Do we need a risk management framework?
A single word can change so much.
For example, the traditional way of thinking about responses to risk includes the expression “accepting risk”. (The options are avoiding, transferring, or mitigating. The idea of taking more (!) is ignored.)
That is so passive!
In order to succeed, whether in life or in business, people need to take risks! Active, not passive!
The key is to do so intelligently with reliable information about where you are (so often overlooked) and what may happen in the future.
Life and business are not about managing or mitigating risk(s). They are about making decisions that will help you get where you need to go, be what you want to be, and achieve the success you desire.
How about changing the expression “risk management framework” to “risk taking framework”?
This is a much more active way of thinking.
It focuses on the decisions you are making, not only understanding the bad things that might happen but why you may want to take the risks of them happening.
Let’s:
- Understand where we are
- Anticipate (another wonderful word) what might happen
- Do something if that is not desirable (better than ‘acceptable’)
If you were asked to change from helping with a risk management framework in a risk management activity, to helping with a risk taking framework in a risk taking (support) activity, what would you do?
Would that add more value to the organization?
I welcome your thoughts.
Leave a comment
Norman Marks on Governance, Risk Management, and Internal Audit 
It should be performance management framework (although don’t even need to use the word framework), the risk is in its right place. Risk-adjusted performance where risk is just the downside of performance, upside of performance is just performance.
Alex, performance management is important. But is it sufficiently active to take in whether, how, when, and where to move forward (or backward)? I am not sure it evokes the same response.
It does in our company, it is the main set of metrics tracked and what drives most important decisions, linked to remuneration and the backbone of board reporting
It may identify the need for decisions, but it would be exceptional if it included how to make them.
Not completely sure what you mean
Risk taking includes more than knowing your current level or even likely level of performance. It encompasses how you do something.
While risk ‘taking’ is another way of saying planning, making decisions, strategizing, deploying uncertainty . . . we will need to have persons committed to the idea, that risk is an ‘active’ form of doing anything when there are unknowns. The consequence is, of course, reflected in performance.
I’m always a fan of raising the bar on performance, and that takes active risk-taking.
Good post, Norman. I like this one.
It shows me as anonymous!! I guess I better fill in the details.
Great thought provoker Norman. For me the shift from ‘management’ to ‘taking’ feels like taking it from one end of the pendulum swing to the other. I know a bunch of managers that would emotionally struggle with that word… It’s provacative, it reflects what we should be doing, but will the emotive response from non-risk experts blind the process.
When you said “It focuses on the decisions…” my mind lept to a Risk Decision Framework, it lines up with a bunch of risk decision tools I have been playing with that guide business decisions by mapping out the risks vs opportunities…….
Great start to the week 🙂
Norman. So tru e. There is no such thing as not taking risks, and hence leading and making decisions is all about intelligent risk taking.
– Intelligent means informed and deliberate
– Risk refers to negative risks, positive levers and general uncertainties alike
– Taking means some things are avoided, some things are mitigated, some things are accepted and some things are in fact actively pursued.
Managing risks is essentially bad risk management.
Leading a business is like walking up a down escalator. The very second you stop going forward, you slide backwards vis a vis the market, your competitors or even alternative investment opportunities.
Thanks Norman for sharing your thought.
It should be Objective management framework since the purpose of risk management is to ensure the achievement the Company’s strategic goals and objectives.
There is no such thing as objective management, let alone framework, it’s just another consulting made up fad 🙂
Alex, its a matter of language. You prefer performance management, but that should be performance against strategic goals and objectives. Right?
Yes, that’s pretty much what I meant. There are already common business terms, new management fads, like objective management, are superfluous, especially when they add additional error on top of existing processes.
It won’t help to change common business language only from the perspective of risk while there are so many others. Generations of students had to deals with terms like management (or directions like in Cobit. So you need to make clear how taking risks fits in the concept of managing organisations. People are also familiar with terms like frameworks: risk, audit, privacy, etc., as a kind of help for creating solutions for different perspectives.
Point if you should blame the risk professional for not being able to address the subject in the right way to management and others,