Assessing and managing corporate risk

This means that first class, strategic and integrated approaches to risk and ways to manage it remains a rarity in organizations.

However, this problem doesn’t need to be terminal. Comprehensive guidance contained in the Management of Risk (M_o_R^®) framework provides a route map for organizational risk management. For project and programme managers it also enables better enterprise agility which will be needed as organizations pivot in the future as a result of market changes.

The guidance is designed to help organizations establish frameworks for decisions about risk and put it firmly on the C-suite agenda.

Its principles and processes provide a method to identify, assess and control risk – and show how risk management can be integrated and tailored to portfolio, programme, project and operational levels.

The principles enshrined in M_o_R cover a range of elements essential to effective risk management, for example:

• Aligns with objectives – the risks you manage should relate to the organization’s strategic objectives
• Fits the context – therefore possible to implement anywhere
• Engages stakeholders – including those that like to deal with issues rather than risk
• Provides clear guidance – embeds processes and informs decision making
• Facilitates continual improvement – learning lessons and improving performance.
• Creates a supportive culture – to get buy-in and shows commitment to mitigating risk
• Achieves measurable value – using a structured approach to risk management is intended to create and protect organizational value.

Creating the right type of documentation is a mandatory part of using M_o_R.

Why? This articulates the organization’s approach and enhances the governance process. Without this documentation, organizations will lack the material to show, share and obtain C-level endorsement and confidence.

Central to the M_o_R approach is the creation of a set of documentation that describes how the organization will implement risk management, comprising:

• A risk management policy which communicates why and how risk management will be implemented throughout the organization.
• A risk management process
• Risk management strategies for each organizational activity.

The M_o_R approach also recommends three types of mandatory documents which include records, plans and reports:

• Risk register – which captures and maintains information on all of the identified threats and opportunities
• Issues register which captures and maintains information on all identified issues that are happening now and require action.

• Risk improvement plan – assists with embedding risk management into the culture of the organization and to document planned improvements

• Risk communication plan – describes how information is disseminated to, and received from, all relevant stakeholders of a particular organizational activity

• Risk response plan (integrated with the project plan) – is linked to the response field of the risk register and details specific plans for responding to a single or linked set of risks.

• Risk Progress Report- this provides regular progress information to senior management within a particular organizational activity.

In turn, the risk management process – as outlined by M_o_R – comprises four steps:

• Identifying the risk
• Assessing the risk – impact, probability, proximity
• Planning
• Implementation.

In addition, communication is a continuum throughout. Overall, the risk management approach should make clear sense to anyone responsible for owning and managing risk and is hugely effective.