Managing your risk

At a basic level, identifying risks can start with a simple brainstorming exercise. It is best done by leaders with operational responsibility as they best know the practical aspects of any risk. Getting an external or independent perspective will also ensure that you don’t miss critical risks from being too close to the activity to be objective.

Once you have created your list of risks, you need to do a simple exercise of systematically determining how important these risks are. Use the universal risk matrix table to help rank the risks based on the likelihood of occurrence and then just how much impact the event would have on your organisation.

Once you have a list of analysed risks, it is time to prioritise them. Rank the risks in order of the highest risks to lowest. At this point many organisations get overwhelmed and give up. We recommend that you select the top 10 risks to start with. It is better to deal with the most important risks properly first, then move on to the other lower priority risks.

There are five things you can do about a risk/uncertainty. The strategies are:

• Avoid the risk. Do something to remove it such as ban the activity.
• Transfer the risk. Make someone else responsible. Perhaps engage a contractor or a third party. Getting appropriate insurance coverage may be a risk transfer strategy.
• Mitigate the risk. Take actions to lessen the impact or chance of the risk occurring.
• Create risk strategies, plans and policies for risks and adjust behaviours where necessary to reduce the risk.
• Accept the risk. You might calculate the risk and decide that it is worth taking on for yourself.
   

Every organisation, big or small, should allocate one or two people to champion and manage the risk management process. They should provide regular reports to the board as well as coordinate the assessment of any new activities.

It is appropriate to conduct a comprehensive review annually and looking at any incident and near miss trends. It is best to schedule in advance.