IRM’s Infrastructure Special Interest Group (SIG) discuss key topics facing risk managers
Article by Gareth Byatt of the IRM Infrastructure Risk SiG
The Infrastructure SIG recently organised a meeting at the Shard in London, for over 35 risk professionals who work primarily in major rail, aviation, public utility and road programmes to discuss key areas of risk management practices affecting the infrastructure sector.
The event was organised by Jemma Boyce, GradIRM, Risk &
Reporting Manager at London City Airport and chaired by Vinay Shrivastava, CFIRM, Director, UK Infrastructure Risk Management, Turner and Townsend and consisted of five break-out sessions which facilitated debate around the following risk management themes:
- What is risk culture and how does it influence decision making?
- How can we embed risk thinking within a project team, and how do we deal with uncertainty in today’s fast-changing world?
- How do we tackle the trend towards complexity? How can we make risk management simpler yet more effective?
- What are Key Risk Indicators and how can we best use them?
- What competencies are required in a risk professional? Is sector knowledge a ‘nice to have’ or ‘need to have’, and can we succeed in a role as process experts alone?
A summary of the key points raised is provided below.
1. What is a good culture for taking and managing risk and how does it influence decision-making?
Having a good culture in place is absolutely fundamental to good risk management. A culture to foster good risk management is one where:
- risk is discussed in everyday conversations and it is on the agenda to aide decision-making at all levels of an organisation / project;
- the understanding of risk is consistent across the organisation, from the front line to the board room;
- it is accepted practice to be open about bad news, and to learn from it;
- the tone at, and from, the top is one that promotes and undertakes good risk management activities.
As part of this, risk teams need to ensure they foster the management of riskand not spend too much time on procedural risk management. By this, we mean that the risk team needs to ensure its process is stitched into how the organisation operates, not a process on the side-lines. If a risk process is disconnected from decision making within the business, it will probably be treated as a non-value adding, bureaucratic exercise.
2. Embedding “risk thinking” into a team, and dealing with uncertainty
There is a greater emphasis on dealing with uncertainty today, partly driven by knowledge of past failures of major infrastructure projects. Focusing on uncertainty is a mindset shift in how we perform risk management, in that it provides a wider scope to the identification and management of risks. It is moving us away from a focus on simply seeking to understand and manage what we know towards seeking to capture, understand, estimate and manage what we do not yet know. To achieve this, it is important to maintain an open mindset to identify opportunities as well as threats.
A key question, which is related to culture, is this: do people think through uncertainty before they attempt to manage it, or do they plunge headlong into seeking solutions / estimating uncertainty when we have not clarified what matters most to us?
The IRM Innovation Special Interest Group is undertaking a project into horizon scanning, which bears relevance to this.
3. How do we tackle the trend towards complexity?
In recent years there is growing recognition that commerce and projects are increasingly complex.
For risk management to help people in a complex world, the emphasis needs to be on using the right tools for the right situations. Sometimes complex analysis is required, but not all of the time, and it should never detract from the quality of thinking through risks and scenarios. Risk management frameworks and principles must be proportionate to the scale and complexity of the project under consideration. Risk teams need to better appreciate that complex quantitative risk models should be used in conjunction with ‘human’ judgement to inform decision making.
As per the recent headline article in the Spring edition of Enterprise Risk Magazine with Dr Sarah Gordon, we should aim to ensure risk management is “stitched into” the way the team works. Good decision-making processes and techniques can help people to “see the wood for the trees”.
4. Key Risk Indicators
As described by the IRM, Key Risk Indicators (KRIs) help organisations (and projects) prevent risks and exploit the opportunities they offer. Well-designed KRIs can help project teams (and organisations) improve risk awareness, better anticipate risks, adapt to disruptors and seize opportunities.
KRIs are metrics, which often link into risk appetite and agreed tolerances for risk. They are useful on projects (and in organisations), as long as they are woven into regular operations, and they are used to make good decisions. This is a key point. It can be all too easy to get carried away with designing pretty-looking metrics indicators that do not actually contribute to good decision-making.
Emphasis should be placed on a few important indicators that can help the project team to see early warning signs of potential issues, to take action in advance to avoid surprises and to protect against damaging impacts that could occur.
5. What competencies are required in a risk professional today?
Two broad areas of competencies were agreed: behavioural and technical. The context of the risk practitioner’s specific activities and remit determines the focus allocated to each area. Important skills in all situations for risk practitioners are:
- Creative skills
- The capacity to challenge in a constructive way
- An ability to join the dots
An oft-asked question for risk practitioners is: how valuable it is to have sector / industry knowledge in our roles?
There was consensus in the meeting that sector experience is desirable but not essential to ensuring good risk management is in place.
An important factor that influences the need for sector experience is the expectation from management in your organisation. If management define that sector experience is a must, this sets a tone for who will be recruited. Even so, there is ample evidence of risk practitioners moving across industries. We have opportunities to leverage different industry knowledge, as long as we can demonstrate that we are fast learners, that we have the capacity to challenge and we can join the dots.
Independent of sector knowledge, we must provide an impartial and objective view in the activities we perform.
The Infrastructure Risk SIG is determining next steps to undertake from the discussions held at our London event. Details will be communicated through future SIG events, our web page and through our LinkedIn Group.
The SIG is targeting to hold future events in various parts of the UK during 2018, and perhaps web meetings with international partner institutes. Stay tuned for details, which will be made available soon on the IRM website.