Identifying risks

Register the identified risks. Find risks by looking backward from the unplanned outcome, to its sources of uncertainty. Then look forward from those sources of uncertainty, to the effects on outcomes. You can also start from the potential for events, or for wrong assumptions, and look both ways. The final ‘risk’ runs from the source of uncertainty, through the event or assumption, to the unplanned outcome. There are other good places to look for risks. Keep the risk register in good order.

What to read first: Next steps: How your unit might not deliver the outcomes

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

You have now come to the first activity unique to ‘risk management’: the identification of specific risks to the unit outcomes for the year.

You must use a certain amount of creativity and brain-storming to identify specific risks. You can follow structures to guide your creativity. The structures guide your creative mind toward identifying the genuine risks. By following more than one of those structures, you can achieve reasonable assurance that you haven’t missed any obvious risks.

This how-to guide has three main starting points for your creative identification of risks. You can also look to existing records for ideas, and to ensure you haven’t missed risks that have already arisen. The guide includes a list of places to look.

Register the identified risks.

A risk register is a formal collection of fully described risks, designed in a way that prevents any of the risks from being overlooked or forgotten. Usually the register records attributes for each risk, along with the risk description.

Find risks by looking backward from the unplanned outcome, to its sources of uncertainty.

You identified the unplanned outcomes in previous stages. Working through each unplanned outcome in turn, you brainstorm possible causal pathways that might perhaps lead to that outcome. Ideally each pathway is completed back to the source of uncertainty that makes the unplanned outcome possible. For any single unplanned outcome, there may be multiple pathways, and each pathway might involve more than one source of uncertainty.

Then look forward from those sources of uncertainty, to the effects on outcomes.

The second starting point is at the opposite end of the causal pathway, the beginning.

You first identify the sources of uncertainty.

A ‘source of uncertainty’ is a fact about your world that means you can’t be sure what will happen, and can’t be sure of your assumptions. There are plenty of such facts. Here are some common examples:

  • Key people are not always around when you need them.
  • Buildings and other infrastructure can become unavailable suddenly, for unpredictable reasons.
  • There is always potential for human error and under-performance within unit activities. Both can be brief or sustained, random or consistent.
  • The behaviour of the unit’s customers is not entirely predictable.
  • The performance of the unit’s suppliers is not entirely predictable.
  • The unit relies on unproven methods that may not always work as hoped.
  • Information systems are complex, so that the effects of a small change may be much greater than the intended effect. The unit does not know about all changes to the information systems.
  • Cybersecurity is never perfect. Even with the best protections, the bad guys get ahead sometimes.

From these sources of uncertainty, you brainstorm events and surprises that might follow from them. You then link the events and surprises to unplanned outcomes for the year.

You can also start from the potential for events, or for wrong assumptions, and look both ways. The final ‘risk’ runs from the source of uncertainty, through the event or assumption, to the unplanned outcome.

You begin with lists of uncertain events and assumptions. From there you imagine the pathways to the range of unit outcomes you have defined. Some events or mistaken assumptions will only lead to the planned outcome, even if they become real. They are not risks. Other scenarios may lead to an unplanned outcome. For any single source of uncertainty, event, or assumption, more than one unplanned outcome might be possible.

For each uncertain event or assumption, you also look backward for the reasons why the event or assumption is uncertain.

There are other good places to look for risks.

It is only sensible to look at existing documents that might be informative about risks for the planning period.

  • The obvious documents are pre-existing risk registers for the unit, perhaps from last year’s planning cycle.
  • Another important place to look is the actual history of unit or functional outcomes, as understood in terms of the freshly defined unit objectives for the planning period. Your draft risk register should be reviewed, and perhaps extended, from what you find in such places.
  • Where possible, check risk registers and actual outcome reporting for the higher level organisational grouping that includes your unit.
  • If your unit contains smaller organisational units with their own business plans, you will also need to consider the implications of the risk assessed in each of those units. The simple way to do that is to put into your own risk register one risk for each of the unplanned outcomes identified for the lower level units. From there you make your own assessment of how the occurrence might affect your own outcomes, and with what likelihood.

In practice, the three directions of brainstorming, and the checks of existing records, can be done in any order or simultaneously. Each one can propel and stimulate creativity in the other directions. If any one of them deserves the bigger slice of your limited time, it will be the consequence approach to identifying risks, that is, identifying possible pathways to each unplanned outcome in turn.

As you are an expert on your unit, and on what can happen in the functions you manage, the whole risk identification process need only take a couple of hours – spread out a bit over days, so that there is space for afterthoughts and improvements.

Keep the risk register in good order.

After you have identified pathways to each outcome from possible causes, and pathways from causes to possible outcomes, you join up and simplify a list of fully defined risks. Where necessary, you fill in missing links. Each final risk description includes a full pathway from causes to the outcome. For many fragments of risk, you will decide that there is no plausible pathway from one end to the other, so there is no risk worth taking seriously. But you will have asked and answered the important question – is there a risk to manage?

The remaining fully described risks go into the risk register.

On the way, you roll together overlapping risks. You also split candidate risks are found to contain two separate pathways from cause to effect.


Drill-down articles

The risk register

A risk register is a collection of risks, each described as a chain from an uncertainty to an outcome.

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Parent articles

Next steps: How your unit might not deliver the outcomes

‘A risk’ is one pathway by which something unpredictable could cause the year-end reality to match a picture that doesn’t show planned success. You need to find those pathways to outcomes other than success. Call these pathways ‘risks’. Each pathway (risk) has a likelihood you can estimate. You also estimate the likelihood of year-end reality matching each outcome picture. The likelihood of each outcome reflects the total of the likelihoods for all ‘risks’ (pathways) leading to that outcome. The likelihoods of each of the outcomes for an objective must total 100%. You then note the outcomes with acceptable and unacceptable likelihoods. Where the likelihood of an outcome is not clearly acceptable, you decide what to do about it.

New to this: This series assumes you have no prior knowledge. It does not use technical terms without explaining them first.

Index to the topic Risk in work unit business planning

Leave a Reply

Your email address will not be published. Required fields are marked *