Risk is the price of both action and inaction. It is worthwhile when expected benefits justify the potential for losses. Publicly funded organisations tend to be risk averse, missing valuable opportunities while enforcing costly compliance with rigorous risk management processes that can give the illusion of reducing risk without making anyone safer. An active risk culture directs more effort to imagining and managing risk, not just documenting risk.
Publicly funded organisations recognise the need to manage risk and have comprehensive guidelines for doing so. Mandatory artefacts such as risk logs and plans are central to this process, exhaustively cataloguing risks in pre-defined categories and assessing their likelihood and consequences.
This compliance-oriented approach to logging and categorising risks tends to focus energy on a familiar set of risks that can usually be managed well by local team members. By anchoring thinking to a defined framework, this process encourages a checklist mindset rather than an imaginative approach that might detect big and unexpected threats or opportunities.
Risk documents usually present decision makers with large volumes of well-known, sometimes trivial risks, and a few big vague risks like lack of budget or time. Strategic risks and opportunities that need executive attention are often missing, or difficult to find.
Busy decision makers have finite time to consider risk, and the time dedicated to observing risks widely is not available for considering risks deeply. Discussions of risk can quickly become perfunctory. The existence of risk documents is taken as evidence that risks are being managed, but writing a risk log is not risk management, any more than drawing a blueprint is building a house.
The artificial separation of risk management from delivery also disengages and disempowers staff on the ground. Risk documents may sit in drawers until the next governance committee meeting, while the team gets on with delivery. Individual responsibilities in relation to risk tend to emphasise periodic reporting over awareness and action.
Instead of poring over risk logs, decision makers should focus on creating an organisational culture that is alert to risk and oriented toward action. An active risk culture does not consign risk to a process ghetto, but integrates it into daily work, empowering people throughout the organisation to recognise and respond to risks and opportunities that are within their reach, and to escalate those that aren’t.
Building an active risk culture requires decision makers to model active risk management behaviours and to require the same behaviours from workers throughout the organisation. This includes allocating time for regular reflection on risks and opportunities, taking responsibility for immediate actions to mitigate or escalate risks, and celebrating actions taken by others that recognise or respond to risks and opportunities. Risk conversations should be framed as a creative rather than compliance activity, encouraging people to think outside the confines of the risk framework.
Managing risk is not just a technical activity. It should be actively practiced as a routine cultural expectation of everyone in publicly funded organisations.
social cohesion vs diversity