Risk management remains an evolving practice across a wide range of sectors and organisations. Typically, the Board of Directors or Board of Trustees wants the organisation to maintain a risk register – one that catalogues the key risks, assigns risk owners, rates each risk and devises proportionate risk mitigations to manage those risks. Some sectors such as the military, emergency services, construction and insurance even build their business model around risk management.

Imagine three business risks in the organisational risk register that relate to income generation in three different sub-businesses. The risk mitigations for each may be about reaching the ideal point on an opportunity/threat ‘spectrum’ that matches the organisation’s risk appetite for that sub-business. The best risk mitigations for each sub-business probably involve moving the opportunity/threat spectrum (for each sub-business income generation risk) further towards the opportunity end of its scale i.e. improving the upside potential. Meanwhile for other types of risk such as brand reputation risk, cyber risk or safeguarding risk, the relevant spectrum is probably threat-focussed with low threat at one end and high threat at the other. The risk mitigations to seek are those that move the risk threat further towards low threat, but at an affordable cost.

If risk velocity is about managing risks (threats) arriving at variable speeds, then risk evolution is about investing in business flexibility to rapidly evolve risk management to keep pace with risks emerging in the ‘risk landscape’. More specifically, finding approaches to improve business adaptability (learning speed and ability to evolve) leads to better business risk management. As does investing in ways to create a fast bounce-back from an adverse event, investing in functions to handle volatility of outcome, training to pivot (be more agile) and developing a business options portfolio to handle risk (dynamic threat and opportunities).     

Finally, working in the charity sector, it’s clear that charities want to grow in scale to achieve more impact. What they may lack is clarity on how best to scale up (the best mix of human resources and technology) to do so. What is also commonly lacking is clarity about the level of business flexibility needed to scale up. Using a trial and error approach means pushing resources until they break (or resign) to find out the natural limits to growth. A better approach is to invest in business flexibility explicitly and before the stretch happens.

Simon