Ask the Expert: Enterprise Risk Management in easy steps with Chris Bell

 

Enterprise Risk Management (ERM) sounds pretty advanced, like a bigger, better version of ‘ordinary’ project risk management. So what is it and is ERM really more complicated to do than the risk management we are all familiar with? I asked Chris Bell, Chief Marketing Officer at Active Risk.

Chris, tell us a bit more about what ERM actually is.

ERM is a scalable, holistic approach to risk management that consolidates and organizes risk information from across the organization into one location so that it may be used for improved decision making. By embracing ERM and creating a risk management culture, organizations can drive business performance, innovation and growth, while protecting company reputation and shareholder value.

OK, I can see that could be a really valuable function for a PMO – to be able to have all the risk information from across multiple projects in one place. If companies want to do this, how do they get started?

Unfortunately, too many leaders still perceive risk management as a complex progress. In reality, there are six steps that need to be followed to enable organizations to optimize the strategic value of risk – regardless of the industry, vertical, size or scope of the project.

First, employees across the business identify the risks currently facing their project or organization. It is critical to identify all risks, including risks that are low probability but high impact, which may have been ignored in the past. While each employee may know several risks, getting everyone into the same room to identify risks together will quickly yield a more comprehensive, more accurate list.

Yes, that’s the same approach as we use on projects, but spread out to include everything managed by the PMO or company. What next?

In the analyze step, teams evaluate each risk individually. How likely is the risk to occur? Who/what will be affected if it does occur? What are the business implications of the risk (e.g. schedule, budget, and scope)? Most risks have more than just a financial impact, so all business implications should be considered. This analysis should start to bring to light the interconnectivity of risks, and some of the connections may be surprising. For example, several different project teams may be relying on the same supplier or the same piece of equipment to meet different schedule and budget requirements, taken together that might cause a problem. At the end of this process, the team should have a comprehensive list/database of risks that can be organized by probability and impact to the project or organization.

Then the team agrees on the best course of action to manage each risk. This is where strategy is key. Often, the team will need to consider the business impact of the risk occurring versus the business impact and cost of controlling or mitigating the risk. If it makes sense to mitigate the risk, the team will discuss steps for risk reduction, risk transfer, insurance, and other options. At the end of this step, leaders should have a clear picture of all relevant risks, how they interrelate to each other, and how they will be managed moving forward.

The PMO would be a good place to keep this information, although it would have to be kept up to date regularly with assigned owners.

That’s correct. The monitor step is about accountability. A person or team should be assigned to each risk, so that they are responsible for monitoring and executing the mitigation plan.

So that’s where it ends?

No. There’s another step for organizations to streamline and enhance their ERM process and risk culture. Are the right people involved? What new risks can be identified? How can we improve the way we’re managing existing risks? Organizations should reward – not penalize – those who share risk information. The earlier a risk is identified, the easier and cheaper it usually is to stop it happening or reduce its impact.

Well, that’s true. How do project leaders get information about the risks that have been identified?

A best practice is to build reporting into the management cycle of meetings so that the right information is available in the right format at the right time. Having a reporting system readily available also ensures that ad-hoc questions from senior management can be answered at any time, with confidence.

Do you have any examples of companies currently using this ERM process on their projects?

A current example of a company that follows the six step process is Crossrail. Crossrail is Europe’s largest infrastructure project, constructing a new rail line across London with 21km of tunnels underneath the center of the city. The project, which has a budget of £14.5 billion, will increase London’s rail transport capacity by 10% by 2019.

Risk management is now an integrated part of Crossrail’s culture – tied into key progress indicators (KPIs) and therefore directly affecting employee bonuses.  The Company has also insisted that its most critical contractor and supplier partners implement the same risk management process and system, sharing real time risk data with Crossrail’s project managers. With the six steps in place, Crossrail has seen benefits including improved business performance and stronger, more effective partner relationships as they work on this very important project.

Given the amount of building work in London at the moment to support Crossrail, I think it’s great that they are integrating risk management and mitigation into their project plans. Thanks, Chris, that’s really insightful!

About the expert:

Chris Bell is the Chief Marketing Officer at leading ERM software provider Active Risk. Chris brings life and energy to technology and business topics such as Enterprise Risk Management (ERM), Project Portfolio Management (PPM), and Governance Risk & Compliance (GRC). He is also a published author of many articles, white papers and books, including EVM for Dummies, and contributed to Active Risk’s ERM Readiness Guide. 

Elizabeth Harrin is Director of The Otobos Group, a project management communications consultancy. Find her on Google+ and Facebook.