The recent pandemic has changed our perceptions about a number of things. As individuals and organisations, many have been recalibrated on what constitutes a crisis and the extent to which external factors can impact our finely crafted plans. Many have seen an acceleration of their digital transformations and what can be achieved whilst working remotely. As we emerge with a catalogue of lessons learned and new ways of working, it is an opportune time to revisit our understanding and approach to risk management.
Risk Management, at its best, is a catalyst for positive change and progress. It allows us to capture, analyse and understand uncertainty so that we can take proactive steps and provide confidence to our teams and stakeholders. Risk, in the absence of robust management, can be quite the opposite. Uncertainty quickly becomes something to be feared, analysis becomes a magnet for more and more questions, and the entire governance structure can seize up – focusing entirely on fire fighting and interrogating as to what went wrong. The underlying difference between effective and ineffective Risk Management is the risk culture within an organisation.
Culture is the sum of the attitudes and behaviours of the people within your team. The attitudes of individuals towards a given subject, such as Risk Management, will directly influence their behaviours. Furthermore, the observed behaviours of others will directly influence our attitudes. Together, these attitudes and behaviours will ultimately set the culture and profoundly impact the enterprise approach to Risk Management far more than any process or policy document. Importantly, the feedback loops between attitudes, behaviours and culture can be both positive and negative. Consequently, both good and bad practices can be amplified very quickly across your teams.
It is imperative, therefore, that we capitalise on the positive feedback and amplify Risk Management culture in the direction we would like. How does Risk Management feature in our decision making? How do we communicate our risk appetite? How do you reward positive (and negative) behaviours? For example, it is very tempting to congratulate and idolise those individuals and teams that perform heroics and fire-fight their way through delivery by the seat of their pants. But what about those individuals and teams that put in the hard yards to get ahead of the crisis, reducing the probability of it occurring and minimising the negative impact if it does? The prevailing Risk Management culture within your organisation will be directly impacted by the attitudes and behaviours encapsulated in your answers to these questions and many others.
Change, like death and taxes, is one of the certainties of life. Consequently, and somewhat paradoxically, there will always be uncertainty to manage. A positive Risk Management culture will not eliminate the negative impacts of uncertain events on your organisation, but it can provide resilience against them and strengthen stakeholder confidence in an uncertain world. Those taking an “I told you so” approach to the recent pandemic and entrenching their risk-averse attitudes and behaviours will likely be the organisations that will suffer the negative impacts of the next unknown event down the tracks – whatever it may be and whenever it may happen. Those who culturally embrace uncertainty as something to be understood and managed will be those more likely to capitalise on the multitude of opportunities that lie ahead.