You could add (at the risk of making it 11 mistakes) the issue of focus. Far too often the risks relate to new projects and it assumed that the status quo is not itself a risk. Rarely is the risk of doing the "same old stuff" properly assessed and, as a result, the costs involed in managing what you aready do are taken for granted. Sometimes doing nothing presents a much greater risk (and cost).
Good point. Doing nothing in the face of (new) technological developments is a high risk option, with high likelihood of consequences. Blackberry, Kodak, music industry and streaming come quickly to mind.
Thought provoking and a great challenge to the ongoing review of our change portfolio. We need honest transparent reporting together with consistent application. Mistake 10 particularly resonates - agree that we need to give far more attention to the “amber” in particular to their direction of travel. Should serve as an early warning sign for attention providing the opportunity to avoid the firefighting caused by neglect… or denial . Aggregation of risk the perennial challenge.
You had me at mistake 1. Reminded me of a governance committee meeting where on the item on the annual risk register I asked "who in the senior team was involved in producing this and what did you learn?" Embarrassed looks. At the following meeting we listened to them discuss their learning from co-creating the newly jointly produced (and radically different) register. What I would have liked is a better set of working principles and frameworks to suggest they could use. Never seen these done well, only misapplied ideology.
All very valid. There is also the danger that risk management becomes a dead hand squahing innovation. For example, research ethics committees enforce the members views of what constitute acceptable research methodologies and demand changes to 'reduce risks'. All good research is risky because you don't know what you are going to find until you have done the research.
In my experience risk management is rarely costed and frequently the cost of mitigatiing risks (including the additional posts and burdens on staff) exceeds the cost that would arise were the risk to happen.
You could add (at the risk of making it 11 mistakes) the issue of focus. Far too often the risks relate to new projects and it assumed that the status quo is not itself a risk. Rarely is the risk of doing the "same old stuff" properly assessed and, as a result, the costs involed in managing what you aready do are taken for granted. Sometimes doing nothing presents a much greater risk (and cost).
Good point. Doing nothing in the face of (new) technological developments is a high risk option, with high likelihood of consequences. Blackberry, Kodak, music industry and streaming come quickly to mind.
What an interesting response. I very much agree!
Anthony
Thought provoking and a great challenge to the ongoing review of our change portfolio. We need honest transparent reporting together with consistent application. Mistake 10 particularly resonates - agree that we need to give far more attention to the “amber” in particular to their direction of travel. Should serve as an early warning sign for attention providing the opportunity to avoid the firefighting caused by neglect… or denial . Aggregation of risk the perennial challenge.
You had me at mistake 1. Reminded me of a governance committee meeting where on the item on the annual risk register I asked "who in the senior team was involved in producing this and what did you learn?" Embarrassed looks. At the following meeting we listened to them discuss their learning from co-creating the newly jointly produced (and radically different) register. What I would have liked is a better set of working principles and frameworks to suggest they could use. Never seen these done well, only misapplied ideology.
All very valid. There is also the danger that risk management becomes a dead hand squahing innovation. For example, research ethics committees enforce the members views of what constitute acceptable research methodologies and demand changes to 'reduce risks'. All good research is risky because you don't know what you are going to find until you have done the research.
In my experience risk management is rarely costed and frequently the cost of mitigatiing risks (including the additional posts and burdens on staff) exceeds the cost that would arise were the risk to happen.