Risk Management - learn to use it
How to plan for everything that can go wrong, ensuring your circle or project's mandate remains secure and achievable. 😌
Introduction
Risk management helps build resilience into your circle. “Hindsight is a wonderful thing but foresight is better, especially when it comes to saving life, or some pain!” — William Blake It also takes account of Murphy's Laws : 1. Anything that can go wrong will go wrong. 2. Left to themselves, things tend to go from bad to worse. 3. Nothing is as easy as it looks. 4. Everything takes longer than you think. 5. If there is a possibility of several things going wrong, the one that will cause the most damage will be the one to go wrong..
What is Risk Management and why is it so important?
In XR a 'Risk' is the chance of a negative event damanging or threatening the existence of XRUK.
We all talk about risks and worry about them happening but we don't make plans to control them. Succesful risk management ensures you do something.
This book shows you how to think about risks and take action to reduce their likelihood and impact. This gives you time and space to understand a risk and to plan how to address it should it happen. You may also find serious and common risks that exist across many XRUK circles. This does not mean you stop all activities or actions which carry risk.
Risk Management is a set of techniques for your circle to plan for threats in achieving its mandate. You prepare for the unexpected and to sleep at night. If you don't control your risks they tend to fester, get worse over time and become harder to manage.
Circles carrying potentially high risk are encouraged by the Risk circle to record and assess their risks and share them with the Risk circle so they can be understood and actioned.
What risks can an XR Circle expect?
Risks come from absolutely anywhere! They can be :
-
financial,
-
legal,
-
reputational,
-
technical,
-
non-compliance with regulators,
-
lack of security,
-
fraud,
-
loss of key members.
Each risk has a cause, a probability and an impact. The probability of your house burning down are very small but the impact is very high. In this case, you transfer the risk to an insurance underwriter.
A risk can become embedded in in a circle's processes.
Here are examples of possible risks for an XR circle. There are many others!
- A group outside of XR and acting in the name of XR does something disreputable, causing loss of funding, loss of rebels and make it hard to get our demands met.
- Key information such as a password or a key skill is only held by a single member of a circle and they unexpectedly are unavailable.
- People aren't told clearly about planned activities or how to join in or the activities are poorly coordinated
- A circle loses access to essential information.
Could any of these apply to your circle? Have you thought about what to do when they happen?
How do we do risk management?
How to manage your risks. You can learn that here and can also get help from the Risk circle.
How to do it
STEP ONE: A RISK IDENTIFICATION WORKSHOP: (Risk circle can facilitate)
- What are significant risks for our circle?
- What is a concern for our circle?
- What worries do we have for the circle?
A risk is that X happens, caused by Y and with the consequence of Z.
We are now in brainstorm mode. Anything goes – GET IT OUT – capture lots of risks without evaluation - that comes later. Build on what others say – one idea or concern can trigger another.
Then make sure you record the risks you identified in a risk register! The Risk circle can provide a template. Here is one with just headings and the Risk circle can facilitate the process of capturing your risks. There are lots of drop downs to record the severity of each risk.
STEP TWO: EVALUATE THE RISKS:
- How bad would it be if this risk happened?
- Would it limit our ability to carry out our mandate?
- What other circles/parts of XR might it impact?
- Who else might it impact? (outside of XR)
- Do we stand to lose anything if it happens? (donations; financial cost)
- What might cause this risk?
Answering these questions for each risk and recording the answers in your Risk Register means you now know the probability and impact of each risk. The register automatically calculates the severity of each risk and now you can see and prioritise those of high severity. If you identify any risks with a high severity to XRUK, please notify the Risk circle.
STEP THREE: DECIDE HOW TO ACT:
Decide what actions to take to deal with the highest priority risks. There are 4 types of action, and a 'Plan B' :
- Reduce: Take steps to reduce the risk's impact and/or to reduce its probability
- Share: Contact the XR Risk circle for help or get someone else to take action
- Accept: Carry on with the activity, monitor it regularly and identify a contingency action.
- Avoid: Stop the activity or do it differently
- Plan B: Be prepared shoud the event occur. Don't be a headless chicken but calmly put Plan B into action.
The first 4 actions reduce the severity of the risk. The last one allows you to plan a contintency action should the risk actually happen. You should try to both reduce the severity and plan for it happening.
Record these actions within your Risk Register so that you remember what was decided and who is taking action.
Meet again to check if these actions have completed. If so, re-evaluate the risk and see if its severity has reduced. If it has, you can stop worrying.
STEP FOUR: REPEAT
Things change.... so it is a good idea to regularly (suggest once/month) review your circle's risks and check whether the mitigating actions have been done. New risks may have arisen and your known risks may become more (or less) critical. That may give you a new set of actions.
LARGER CIRCLES
A large circle may contain diverse sub-circles and if so, each should carry out risk management. The sub-circles may have different levels of risk and should try to rank themselves so the riskiest circles can be prioritised for any support they may need.
ITS A RISKY BUSINESS - XR RISK MANAGEMENT IN A NUTSHELL
- Ask the Risk circle to join one of your circle's meetings to help you discuss risk management
- Set time aside with your circle to brainstorm risks
- Prioritise your risks and decide what you want to tackle first
- Use the 4 Risk Management action types to manage high priority risks
- Ask the Risk circle about tools for getting to the “root cause” or decide the best “action” to take
- Make a commitment to review risks
- The Risk Circle can't tell you what are your risks or how to manage them, but these tools help you to do it
Help available
What help is available? What is the Risk circle and how it can give support?
The UK Risk Circle
Support and more information is available from the UK Risk circle - just message us via the Risk Circle Reception channel on the Hub (Mattermost). We will be pleased to offer you help and support as needed.
The Risk circle has been created to provide information and support to circles in recognising and reducing the impact of risks that could seriously hamper the circle's mandate or existence. It aims to create a positive and open culture where circles understand their responsibility to minimize the exposure of XRUK's purpose, to the risks falling within their circle’s mandate.