Risk-based working in practice

Risk-based working in practice by Martin van Staveren

Of this book I only found a Dutch version. But the ideas are too important not to share.

Within Risk-based working in practice, the author wants to show that there is another way to risk management than looking away from risks, or creating false security with a paper tiger that is supposed to represent risk management.

The book provides a different approach than conventional risk management, by integrating Risk Management into the operation of the organization. The author explains what is involved in four chapters. What did I remember?

Contents

• Today’s Organizational Landscape
  • Dealing with uncertainties
  • Five principles
• The what and how of risk-based working.
  • Uncertainty
  • Risk
  • Risk perception
  • Risk management
  • Six risk process steps
  • Set of tools
• Conditions for risk-based working
  • 15 conditions of support
• 10 Tips for risk-based working

Today’s Organizational Landscape

Chapter 1 begins with a description of the contemporary organizational landscape, with its changes, uncertainties and lack of time. These three factors have an impact on everyone’s working life in organizations. Despite this, they want to achieve the objectives.

There are relationships between organizational change and uncertainty due to the reasons for the change and the outcomes of the change.

Uncertainties are the cause of why organizations change. Changes lead to new uncertainties. This often leads to gathering more and more information, collecting and researching and intensive meetings/coordination. As a result, there is a lack of time. Just going to work more is not a solution.

Dealing with uncertainties

Dealing with uncertainties in order to achieve objectives sometimes means limiting risks, sometimes doing something else, but often also taking risks consciously. In a professional manner with the correct use of tools. And that leads to the question “What is the current reality of (risk) management in organizations in relation to dealing with uncertainties?”.

Or: does the usual way of managing help in dealing with the uncertainties of change or does it work against it? Does it reduce time pressure or does it all take more time?

One of the conclusions is that risk management appears to be necessary to achieve the objectives, but is often not applied broadly, in-depth or effectively. Despite the fact that organizations are increasingly faced with complexity, conflicting interests, calls for more and more frequent accountability, and an ongoing difficult economic situation that require change, risk management is rarely enthusiastically welcomed. This is the risk paradox.

To this end, it is necessary to move from conventional (risk) management to innovative management. According to Wouter Hart, this means the following:

Five principles

Furthermore, this chapter provides five principles with which High Reliability Organizations (HROs) deal with the uncertain and the unexpected:

1. Focusing on disruptions: mistakes are normal. However, avoid escallation of it.
2. Reluctance to simplify: not everything on an A4 sheet of paper.
3. Sensitivity to execution: Focus on the primary work process.
4. Commitment to resilience: no ‘anorexia organisations’. In that case, a single case of illness causes major problems.
5. Respect for expertise: decision-making by the subject matter experts instead of managers.

The what and how of risk-based working.

Chapter 2 is about the what and how of risk-based working. This must be integrated into the existing processes.

First, the chapter discusses these four key concepts as foundations:

Uncertainty

• Uncertainty is incomplete certainty caused by unavoidable variation and/or lack of information.

There are seven sources of uncertainty due to lack of information (Van Asselt and Rotmans)

Risk

• Risk is an uncertain event with causes, a probability of occurrence and effects on objectives.

A practical classification of causes in “Understanding industrial crises by Shrivastava: HOT-RIP

An important note is that a risk is not just a chance times a consequence.

Risk perception

• Risk perception is the unique way in which a person perceives a risk.

It is not a question of right or wrong, but of different.

Important concepts for risk perceptions are availability bias, optimism bias, and confirmation bias. Diversity in vision is a solution. Different risk attitudes are possible: risk paranoid, risk aversive, risk tolerant and risk-seeking.

Risk management

• Risk management is goal-oriented, explicit, structured, communicative and continuously dealing with risks.

There are the following misunderstandings about this:

• ‘Risk management offers 100% certainty, from now on everything will go well.’
• ‘Risk management is difficult.’
• ‘Risk management is about predicting the future.’
• ‘Risk management is only about avoiding risks and is therefore only for risk-averse and anxious people.’
• ‘Risk management is just about filling in lists.’
• ‘Risk management is expensive.’

Six risk process steps

In doing so, these six risk process steps come to the fore:

1. Setting goals.
2. Identify risks.
3. Classify risks.
4. Managing risks.
5. Evaluate risk measures.
6. Transfer of risk file

These six steps can be found in frameworks such as ISO 31000, COSO ERM, RISMAN.

All six can be used in any of the six usual project phases:

1. Exploration phase
2. Preliminary design phase
3. Tendering phase
4. Final design phase
5. Implementation
6. Usage Phase

Set of tools

The chapter then discusses these eight commonly used tools: these are also not unique to risk-based working and can be found in the literature in one form or another:

• The risk file
• Risk sessions
• Scenario analyses
• Risk-based research
• Risk-based monitoring
• Herringbone method with cross table
• Contractual risk allocations
• Risk scans

The working definition of risk-based working then becomes:

‘Risk-based working is the application of the six generic risk process steps in work processes.’

In doing so, the 20 characteristics from the first chapter are explained.

Conditions for risk-based working

Chapter 3 presents the most important conditions that must be present in organizations in order to actually be able to implement risk-based working. After all, there are obstacles, such as:

• Lack of time.
• Subjectivity of the risk assessments.
• Fear of Gray Rhinos emerging from the fog of false security.
• Difficulty in choosing control measures.
• Not wanting to deviate from existing working methods.
• Don’t want to see risks. (“I have a CRO for that.”)

So how can risk management be implemented in organizations?

There are four general things to say about it:

1. The form, function and meaning of risk management are largely intangible and subjective, which complicates effective, efficient and sustainable implementation.
2. Specific attention to the implementation of risk management is underdeveloped.
3. The implementation of risk management requires a combination approach of risk management, innovation management and change management.
4. Risk management methodologies must be adapted to the structure and culture of the organization and the different types of intended users.

Points 1 and 2 are bottlenecks, points 3 and 4 are solutions.

15 conditions of support

There are a total of fifteen conditions that support the embedding of risk-based working in organizations. These can be grouped as follows:

1. Conditions for the organizational structure:
   1. Roles, tasks and responsibilities have been formally agreed upon.
   2. Dealing with risks has been formally delegated to people who do it as part of their day-to-day duties.
   3. The handling of risks in relation to the objectives is formally reported to managers and supervisors.
   4. Formal agreements have been made to adjust the work process of risk management on the basis of advancing insight.
   1. It has been formally agreed that the external environment of the organisation will be involved in risk-based working.
2. Prerequisites for the organizational culture:
   1. Unambiguous working definitions for risk-based working are used throughout the organisation.
   2. Throughout the organization, it is realized that risk assessments are partly subjective.
   3. Differences in risk perception and risk attitude are explicitly expressed and discussed throughout the organization.
   4. Risk-based working is carried out through collaboration in multidisciplinary teams with members from inside and outside the organization.
   1. The exchange of risk information is a matter of course throughout the organization.
3. Conditions for the method:
   1. The method is available and accessible to all intended users.
   2. The intended users perceive the method as user-friendly.
   3. Use of the method provides relative benefit to the intended users.
   4. The method fits seamlessly with the work processes of the intended users.
   1. The costs for purchasing, developing and using the method are acceptable.

10 Tips for risk-based working

Finally, in the fourth chapter, the author explains ten tips for risk-based working:

1. Risk-based working is not a guarantee of success.
2. Risk-based working is more than a risk analysis.
3. Instruments are supportive, not leading.
4. Courses are just the beginning and often the end.
5. Do a baseline measurement of the conditions.
6. Create a flexible deployment plan.
7. Managers need to create conditions.
8. Differentiate in applicators of risk-based working.
9. The step from early birds to followers is a leap.
10. Monitor the progress of risk-based working.

Title: Risicogestuurd werken in de praktijk, Author: Martin van Staveren, Publisher: Vakmedianet, ISBN: 9789462760202