Roadmap to Risk Management
The main cause of uncertainty in any organisation is a risk, and therefore the importance of risk management is that it can help organisations identify what risks are causing this uncertainty and put processes in place to manage these risks before they impact the organisation. If performed correctly, risk management can lead to a range of benefits such as better decision making and value for money, more effective use of resources and greater innovation together with fewer nasty surprises.
Across the next few issues of our Not for Profit eNews, we will discuss the importance of key aspects of an effective risk management framework, some of the questions that you may need to consider in relation to this and possible actions to take for your organisation.
This will include:
- The importance of objectives in risk management
- Breaking down and understanding your risks
- Understanding your control environment
- The benefits of a dynamic assurance framework
We start though with the overall risk management framework itself, as having in place an agreed framework that is well understood by all a fundamental building block for ensuring an effective risk management framework and therefore the key first step in developing your arrangements. We have therefore set out below some of the key points to consider in developing such a framework and the type of stakeholders you may involve in the framework development process.
Bring onboard the Board
Risk management works best when the process is well understood and there is clarity over the objectives of your risk management system and the structure and framework by which it is embedded throughout the organisation.
Whilst the initial design of your arrangements can be assigned to one or two individuals it is important that the board is brought into the process at an early stage and is involved in the decision-making process as to how the final system will look like.
Risk Management does not work well when it is something that is done to an organisation and needs to be something that is done with the involvement of the Board and senior managers in order that there is clarity and agreement regarding what you are looking for in the process to achieve.
The use of workshop and business development days can be useful forums to work with the board in developing and agreeing on what this framework will look like, in addition to considering other factors such as how and where risks will be reported.
Keep it simple
There is sometimes a tendency to build complex risk management structures as this is thought to provide the most effective solution.
Often the simplest risk management processes are the ones that work the best as these are the easiest for everyone, from the board to operations, to understand and therefore has the highest chance of success.
It is easier, once simple structures are embedded and operating effectively to add additional layers to the process than to try and simplify a process which is too complicated and widely misunderstood
Write it all down
It is important that your overall approach to risk management is documented within an overall Risk Management Strategy or Policy so that it is clear as to what the overall framework for risk management is, where responsibility sits, and what the process is for recording risks on the risk management system.
Such a document should be easily available to staff via the intranet or similar.
Be adaptable to change
When you are developing a framework that needs to be bought into by a diverse range of stakeholders, it is inevitable that there will need to be an element of change from the framework which was originally envisaged.
As detailed above, risk management frameworks work most effectively when they are easy to understand and there is buy-in from everybody, and therefore an element of adaptation to accommodate different views across stakeholders is likely to bring dividends in the medium term.
Such a flexible approach must also be maintained over time; as stuff happens your processes will need to be dynamic to respond to these changes.
Does it answer the “So What?” Question
The risk management framework must have a defined purpose and provide beneficial outcomes to the organisation through improved awareness of the key risks faced by the organisation and the arrangements that are in place to manage these.
If your framework is not going to achieve this then it probably needs reconsidering to ensure that it is delivering benefits in your ability to manage risks.
What can MHA Moore & Smalley do to help me with my risk management?
Pulling all of the above together should enable a consultative and inclusive approach to be taken to the development of your risk management framework, which ensures collective buy-in from your board and leadership team and the development of a framework that can be embedded throughout the organisation.
MHA Moore & Smalley has a long history of supporting not-for-profit businesses in helping stakeholders identify risks within the organisation.
If you are looking for assistance on how to manage risk in your business and are looking for expert advice, our charity specialists will be happy to help.