Risk Management : Important or Effective (or both)?

 

We recently conducted some research in partnership with Peter Kulik to investigate how organisations perceive the value of risk management. The survey addressed a number of different aspects, but two questions were particularly interesting. The first question asked “How important is risk management to project success?”, with possible answers chosen from extremely important, very important, important, somewhat important, not important. The second question asked “How effective is risk management on your projects?”, with answers ranging from extremely effective, very effective, effective, somewhat effective, or ineffective. Of course the raw data was interesting in itself, but the correlation between answers to these two questions was fascinating. If the answers to each question are simplified into two options (positive or negative), then there are four possible combinations :

1. Risk management is important and effective
2. Risk management is important but not effective
3. Risk management is not important and not effective
4. Risk management is not important but it is (somehow) effective

Perhaps the fourth combination is not really feasible, since it would be unusual for risk management to be effective if the organisation does not consider it to be important. Indeed if it is viewed as unimportant it might not be done at all. But the other three combinations represent different levels of risk management maturity, and organisations in each of these three groups might be expected to act in very different ways.

Where risk management is seen as important and it is also effectively delivering the promised benefits (Combination 1), those organisations could become champions for risk management, demonstrating how it can work, and persuading others to follow their lead. These risk-mature organisations might be prepared to supply case studies and descriptions of best-practice, allowing others to learn from their good experience.

If an organisation believes that risk management is important but is not finding it to be effective in practice (Combination 2), then they should consider launching an improvement initiative to benchmark and develop their risk management capability. Tackling the Critical Success Factors (CSFs) for effective risk management will lead to enhanced capability and maturity, allowing the organisation to reap the expected benefits. Key CSFs include a risk-aware culture, efficient processes, experienced and skilled staff, and consistent application, among others.

It is not surprising that risk management is ineffective in organisations which believe that it is unimportant (Combination 3), as it is not possible to manage risk effectively without some degree of commitment and buy-in. These risk-immature organisations should be persuaded and educated about the benefits of risk management to the business – a task best performed by convinced insiders who can show how proactive management of risk could be applied to meet the specific challenges of the organisation.

It is a good idea for every organisation to review its position on risk management against the two dimensions of importance and effectiveness, and to take appropriate action to move up the scale of risk management maturity. Risk management offers genuine and significant benefits to organisations, their projects and their stakeholders, but these will never be achieved without recognition of the importance of managing risk at all levels in the business, matched with operational effectiveness in executing risk management in practice.