Many people believe that once you design an ERM program, that is it. No changes. No adaptability. It’s our way or the highway when it comes to risk management.
But it shouldn’t be that way.
Instead, we should treat ERM as an experiment.
Risk management practioners use their knowledge and experiences to design a process that we think will work. But there is no guarantee it will work. As risk management professionals, we need to change our way of thinking.
When companies come up with a great idea for a new product, they develop a prototype, test it, make modifications, test it again, do a limited product release for feedback, make modifications based on feedback, then go into mass manufacturing.
ERM can be treated the same way. Pretty cool, huh?
ERM professionals can design and document the process as we think it will work, run it by a small “test” group, make changes based on the participants’ feedback and experience, then try it out again with the same group. Keep repeating until the process is working smoothly, and the outputs are what the executives need for decision-making…because we can’t forget ERM’s primary role – to provide timely information to leadership for decision-making in order to properly manage risks and pursue the best opportunities.
I call this iterative process “piloting” the ERM process, similar to a familiar scenario when new software programs are being implemented in the organization, and a pilot business unit tests the new functionality before it is released to the entire organization.
Pilots can and should be conducted for both brand-new ERM programs and existing processes that are getting updated.
There are five reasons for why am I a proponent of conducting an ERM pilot:
- Verifies the designed process works well for the organization
- Allows for timely feedback
- Gives employees an opportunity to observe and/or participate in the process
- Gains early adoption and buy-in for the concept and application of ERM
- Provides time to revise the process to fit the organization’s needs and culture
Can’t beat those reasons, right?
For example, you think that one method of risk identification will work best (you may want to check out my eBook on this topic!). But to ensure it works as you think it does, select a small group of people to be your pilot group. How does the risk identification method work? Did it go as expected? Or do you need to use a different method to get the desired output?
Or a risk assessment is needed for a group of identified risks. Pilot this part of the process. What kind of experience did the participants have? Did you solicit their feedback throughout the discussions?
Remember…the success of the ERM Program depends on how the process is received and experienced.
Have you tried piloting your ERM processes? What happened when you did?
I invite you to share your stories or questions in the comment field below; or join the conversation on LinkedIn.
And I want to encourage organizations of all sizes to not think risk management is something to put at the bottom of the stack until something bad happens. Not doing what you can to anticipate future events AND identify opportunities can hinder your organization’s potential.
Continue browsing or subscribe to my blog to learn more about my approach to ERM. And you can always contact me directly to discuss your organization’s threats and opportunities.
