Company Management- It’s a Risky Business
Picture this: you're at home, lounging in front of the fireplace and browsing for work. Business has been slow lately, and you are burning with restlessness for a new project. An advertisement pricks your interest: two weeks paid travel to one of Africa's most intriguing locations, doing a job you love and earning some big bucks in the process. Come on, what's there to even think about? Well, a good friend of mine recently received that exact opportunity. A very experienced exploration geologist, Ben has travelled all over the world, seeking and analysing metals and minerals. He has visited over 50 different countries, trekked the typical tourist trails but also hiked up many remote roads in rural regions. His latest adventure was to Nigeria, Africa. But here's the thing: Ben flew out on a Saturday, with only three days notice, no return flight, and no details of either the hotel or who was to collect him at the airport. Unknown to him, military insurgents were thought to be preparing another bomb attack on major city centres. The morning of his flight, news of the Ebola outbreak hit headlines. I was worried- sure, this was the opportunity of a lifetime, and Ben would be well reimbursed for his time. However, everything had happened so suddenly without any time to plan, and he was travelling to a dangerous, disease inflicted conflict zone. What could he do if things went wrong? The circumstances of Ben's situation were unusual, but the decision he had to make to balance the expected benefit against the possible problems face us all, every day. Risk management is about balancing these opportunities and potentially adverse situations. Individuals and companies juggle opportunities and risk every day in the workplace. And not only in the workplace. There are risks we must assess when crossing a road, turning on the stove top, or climbing a ladder. Most of these risks we manage almost without consciously thinking of them as they are so familiar to us. Where the risks are significant and unusual they must be managed consciously. Sky diving, for example, is an extremely high-risk sport. 2.6 million jumps are made annually in the US and on average around 25 individuals die each year. This number could be far higher, but what makes skydiving safer is the level of risk management. Risk is controlled through training, quality controls on equipment, weather monitoring, and safety procedures. Analysis of skydiving accidents show that most are caused by jumpers who make mistakes of procedure or judgment.[1] An important aspect of strong business ethic is to recognise that simply because a risk does not eventuate does not mean that the risk itself does not exist. At the same time, we can't just sit still and twiddle our thumbs, hoping for an amazing opportunity that doesn't push our comfort zones just a little. The solution is incredibly simple, and yet it's rarely implemented successfully. It requires that risks are identified, evaluated and appropriate action is planned and undertaken. Unfortunately, too often we don't fully analyse or plan for risks in our risk management policy, and the consequences can be severe. Consider this: Late in 2013, a Royal Commission was established to investigate what went wrong with the Home Insulation Program (HIP), an initiative rolled out across Australia during 2009 to 2010. Four young men died and hundreds of house fires resulted, and 12 months later the program was withdrawn. Subsequent investigations uncovered many cases of fraud, and insulation was removed from 50,000 homes with another 150,000 inspected for safety. In his findings the Auditor General, Ian McPhee, reported that "...the department underestimated the level of risk involved in an unregulated industry which used inexperienced workers to install insulation in ceiling spaces". It was revealed that, under pressure to re-invigorate the economy during the global financial crisis, planning for the program was conducted over a single weekend. But there were other problems: the level of demand was more than double original expectations; progress reporting was poor; early warnings of safety concerns and poor costings were allegedly not reported to senior managers within the department. As the program evolved further, the progress reporting process became increasingly deficient and unreliable. "...the stimulus package had a colour-coding system: green for 'on track'; amber for maintaining 'close watch'; and red for 'in difficulty'. Of the eight reports during 2009-10, all recorded the HIP as 'on track' until March 2010. By then, the four young men had died and the program had shut down".[2] The House Insulation Program was a tragic example of inadequate attention to risk management. There was insufficient time allowed at the start to plan the program properly, advice from experts was ignored, and reporting was woefully inadequate. Our responsibility for a business or a project or an activity includes managing the associated risks.
So How Do We Manage Risks?
The level of management and the detail can depend on both the significance and the breadth of the risks, as well as on the level of risk tolerance. If the project has the potential to impact others and the risks include adverse events that contain a high possibility of occurrence/serious consequences, then the importance of careful risk management is magnified. This process generally involves four steps:
- Identify risks;
- Assess for probability and consequence;
- Control the risks to prevent occurrence and develop contingency plans for residual risks;
- Monitor the ongoing levels of risk and update as required
Ideally this should be documented so the plans can be shared with other who need to be aware of their own responsibilities, and so that the Risk Management Policy can be reviewed and updated. Also consider the level of tolerance you or the business has for risks. Are you a Risk Taker or a Risk Avoider? To put it another way, Ben's capacity to tolerate travel risk is far different from my own. I was worried; he was cautious. But that's okay. Your approach to controlling risks might be different from others. This could be influenced by the number people you will affect, the nature of your business, the kind of activities you're embarking upon, and the reverberating effect that your business has on the environment. This might mean that you make decisions that others don't. It might mean that you implement a different process to better suit your needs. Great. Even thinking and working through the process can be extremely beneficial. Soon, this will be an express requirement under management standards such as ISO9001:2015 and ISO14001:2015. These express requirements take into account this very concept but phrases it as business context. See more about this here. What is the impact of this change? You cannot simply slap on someone else's risk management policy when it does not orientate itself to your individual business processes in light of the context of your business model. (Don't worry, Certex is rolling out articles about the new management standards as details become finalised). We all deal with risk every day. Building an effective risk management approach is fundamental to all successful businesses and projects. Ben returned 2 weeks later. He had seen a vastly different country, travelled through remote bush areas, tense road blocks and endured basic food and sleeping arrangements. Thankfully, nothing worse came of the trip. A ship is safest at the docks, but that isn't what ships are designed for. Just make sure you have adequate life preservers first.
Footnotes:
[1]: Skydive Mag - How Dangerous is Skydiving? [2]: ABC News - Report scathing of insulation scheme