Risky business

This month John Cowling, risk and value management consultant at F+G, looks at why and how risk should be identified on both a human and financial level.

So why should we identify risks? If we accept that a broad definition of a risk is ‘a possible threat or opportunity which will in some way affect the outcome of a project or objective', then we allow ourselves to begin the process of managing the ‘known unknowns'. This flows into the concepts of business continuity plans and how our business could recover from potentially disastrous events.

It is important to note that risks are not issues, risks are future phenomenon that may occur, and issues are an event that it is happening here and now.

So, before we can implement recover/response plans for risks, we first need to identify the risks. Then we consider multiple options (analyse), evaluate these options and select the most appropriate to suit the business need, implement the response/mitigation plans and monitor and review the plans.

Why we should identify risk

We can approach this process from one of two concepts: ‘doom and gloom' or that the ‘glass is half full'. Our perspective at F+G is that we should be creating opportunities to improve our client's operations, and thus their overall business. Ideally we are allowing their business to operate with an eyes wide open approach.

When an organisation implements a risk management system, careful consideration needs to be given as to how it will formally identify its risks, and then follow through the process with the aim of mitigating risks to an acceptable outcome.

Simple approaches are often the most effective. Using a standardised approach to the identification phase will allow personnel to more easily understand and thus utilise the system, with the benefits of increased usage, reporting and thus an earlier response.

Using a formal statement allows those personnel to easily grasp the complexity of the process, without having to be an expert in the entire process, and would allow more junior team members to escalate the risks to the appropriate level. So we need a balanced approach.

An example of the formal statement could be: ‘As a result of definite cause, an uncertain event may occur, which would lead to an affect on our objectives."

Then a scenario could develop where by the statement is: ‘As a result of unanticipated failure in the building's air conditioning system, stoppage of tenant's business operations may occur, which would lead to a reduction in our revenue and damage to our reputation (against our objective of providing a 24/7 operational facility, etc).'

A junior team member may not be able to grasp all of the complex revenue implications of disruptions to a tenant's operations, and escalating this upwards in a formal manner, will ensure senior management deal with the issue.

Legionnaire's disease

Let's consider the case of the Melbourne Aquarium where, in simple terms, the maintenance of the cooling towers by an external contractor was not carried out to the required standard. Subsequently, a number of visitors became ill, of which 125 people were diagnosed with Legionnaire's disease. From these 125 confirmed cases, 95 patients (76 percent) were hospitalised and four (3.2 percent) died.

READERS' COMMENTS

MORE FROM ARABIANBUSINESS.COM