There is a better way of managing risk

You are not a fan of the traditional risk management framework but what is the alternative?

A much better way is to integrate risk management messages into all the different processes and procedures within the organisation, so it kind of becomes part of day-to-day life, as opposed to a separate risk document. That’s one, that’s like the framework itself.

Once a quarter, c-suites and boards sit down to identify the risks currently affecting their businesses and look for ways to mitigate them. Is this the most effective way of doing risk assessments?

No. This traditional way to quarterly sit down and discuss risks for the sake of discussing risks is pointless. Instead of trying to, in a single sitting, capture all the risks simultaneously and have a whole complete picture of the company, which is unrealistic and naïve, how about having small risk discussions every time an important decision is about to take place. Instead of doing one big quarterly risk assessment, do dozens of smaller risk assessments, but do them sporadically.

You have been quite outspoken on the effectiveness of the traditional style of risk reporting. What are the alternatives?

The traditional approach is to have a risk report; it might be quarterly or monthly, it doesn’t really matter. But, this is, of course, silly because that’s not how business reports on performance and objectives because they have their own standard performance report which is your management reporting or financial reporting. There are existing reporting channels and frequencies within the company. A much better approach is to integrate risk information into the actual reporting and change how the other reports, those actual, real business reports look like, as opposed to creating your own stuff.

If you want to hear more of Alex’s thoughts, there is still time to register here.