Please… Kill… Me... I have to go to a risk workshop

There is a scene in the 1986 Aliens movie where a doomed crew member is discovered trapped in an alien cocoon awaiting an awful fate. She begs them to kill her.

I’ve seen participants anticipate risk workshops with less cheer and hope.

Why is this the case? Assessing, managing and engaging with risk is crucial to achieving objectives. Why are risk assessments and the workshops they often require seen as tortuous compliance exercises? Why do they often produce ‘outcomes’ which have little utility in practice other than populating a spreadsheet?

In our busy lives, a few hours away from the inbox and the pressures of the here and now to think about the future should be a welcome opportunity. How can we get the most from the investment we make in these activities?

I have eight suggestions for getting the most from a risk workshop and making them slightly more useful and slightly less awful.

1.          Agree what good looks like before you start to tear it down. ‘Setting the Context’ is the first step in the ISO 31000 process for a reason. It is critical to ask the question ‘risk to who and to what’ at the beginning of any assessment. It can help to have relevant strategic, corporate or business plans available to remind participants what they agreed their priorities were. In addition, defining the boundaries and interfaces of a risk assessment are essential to getting a usable outcome. Given how little time you likely have, focusing participants on the right question is key to getting the right answer. Beginning the session with identifying risk is like tearing off down the road without agreeing where you are going.

2.          There’s a fine line between risk management and therapy. Risk workshops can be cathartic – and the first things to be raised will be today’s problems - not enough money, not enough people, etc. etc. However, a degree of venting is pretty much a given. Shutting this down too quickly will stifle what can often be turned into useful conversation, and if you sift these problems of the world you are likely to find some useful risks. Have plenty of ‘parking lots’ ready to capture issues raised, even if they might not immediately contribute to the risk conversation. Wall charts and butcher’s paper are great for this. Having a well-founded but not immediately relevant concern written down can sometimes be all it takes to move a discussion on. Study up on human and group biases such as the proximity effect and push-on-itis which can taint the discussion and appropriately manage these when they appear.

3.          Participants should have an oar if they want a place on the boat. Workshop participants will quickly judge the extent to which they can contribute to the assessment and whether this justifies their likely investment in time. Be clear to each participant why they are there, and the ‘hat/s’ they are wearing. People don’t need to be deep experts to make a valuable contribution, but you might need to explain why. Be aware of organisational agendas and manage the conversation to steer around these. To help further, do not have too many participants. More than 12 or so people in a single session can lead to many feeling they have wasted too much of their time. It also allows people to hide and have no opinion. Have the right people in the room at the right time.

4.          Rome wasn’t built in a day. Being locked in a hot windowless room and asked to go from a blank whiteboard to a complete risk assessment in four hours is never going to generate a quality outcome. Participants will toss in any old rubbish to complete the exercise and get out of there. One output of a risk assessment is a set of risks captured in a risk register. Another, which is often more valuable, is the conversations the activity generates. Stage the activity over a number of sessions, each leading into the next. If this isn’t possible, meet a sub-group of participants to gather some ‘seed’ data prior to the main workshop to lead the discussion in the right direction.

5.          Don’t carry a hammer hoping to find nails. Although the basic principles are common, the risk assessment process should be tailored to each circumstance. Strategic risk needs to thought about differently than operational or technical risk, and more complex activities require more sophisticated risk assessment methodologies. There are also many dimensions to a risk such as its potential speed of onset, inherent risk, control effectiveness, interdependencies, etc which can provide the real insight needed to effectively manage it. If nothing else, considering these additional dimensions provides structure for and can encourage a richer discussion. Scale your approach to the complexity of your situation and the ‘DNA’ of the people you are working with.

6.          You can kick the tyres or you can drive the car. Any risk management process is only a vehicle to get to a destination, and no process is perfect. Hence, you can either argue over the vehicle or get in and use it to achieve an outcome. Risk management guidance is guidance, participants need to make professional judgments. Hijacking the time of a dozen other people to debate whether the likelihood scale should have four or five levels is going to add nothing to your collective ability to manage risk. Well prior to any group workshop, always speak with the most influential people likely to be in the room to get them onboard. Seek their advice on how to best engage the group and use their influence to get the most from the team on the day. In the end, it is the ability of the participants to think about uncertainty and the future rather than problems and a process that will differentiate the risk assessment from any other management meeting.

7.          Build a wall, don’t polish stones. The value of debating individual words or consequence scores etc, reaches the point of diminishing returns very quickly. Ultimately, the thing that makes a difference is the effectiveness of the controls and treatments identified and implemented. Debate most what you can change. What contributes to this risk (can we influence it?), what is being done to manage it (is it effective and how can we ensure that?) and do we need to do something differently (are there additional treatments we should implement?). It is human nature to be overconfident about our ability to control risk, yet failed controls are disproportionately responsible for the major risk realisations of history. A culture of constructive challenge is the most powerful counter to this we can build.

8.          Sharpen the knives before you leave the kitchen. A good chef prepares for tomorrow’s work before turning out the light each evening. Any risk assessment is a starting point, never an outcome in its own right. It needs to be converted into tangible action. Don’t close a risk workshop without the participants discussing and agreeing the next steps and how they will contribute to ensuring the conversation becomes a reality. Similarly, a risk assessment represents a snapshot in time, and unless refreshed regularly will become dated and irrelevant.

There is no single recipe to guarantee a successful risk assessment workshop. But thinking of it as a step in a series of well-focused and well-prepared for activities is most likely to lead to rich conversations generating outcomes in practice.