Risk in work unit business planning – index page

For unit managers

For risk specialists


How-to guide for unit managers

Risk in work unit business planning: Start point for unit managers

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Risk in work unit business planning: What is it?

In business planning, ‘risk’ is just the possibility that your unit’s outcomes for the year will be different from those promised in the business plan.

What to read first: Risk in work unit business planning: Start point for unit managers

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Starting from the business plan

A business plan explains what the unit delivers to the organisation in exchange for the resources it uses. The business plan document is usually a formal record of decisions already made.

What to read first: Qualities of the outcome pictures Risk in work unit business planning: What is it?

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Assumptions

To reach assurance you must know your business. You and your boss must know what’s acceptable. It helps if you can talk with the boss. ‘What’s acceptable’ includes behaviours, numbers, delivery, real-world outcomes, and outcome likelihoods. It’s the real-world outcome likelihoods that matter.

What to read first: Risk in work unit business planning: What is it?

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Different kinds of tolerance and acceptability

Acceptable risk is fundamentally different from an unacceptable behaviour. ‘Zero tolerance’ isn’t about risk at all. Acceptable risk is different from an unacceptable number, and from an unacceptable outcome. An acceptable risk is an acceptable likelihood for an outcome.

What to read first: Assumptions

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Risk management driven as a prescribed process

The Clear Lines on Audit and Risk lead to meeting the assurance demands of the boss. Corporate risk specialists may drive ‘risk management’ as a prescribed set of steps, regardless of assurance demands.

What to read first: Risk in work unit business planning: What is it?

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Exclusive focus on Enterprise Risk Management

Your organisation may understand ‘risk’ exclusively as Enterprise Risk Management (ERM). Understanding business plan risk for work units is not ERM. It is a component of ERM.

What to read first: Risk in work unit business planning: What is it?

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

If you have already been told how to do ‘risk management’, with templates

The how-to steps in this guide will differ from guidelines you have been given within your organisation.

What to read first: Assumptions

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

What the risk work delivers: confidence

Building confidence in your business plan results in auditable ‘risk’ documents. The documents explain the decisions you make within business planning and over the year. They also explain the assurance you give the boss. The documents are not the end result. The process is not about filling templates. The end result is outcome assurance based on smart decisions and effective actions.

What to read first: Risk in work unit business planning: What is it?

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Understanding ‘risk’ for business planning

The focus of business planning is the end of the planning period. ‘Risk’ in work unit business planning is the uncertainty of the year-end result for the organisation, from all possible causes. ‘A risk’ is one pathway by which the year-end outcome can be different to the success outcome you planned. That limits the range of ‘risk’ you need to think about right now. Risk isn’t bad, or good. Taking more risk can be the way to better performance outcomes.

What to read first: Risk in work unit business planning: What is it?

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

What can be left out of business plan risk

These categories of ‘risk’ can be left out: Routine and low-level events from which you can recover. Most disruptive events, even those experienced as ‘crises’. Potential events that are clearly harmful, though to someone else’s outcomes rather than those of your unit. Risks subject to separate management. Existential risk – the possibility of being abolished. But first be sure of the objectives for the unit.

What to read first: Understanding ‘risk’ for business planning

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Risk in work unit business planning: Why this way?

Every step takes you closer to confidence in delivering on the plan, and getting credit for your unit. The steps in this guide guarantee that your risk work will line up with what’s important to you, your boss, and your organisation. You can take all the steps in self-protection, without any support from the boss. This process can be followed by units at multiple levels, all at once. You can take all of these steps without any corporate support or guidance from risk specialists. There are some areas where you may run into differences with risk specialists or corporate expectations. You will be way ahead of typical corporate ‘risk management’.

What to read first: Risk in work unit business planning: What is it? Risk in work unit business planning: Fast track for risk experts

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

First steps to confidence: Find the unit outcomes that matter

The first step is validating the unit’s objectives. ‘Risk’ is meaningless without the objectives. You understand each objective only when you see how success and failure are different. To see that difference, draw pictures. The outcome pictures must show your real world as it might be at the end of the planning period. You will use the outcome pictures to understand the significance of unplanned developments during the year.

What to read first: Risk in work unit business planning: What is it?

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Discovering the objectives

Understanding your objectives is the most important part of business planning, and of the risk management process.The objectives are the outcomes that the unit delivers for the organisation. Big questions: You can find the objectives by asking about your unit’s benefits, costs, dangers and capabilities. Precision engineering: Ensure that those objectives are necessary, sufficient, independent – and yours. Choose your priorities within risk management.

What to read first: First steps to confidence: Find the unit outcomes that matter

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Big questions about objectives

You can find unit objectives under four headings: Benefits, Costs, Dangers and Capabilities. For a work unit, benefits, costs, dangers and capabilities beat existence and reputation. Example draft objectives for a payroll unit.

What to read first: Discovering the objectives

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Precision-engineering objectives

The objectives should be necessary, sufficient, independent and yours. If the process has been followed successfully, the number of objectives will usually end up somewhere between four and fifteen.

What to read first: Discovering the objectives

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Payroll example of engineering objectives

What to read first: Precision-engineering objectives

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Priorities within business plan risk management

Some risk needs immediate attention, not all risk. You choose the objectives that need immediate attention.

What to read first: Discovering the objectives

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Draw lines of potential year-end outcome pictures

To really understand the objectives, draw a line of potential year-end outcome pictures on each objective, from best to worst. First create spaces for the levels of success and failure. Then sketch pictures for each space. Lastly, test and improve the pictures. If you don’t understand the objectives well enough to draw the lines of pictures, you will not be able to evaluate risks.

What to read first: First steps to confidence: Find the unit outcomes that matter

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Degrees of success and failure

Degrees of success and failure are possible on each objective. Aim to get three levels of success and four more levels of failure. The levels of success and failure are how the organisation will see the unit outcomes for the year, not how you see them. The pre-defined levels of success and failure can disappear after you have specific pictures of success and failure for each objective. The pre-defined levels of success and failure are not themselves a scale for consequence or impact.

What to read first: Draw lines of potential year-end outcome pictures

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Reference table for (seven) success and failure levels

What to read first: Degrees of success and failure

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

More on the seven levels of success and failure

What to read first: Degrees of success and failure

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Sketching outcome pictures at each level of success and failure

For each objective, draw a picture of Success. Then draw an outcome better than Success. Then describe the worst imaginable outcomes. Lastly, fill in the intermediate outcome pictures for that objective. Each picture shows the unit’s success or failure for the year, as you will remember it. Each outcome picture is important, even if unlikely. After capturing the initial pictures, review the full collection for realism.

What to read first: Discovering the objectives

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Example of outcome pictures with sub-objectives

What to read first: Sketching outcome pictures at each level of success and failure

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Why unrealistic pictures matter

Your customers care deeply about what won’t happen to them.

What to read first: Sketching outcome pictures at each level of success and failure

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Working through far-fetched outcomes

What to read first: Why unrealistic pictures matter

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Qualities of the outcome pictures

The pictures must be of different outcomes, and evoke different feelings. Draw the destination, not the journey. Ensure that the collection of outcome pictures is realistic in view of recent history, and in view of what the organisation expects. Even the most unlikely outcome pictures are important as possibilities. They illustrate vividly what won’t happen. Ask smaller work units inside your own to define objectives and draw pictures in the same way. This is a good time to compare the re-generated objectives and pictures with the original business plan. You can compare your objectives and outcome pictures with those of lower- and higher-level work units.

What to read first: First steps to confidence: Find the unit outcomes that matter

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Prove and consolidate the outcome pictures

Check similar pictures appearing for multiple objectives. Review each picture on its own. Review the pictures in each cell. Review the line of outcome pictures for each objective. Review the collection of outcome pictures as a whole. Sub-objectives can be useful. Small is beautiful. Appearance counts.

What to read first: Qualities of the outcome pictures

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Picture review

Review each picture on its own. Each picture must be fully defined. Each picture must describe the outcome, not something the on the way to the outcome. Each picture must describe the outcome, not an indicator of the outcome. A picture may refer to future prospects as they will look at the end of the planning period. Each picture must become factually true or false, regardless of point of view. Each picture should produce an emotion, instantly. The picture should match the way the year is remembered in the future. Each picture shows the period outcome, not a specific incident during the period. The period outcome can be an accumulation of specific incidents. If you keep the success and failure levels, make sure the picture matches the level.

What to read first: Prove and consolidate the outcome pictures

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Cell review

Cell review: checking multiple pictures for the same outcome on the same objective.

What to read first: Picture review Prove and consolidate the outcome pictures

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Objective-level review of outcome pictures

Any outcome on the objective must match exactly one cell. Pictures in different cells generate different emotions. Pictures in different cells might lead to taking different paths in strategy, controls, or consultation. No pictures are missing.

What to read first: Picture review Cell review: checking multiple pictures for the same outcome on the same objective. Prove and consolidate the outcome pictures

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Review of the whole picture collection

Sometimes a positive objective is the complement of a negative objective, so the two lines of outcomes can be merged into one sequence.

What to read first: Objective-level review of outcome pictures Prove and consolidate the outcome pictures

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Valuing your picture collection

The outcome picture collection replaces a ‘standard consequence scale’. You have now set the ‘risk management context’. At this point you’ve done the hard and important work for risk management in business planning, even though there isn’t yet a single risk. The outcome picture collection is useful for more than risk management.

What to read first: First steps to confidence: Find the unit outcomes that matter

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Outcome pictures and consequence scales

An outcome picture collection can look like a standard consequence matrix. There are fundamental differences between an outcome picture collection and a standard consequence matrix.

What to read first: Valuing your picture collection

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Reconciling your outcome picture collection with a corporate consequence scale

What to read first: Outcome pictures and consequence scales

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Next steps: How your unit might not deliver the outcomes

‘A risk’ is one pathway by which something unpredictable could cause the year-end reality to match a picture that doesn’t show planned success. You need to find those pathways to outcomes other than success. Call these pathways ‘risks’. Each pathway (risk) has a likelihood you can estimate. You also estimate the likelihood of year-end reality matching each outcome picture. The likelihood of each outcome reflects the total of the likelihoods for all ‘risks’ (pathways) leading to that outcome. The likelihoods of each of the outcomes for an objective must total 100%. You then note the outcomes with acceptable and unacceptable likelihoods. Where the likelihood of an outcome is not clearly acceptable, you decide what to do about it.

What to read first: First steps to confidence: Find the unit outcomes that matter

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Particular risks

‘A risk’ is one pathway by which something unpredictable could cause an unplanned outcome on an objective.

What to read first: Next steps: How your unit might not deliver the outcomes

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Identifying risks

Register the identified risks. Find risks by looking backward from the unplanned outcome, to its sources of uncertainty. Then look forward from those sources of uncertainty, to the effects on outcomes. You can also start from the potential for events, or for wrong assumptions, and look both ways. The final ‘risk’ runs from the source of uncertainty, through the event or assumption, to the unplanned outcome. There are other good places to look for risks. Keep the risk register in good order.

What to read first: Next steps: How your unit might not deliver the outcomes

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

The risk register

A risk register is a collection of risks, each described as a chain from an uncertainty to an outcome.

What to read first: Identifying risks

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Decisive final steps: Taking action

To the extent that you are relying on controls, you ensure that those controls really work. Confidence comes from always knowing that those controls are in place. After all of that, you will definitely be ready to look the boss in the eye over the business plan. You can maintain the outcome pictures and their likelihoods as the focus of conversations with the boss through the year. You review can and maintain the risk collection at the same time.

What to read first: Next steps: How your unit might not deliver the outcomes

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.
Fast-track summaries for risk specialists

Risk in work unit business planning: Start point for risk experts

About the how-to guide What’s different about it

What to read first:

Seen it all: This series assumes you know risk terms and concepts. It includes references to standards.

Risk in work unit business planning: Fast track for risk experts

Risk is managed by managers, not specialists. The manager identifies a range of potential outcomes on each objective, pathways to each outcome, and the likelihood of each pathway and outcome. The process is in the spirit, and letter, of ISO 31000 applied to a work unit. It creates a single view of forecast outcomes that includes ‘risk’. Risk specialists work for managers. Managers don’t work for risk specialists. Work unit risk management contributes to Enterprise Risk Management.

What to read first: Risk in work unit business planning: Start point for risk experts

Seen it all: This series assumes you know risk terms and concepts. It includes references to standards.

How the how-to guide follows ISO 31000

Risk in work unit business planning helps ERM. Risk concept Purpose ‘Framework’ (ISO 31000 Section 4) Establishing the context (ISO 31000 5.3) Consequence criteriaOther risk criteria Risk assessment (ISO 31000 5.4.2) Risk analysis (ISO 31000 5.4.3) Risk evaluation (ISO 31000 5.4.4) Risk treatment (ISO 31000 5.5) Risk Based Outcomes Forecast

What to read first: Risk in work unit business planning: Fast track for risk experts

Seen it all: This series assumes you know risk terms and concepts. It includes references to standards.

Comparison of the how-to guide with typical corporate prescriptions

The guide differs from typical corporate prescriptions in these ways: Objectives Consequence measures Likelihood measuresLevel of risk Risk register Overall risk view Negative and positive risk

What to read first: How the how-to guide follows ISO 31000

Seen it all: This series assumes you know risk terms and concepts. It includes references to standards.