much risk management can extend the amount of time needed to plan and execute a project to a point where the return on investment and feasibility becomes inadequate.
There is a delicate balance that leadership has to consider when creating the incentive mechanisms of risk management. Failure to do so can cause the organization to promote overly safe practices that stifle innovation, operational efficiency and ultimately leading to organizational stagnation. It can also have a profound impact on hiring and promotion practices, leading to managers that prefer excessive caution as opposed to a balanced risk profile.
It is important for the organization to be cognizant of its risk profile and to revisit it from time to time to ensure that it remains viable. Risk aversiveness can lead to stagnation and consequently cause the organization to become obsolete.
Run Practice Tests
After all is done and running, put your procedure to test and assess the overall quality and response of your procedure and your teams. Some companies even go beyond and completely fake a risk situation and assess how employees deal with it under pressure. Sometimes, that is not a viable option for certain businesses or departments, however a stress test can always verify how efficient your procedure is. Remember that your employees are a key part of any risk mitigation procedure and tools are always there to aid them to navigate through the everyday risks of your business.
Communication Plan Template
Communication Plan Template Share on facebook Share on twitter Share on linkedin Share on email Share on whatsapp Communication helps instill important information between different parties, helping to build…
Team Charter Template
Team Charter Template Share on facebook Share on twitter Share on linkedin Share on email Share on whatsapp Team charters can help teams, projects and organizations build the rules…
