Too many businesses place the emphasis on identifying and understanding the risks associated with a project or task rather than actually managing the risks they identify. They create a finely honed, quantified, risk log – sometimes even with 3-point sensitivity analysis – and then do nothing about it. The key is to manage; take action to avoid, limit or mitigate the likelihood of risks occurring or their impact if they do.
But even if we do this successfully, we often assign technical risks to technical people, financial to finance, commercial to commercial etc. I would advocate much more cross-functional involvement in discussing and agreeing the best course of action to manage any given risk. In many of our training courses we run a simple exercise to brainstorm ideas on how to mitigate the risk of falling off a ladder. We usually get answers like; get training, wear a hard hat, use a harness, use a crash mat, don’t climb it – use scaffolding, get someone better to do it etc. But often it’s not until we have someone from a commercial background that we get “take out some insurance” or “get an indemnity”. Their background and perspective leads them to come up with completely different mitigation approaches. Different functional thinking will yield different solutions. It may not be that we take one action or the other; we might need to combine them. But the key is that we have the cross-functional discussion. Agree the action, do it and manage it.