Leaders of traditional organisations often look at the discussion of Responsive Organistions with horror. Confronted with transparency, autonomy, less process and experimentation they exclaim ‘where’s the risk management?’ Responsive Organisations can have highly effective risk management but they leverage adaptation not compliance in managing risk.
Traditional Risk Management.
Traditional risk management is an elegant science. Determine the risks, their frequency and their consequences. Choose your appetite to take risk informed by this assessment and the cost and outcomes of mitigation. We mitigate or accept risks driven by the risk appetite. This process is straight forward in organisations where the focus is scaling a proven process or business model. Risks and their mitigants are reasonably well understood.
We often focus on the compliance, policies and processes as risk management. They are simply the mitigation, an outcome of what should be a considered decision of what risks to take and which risks to avoid. Many businesses go wrong when they forget to set a risk appetite and seek to mitigate all risk. We have seen organisations where risk appetite declines and processes are tightened with every bad outcome.
Responsive Risk Management
Responsive Organisations approach risk with the same fundamentally commercial logic. However they tackle the risk assessment and mitigation in a more adaptive and systemic way.
If the risks of activity are unclear, hard to assess or changing quickly more dynamic risk management will be required. We step out of the domain of setting a fixed policy or process and move into learning in a distributed way. We apply the same process but we learn and mitigate risk using other methods.
Better understanding by leveraging the insights of entire network of the organisation and its stakeholders is a risk mitigation strategy. So is a continuous process of experimentation to ensure losses are small until greater confidence is achieved. Autonomy shifts the locus of accountability closer to every day risk decisions and accelerates the responsiveness to bad outcomes. Most importantly of all motivating people through purpose and a focus on outcomes mitigates the incentive mismatches which create many risks for traditional organisations.
The best risk management strategy is responsible, engaged and responsive people. People help drive the adaptation and response to a changing environment of risks. Responsive Organisations manage risk using this distributed capability to adapt.
