In this topic, we look at the process of risk management. We explore common risks you may face and how to manage them effectively. We also discuss managing change and crises as part of successful risk management.

Managing risk

Risk management is the process of identifying, assessing and managing risk that could potentially affect your group. It’s about taking advantage of opportunities while managing potential adverse effects.

Risk is the possibility that something unpleasant or unwelcome will happen. It’s the possibility of something happening that could expose a person or your organisation, community or nation to a threat or danger. Risk is the likelihood of this happening and what happens if it does – the consequences.

Risk management is important to support more informed decision-making. When a decision is made with the understanding of the risks and how to manage them, it improves the chance of success.

Risk appetite

All organisations, communities and nations must take risks to grow and to reach their goals. The question that your group needs to ask is: How much risk and what kind of risk is acceptable? Your answer to this question is called your risk appetite.

To understand your risk appetite, consider your group’s capacity to manage the risk and the consequences if they happen. Your risk appetite might be different for different risks.

Types of risks

There are many types of risk that could affect how smoothly your organisation, community or nation runs. The 7 most common risks are:

Operational risk is the risk of something going wrong with the day-to-day running of your group. They’re the problems that can happen from ineffective policies, processes and/or procedures.

Reputational risk is the risk of adversely affecting the name or reputation of your group. This can happen:

• directly – as a result your group’s actions
• indirectly – as a result of a group member’s action
• peripherally – due to the actions of other parties – such as suppliers or joint venture partners.

Environmental risk is the risk of danger from something in your environment. There are many types of environmental risks. Examples are the hazards in the natural environment or pollutants in your building.

Financial risk is a situation that could cause your group to lose money in financial transactions like loans. It’s about how well you manage your debt and fulfil your financial obligations.

Strategic risk is the risk involved in events or decisions that could threaten your group’s ability to achieve its goals. It’s the risk of flaws in your strategic planning that stop your group from setting and implementing your chosen strategy.

Legal risk is when a group does not comply with regulations and laws, or contracts it has entered into.

Health and safety risk is the likelihood that a person could suffer death, injury or illness if they’re exposed to a hazard.

Risk puzzle

Role of the board and management

The board’s role is to:

• set the risk appetite of the organsation, community, or nation
• make sure there’s a risk management framework
• oversee the risk management framework and make sure it’s working well
• periodically review the risk management framework.

Management’s role is to:

• develop and implement the risk management framework
• manage risks on an ongoing basis.

Role of the board and management

Risk management framework

A risk management framework can help your organisation, community or nation make decisions in a more thoughtful and controlled way. Some groups might establish a risk management committee to help the board.

The key processes to cover when developing an effective risk management framework are:

1. Identify the risk
• Regularly review the risks that your group could face.
2. Assess the risk
• Determine the likelihood of those risks happening.
• Make a plan to reduce the impact of the risk.
3. Manage the risk
• Develop processes and procedures to manage the risks if they happen.
4. Monitor and review
• Evaluate whether the level of risk appetite is suitable to what your group is trying to achieve.
• Monitor whether the processes and procedures have been implemented and are operating effectively.
• Check that the people responsible for risk management are acting according to the framework.

Risk management framework

Ways to manage risk

The type of risk might determine how you choose to deal with the risk. There are several ways to manage risk:

• Avoid the risk by stopping the activity that creates it.
• Use preventative measures that reduce the chance of a risk occurring. For example, having safety signs installed for any hazards around the workplace.
• Use corrective measures that reduce the consequences of the risk if it happens. For example, retraining employees so they can perform a task safely.
• Transfer the risk to a third party, such as an insurance company. For example, when you buy car insurance you buy financial protection against physical damage to the car or a person if you have an accident.
• Accept the risk and have plans in place to deal with the consequences if it happens. For example, deciding not to get car insurance and choosing to pay for the damage if you’re in an accident.

To understand potential risks that Aboriginal and Torres Strait Islander corporations and the communities they serve may encounter, see the Office of the Registrar of Indigenous Corporations (ORIC) Strategic Risk Framework.

Change and crisis management

Managing change is an important part of successful risk management. Not handling change properly can create risk for your organisation, community or nation.

Change can be challenging for individuals and groups. Change management is about understanding and supporting people through that change.

Successful change management has a strong focus on communication with your members and the community. It’s about communicating what’s happening to help them embrace change. It’s often slow and steady, so the change isn’t overwhelming.

You can help others understand and accept change by communicating:

• what’s happening
• why it’s happening
• how it’s happening
• who’s doing it
• when it’s happening.

If your organisation, community or nation has a strong plan and manages it well, it can have a positive effect on your goals.

Having sound decision-making processes, credible leaders, and a strong internal culture of trust and teamwork gives your organisation the resilience to withstand damaging crises and changes.

Groups that plan ahead can survive various risks, conflict and change. They’re better at:

• keeping new plans going
• sustaining economic development
• reliably delivering services and support to their members and communities
• reducing the risk of multiple crises
• retaining staff and board members
• reducing internal conflict.

Managing change successfully can help to avoid a crisis and maximise your success. If your change management plan is unsuccessful you’ll need a crisis management plan. Crisis management often involves making decisions quickly and dealing with fast-moving changes.

Purple House Covid-19 Management Plan is an example of change management in relation to rapid change.