Rugby League Merchandise

The 2008 Annual Report for the Manly-Warringah Rugby League Football Club Limited (the Club) does not mention risk or risk management. If one looks at the list of 40 positions within the administration and football departments, there is no Risk Manager. In fact, ‘risk’ is not mentioned in any of the position titles listed at all. With this in mind then, it is not surprising the Club’s recent response to an alleged incident involving one of their senior players appeared ad-hoc and poorly planned.

Many sporting codes fall into the same trap. They impose compliance on players; however, they do not manage risk very well.

Outside sport, there is also a popular misconception by some senior executives and senior managers that compliance by way of a code-of-conduct, legislation or contract (or other such requirement) removes the need for risk management. Employers are required to comply with occupational health and safety (OH&S) legislation in states and territories. However, the fact that an organisation complies with OH&S legislation does not remove the risk of an incident or accident occurring.

Measuring compliance involves a pass or fail judgement. You have either complied or you have not. Compliance typically deals with treating the ‘likelihood’ (i.e. reducing the probability) of an event occurring. Typically, compliance does not treat the ‘consequence’ should an event materialise.

Compliance with an imposed requirement also does not involve measuring residual risk; i.e. the risk that exists after control measures are applied.

A new home may comply with the Standard for Construction of Buildings in Bushfire-Prone Areas (AS 3959:2009 – Standards Australia); however, there is still a risk that a bushfire could occur and the home still burn down. Compliance with this construction standard may reduce the ‘likelihood’ of the house being destroyed, but it doesn’t treat the ‘consequence’ of the house being destroyed. The compliance control is only as effective as other measures that may be taken, such as: clearing the bush from around the home, having fire retardant curtains, and reducing materials in the home which are above the self-ignition temperature threshold.

So how effective is compliance management?

Compliance management is important; however, this does not abrogate an organisation’s responsibility to assess the effectiveness that this control mechanism has on reducing the overall risk. Without a risk management framework in place, compliance management is a poor attempt to gloss-over the cracks in an organisation’s corporate governance.

What is surprising, however, is how straightforward it can be to fix those cracks.

Key ingredients

The recipe for creating a risk management framework is simple. It should include the following three ingredients:

Culture

Risk management is often cast aside from the day-to-day mindset of people because there are perceptions that:

The value of risk management needs to be demonstrated to people within the organisation. Negative perceptions need to be debunked and senior management needs to embrace the level of change required and lead the way. Introducing a risk management culture is effectively a change management project.

In an article for Risk Magazine, 21 June 2005 (Risk management in practice: risk culture at IAG), Peter Sutherland (Head of Group Risk & Compliance, IAG) and Dr Katarina Hackman (Senior Manager Change Strategy in Group Risk & Compliance, IAG) stated: “Most risk professionals see risk management as a process… To a degree this is true but this view misses the fact that risk management can equally be seen as a set of behaviours”.

For risk to be taken seriously (and subsequently managed effectively) sponsorship should start at the top and cascade down through the organisation. Policy development and ongoing communications from senior management need to reinforce risk management behaviour. People need training and support for this to be successful. Such training and support will underpin the introduction of a new common structure and language for managing risks.

Common structure and language

Australian Standard AS/NZS 4360 is the risk management framework used by many public and private sector organisations. It is a good place to start when implementing risk management in most organisations.

Regardless of the approach, the first challenge is to sort out definitions. Many communication problems can be solved by everyone using standard terms. The Australian Standard provides definitions for risk management terms, some of which are:

 

Risk – Risk is measured in terms of likelihood and consequences. It is the chance of something happening that will have an impact upon objectives.

 

Likelihood – Likelihood used as a qualitative description of probability or frequency (i.e. of something occurring).

Consequence – Consequence is the outcome of an event expressed qualitatively or quantitatively. The outcome may be a loss, injury, disadvantage or gain. There may be a range of possible outcomes associated with an event.

Event – An event is an incident or situation, which occurs in a particular place during a particular interval of time.

Magnitude – The Australian Standard also provides for ‘magnitude’ to be assigned when undertaking risk analysis. Magnitude is used to describe the level of risk (or exposure). Magnitude is assigned by using a matrix to combine likelihood and consequence such that a descriptive measure can be assigned. When people say something is a “High Risk” they are articulating the magnitude of the risk.

(Source: AS/NZS 4360 Risk Management, Standards Association of Australia)

With definitions clearly understood a common process can be applied. The Australian Standard provides a clear process for risk management.

If we strip back the layers of this risk management process there are some very simple things that should be done:

Treatments applied to reduce the consequence or likelihood may be referred to as ‘controls’. After applying controls, there may still be residual risk (i.e. the risk remaining once controls have been applied). Risk treatment continues until a point is reached where the risk is retained (i.e. the risk is acceptable).

Using scenarios, the value of risk management (over and above compliance) can be demonstrated. The Risk Definition and Classification contained in Appendix E of the AS/NZS 4360 Risk Management, Standards Association of Australia are often referenced in risk analysis.

Scenarios

Following are two independent scenarios where Inherent Risk is being assessed in the context of Existing Controls; Further Controls are being recommended and Residual Risk is being assessed. These scenarios demonstrate transparency in the process of implementing controls. In both scenarios a combination of controls has been used to treat Consequences and Likelihood in order to reduce Magnitude.

Scenario 1 – OH&S

Context

Risk Event

Existing Controls

Inherent Risk

Consequence – Major (4)

Likelihood – Possible (C)

Magnitude – Extreme (C4)

Further Controls

Residual Risk

Consequence – Moderate (3)

Likelihood – Unlikely (D)

Magnitude – Moderate (D3)

           

 

Scenario 2 – Player behaviour

Context

Risk Event

Existing Controls

Inherent Risk

Consequence – Major (4)

Likelihood – Possible (C)

Magnitude – Extreme (C4)

Further Controls

Residual Risk

Consequence – Moderate (3)

Likelihood – Unlikely (D)

Magnitude – Moderate (D3)

 

Compliance alone is not enough

In both scenarios, compliance management is not enough to reduce the exposure of the organisation to adverse consequences; i.e. residual risk still exists. The question is: do the controls (when applied) provide an acceptable risk profile?

Complying with OH&S requirements in the construction context presented does not help if things go wrong. Similarly, a basic risk assessment would clearly show the existing compliance approach to control player behaviour (imposing Player Code of Conduct and Player Contract requirements) are inadequate in treating the consequence. The existing controls do not provide an acceptable residual risk profile and the risk requires further treatment and management.

Tools can help

Most medium and large sized organisations are now turning to risk management software as the key tool to manage risk.  Planning is a critical stage of implementing risk management software. The saying goes: “if you automate a bad process, ‘garbage’ will be delivered at the speed of light”.  There is a plethora of risk management software on the market which can support the process; however, if the process is bad to begin with, it may just get worse if you automate it.

Business Process Re-engineering (BPR) was the consultant catchphrase of the 1990’s. The concept is still around but it now has a different name – Business Transformation. Regardless of the name, the concept of analysing existing processes to determine if they are delivering best value is still fashionable. Continuous improvement should occur within every business so that where processes are identified as deficient, they can be fixed (Larson A, 2003, Demystifying six sigma: a company-wide approach to continuous improvement).

Before implementing risk management software, a process review of the risk management framework is imperative to ensure the process is optimal. Only then can increased value be delivered.

In looking for a software provider, seek an organisation that can:

There are some fundamental issues to tackle when shopping for risk management software, as is demonstrated in the following table.

Issues

Flexibility – The basic concept of risk management will not change substantially over the life of the software; however, your ‘maturity of use’ will. This will result in changes to definitions within the risk definition and classification, the calculation of magnitude and depth of controls applied. The software must have the flexibility to change without the need for significant re-investment.

Scalability – The initial implementation may see a few key people use the risk management software. When the culture of risk management becomes instilled within your organisation, usage will inevitably increase. The software must be able to cope with forecasted growth.

Sociability – Risk management software should not be deployed in isolation from other key business systems. Interoperability is important to ensure people can interact with the risk management software when using their day-to-day business systems (e.g. reminders issued via email).

Usability – If the risk management software is user-friendly, people will use it. If it hard to use, they won’t use it. There must be adequate training to ensure people can use the software efficiently and effectively.

With any software implementation it is important to define what success is. Consider having a definition of success which encompasses the level of acceptance by users. Without this acceptance, it does not matter how good the risk management software is, it will be reluctantly used, or avoided altogether.

Conclusion

The evidence is clear: Compliance does not equal Risk Management.

Organisations need to comply with a number of obligations, such as those contained in: legislation, contracts, codes-of-conduct and other such requirements. Compliance management is, therefore, an important function within any organisation.

Compliance management should only be considered as a small part of managing exposure. Without an all-encompassing approach to risk management, an organisation has a corporate governance crack as wide as the Grand Canyon. To fix this requires: