Risk Management - what could possibly go wrong?

Many organisations spend a lot of time thinking about risk. In many public bodies, risk registers are discussed at every board meeting. Measured by the amount of risk management activity, risk is a priority for many. But how much does all that activity actually achieve?

I remember looking at the risk register of an organisation a few years ago. It was full of weird and wonderful risks. But people seemed reluctant to put things on it that not only actually happened from time to time, but did the organisation quite a lot of damage! It was as if the more obscure the risk, the better.

That approach wasn't just a waste of time. It also indicated something more important - that people hadn't quite got their minds around what the whole risk management business was about.

Similarly, I have seen organisations with very complex risk management systems, often using immensely complex spreadsheets.

Risk management though isn't about a clever spreadsheet - however beautifully colour coded it is.. Risk management is about taking action that stops bad things happening. That means identifying the right things, working out what to do about them, but most importantly - doing something.

A good process must start with good risk identification. If you don't start with the right risks, it is very unlikely that you will get to the right actions. It is worth starting afresh from time to time and asking basic questions: what are the objectives of our organisation, and what might stop us achieving them.

I know that a lot of people think that risk management is boring. But it really shouldn't be. Risk management is a basic part of business planning - knowing what you want to achieve and how you intend to achieve it should lead you pretty quickly to identify the things that might stop you. If those issues don't interest you, maybe you're in the wrong business!