How to use Key Risk Indicators to keep score

Implementing effective risk management in an organisation requires change. Starting with leaders and then cascading throughout the organisation. This kind of change takes hearts and minds, and the many current approaches to risk management are simply not compelling enough. This article will explain how to use Key Risk Indicators to keep score.

We’ll also share some uncomfortable truths about current risk management protocols. And provide you with an antidote of refreshing ideas to help you align risk management with the perspectives of your organisation’s leadership.

Why some leaders resist risk management

A small minority just do not want to know. They prefer blissful ignorance to dealing with the cold, hard truth. But this bubble will burst quickly because today’s business environment is full of volatility, uncertainty, complexity and ambiguity.

One CEO even described, “The worst day of my entire year is when I have to sit down and read the risk register. It’s so depressing to list all the things that could destroy our business. It makes me want to sell my shares.”

Unlike those alarmists who devise worst-case scenarios for events such as Covid-19, good risk management considers both impact and likelihood. Of course, there’s a possibility that Covid will wipe out 25% of the world’s population, but what’s the actual probability? It is very, very low. Stop trying to scare everyone with this kind of analysis. It’s not helpful and it undermines credibility. Just tell us what you think will actually happen.

Risk assessments alone aren’t keeping score

The “score” for the impact and likelihood of a risk is not what we mean by “keeping score”. Instead, this serves a different purpose.

We know that businesses face many risks.

Assessment scoring is simply a quick and consistent way to compare different types of risks with predefined definitions of impact and likelihood.

This allows for prioritisation and focus. Which is an essential step in taking a proactive approach to managing the business and allocating limited resources to address key issues and uncertainties. While the benefits of this approach are significant, it is still not keeping score from a profit, loss, and performance perspective.

No one wants to see risks in the red zone, and everybody wants to see these improve. But even if they do, we must recognise that the definitions of impact and likelihood here are very broad and only an estimate to begin with. So these values are not real data points. If you look at most standard risk reports and registers, you will find they usually do not contain any concrete data points at all.

Why play a game without keeping score?

While risk is not always top of mind for C-suite executives, the numbers are important to them. It’s part of the innate winning and competitive mindset that almost all executives have. The need and desire to be a high performing person or team. A “measure and manage” mantra is present in the culture of many companies.

Yet risk management, a discipline designed to help you manage the most important problems, projects and issues, actually uses very few actual data points. Let us be frank, subjective ratings and traffic lights do not really count as data.

Recognising this gap and need, GOAT Risk™ introduces metrics in the form of Key Risk Indicators (KRIs) into the risk management process. This is a crucial step that transforms the approach from a static and uninteresting one into a strategic tool that helps users identify, manage and drive change in their organisations.

Imagine if you had a report that prioritised key issue areas across your organisation. These risk areas would be managed and updated by their respective leaders. So you would have all the latest updates, issues, actions, and performance metrics at your fingertips. Then you could see the true picture.

Currently, there is just not anything like this. Even in organisations that are the most advanced with balanced scorecards and performance mindsets. But it is key to unlocking the true potential of risk management. It helps you run your business better. Make important decisions. Drive lasting and meaningful change, and gain competitive advantage.

How do you know you’re winning?

If your job is to own and manage risk in your area, what are your key risk indicators? How do you know if you are winning?

Business leaders and subject matter experts in technical fields have asked us the same questions. So what should we be measuring? All businesses and risk areas are unique, but we know people still struggle to identify the metrics that matter.

There is no silver bullet. One of the aspects of culture we introduced in our first blog in this mini-series, ‘Why risk management is important for your business’ was ETCHED. While the ‘D’ represents a data-driven approach, the ‘H’ represents a holistic view. When you take a step back to understand the big picture, you get a more complete view of a risk and its impact. There may be multiple data points and measures that need to be combined, and these may involve current, leading and lagging indicators. In this case, it is likely that you will need to involve other areas and teams, some of which may not fall within your direct remit.

Talk to us if you would like to have a conversation about the metrics that are important to your business.

About the author

Danny Wong is the Founder and CEO of GOAT Risk Solutions. He is a thought leader in risk maturity, having engaged with hundreds of leaders and professionals in extensive market research. He has first-hand experience of supporting major corporates in a +20 year career specialising in Enterprise Risk Management. Danny saw a market opportunity for a simple, low-cost risk software solution to help organisations improve risk management capability. He launched GOAT in 2018.

Find out more about GOAT Risk™