A vital component for every risk management program is the risk register, where your risks are recorded and classified. Simply identifying the risks your business is exposed to is not enough. Let’s look at the QLD and Vic floods of recent weeks. If the organisations in these affected areas identified that they were in flood prone areas but did not record their exposure on a risk register and classified it, it’s quite likely that when the water hit their business was devastated. And many were as we know.
Now, take the business that identified it was in a flood prone area, recorded it on a risk register and noted that if the water reached their doorstep virtually all functions would cease. Customers would not be serviced, communications would fail, employees could not work, cash inflows would dry up and yet the bills would still have to be paid. Classifying this particular risk would mean looking at the exposure to the risk; in this case substantial (given the business is in a flood prone area) and the significance of the event; also substantial (given the business would not be able to function at all). This adds up to an identified risk with potentially disastrous outcomes.
We all know there is no stopping a flood like this one. And no-one really expected it to be this bad. So what can the risk register do for us in a situation like this one? With a classification such as ‘Extreme Risk’ we would have been compelled to put in place a contingency plan that allows the business to function despite having to relocate to a temporary site. Of course, this is not possible in some cases where manufacturing equipment is used for example, but relocating sales, customer service, admin people etc, the business could still function at the front end and communicate with customers etc. This would have been a much better outcome for many businesses.
So, the risk register records your risks, provides the means for classifying them and gives an indication of the implications of the risk. It also provides the template for reviewing your risk management plan on an ongoing basis.
For more information on risk management visit www.somconsulting.com.au
January 31, 2011 at 9:15 am |
When setting up a risk register it is important to think about how you want people to interact with the risk register. If more than one person is meant to update and service the risk register, so it is always up to date, a spreadsheet based risk register is not the best solution. Instead a web based risk register like http://mediumrisk.com provides a good platform for communication and interaction about risks. The possibility for defining accountabilities and getting reminders when tasks are overdue is an important step for reducing risks. A web based risk register is also perfect for cross-organisational projects where many people need to access the risk register.