Five steps for developing your risk maturity | Risk management - Business Resilience Toolkit
Business Resilience Toolkit
5 steps to develop your risk maturity
Presented by Andrew Ellis, Business Consultant
In this video, we walk you through the five stages of risk maturity and how you can improve your organisation’s approach to risk.
Transcript:
When it comes to developing your organisation’s risk maturity, there are 5 steps that you need to progress through.
In this short video, we are going to look at what each of these steps are and how you can progress through them to the next level, ultimately ending up at a place where you have a more resilient business – managing your risks in a best practice manner.
My name is Andrew Ellis and I am a business consultant with CBB.
The model we are using today is based on what Deloitte produced about a decade ago in The Risk Intelligent Enterprise Maturity Model and I think it provides a great perspective to look at your risk management activities, no matter the size, scale or complexity of your organisation.
Level 1 Ad hoc (Tribal and Heroic) is about ad hoc risk management which might be done well by one person or group within the organisation.
Level 2 Specialist Silos is where there are some risk mitigations in place and steps taken to reduce risk. You might have insurance in place and a few simple organisational policies, but risk is only thought about by a few people.
Level 3 Reactive (Top-down) is where the tone of risk management is set at the top and policies/procedures are in place, but risk management is still somewhat reactive.
Many disability and aged care organisations are at this point now – the quality and safeguarding standards that these businesses operate under are about setting minimum standards. However, best practice requires doing more than the minimum.
Level 4 Proactive and Systematic is where risk management is getting more sophisticated. By this point, risk is a factor in every business decision being made, staff take ownership bottom up in the organisation, and a cultural transformation has taken place where all staff view their decisions and actions through a lens of risk management.
Level 5 Risk Intelligent is the highest aspiration, and it is difficult to get an entire organisation to this level. I’ve seen some teams operate at this level, and when you do, you can make amazing decisions which boost profitability and remove the downside risks when things go wrong, as they sometimes do.
There is a big difference between being Risk Intelligent and Risk Averse. Being Risk Intelligent is about knowing what risks your organisation is better than anyone else at taking on, rather than avoiding risk altogether.
If you can increase the maturity of your risk management systems and approach, then you will make your organisation more resilient in the process.
I’ve been in workshops where this model has been shown and it is fascinating to see people look at it and calibrate the risk practices against all the different parts of their organisation. We all want to be level five. It’s only human when you put up a model like this to think that. More often than not, I hear people say that there are functions or parts of the organisation which operate at different levels.
If you work in aged care or disability services, maybe some of the clinical elements of the work are at about a level three or four, but other back office administration functions are more like a level two. If your goal is to put in place the minimum standards of quality and safeguarding for your industry sector, then you are likely only operating at level three at best. Achieving a higher level requires leadership modelling and an organisation commitment to resource it appropriately.
So there you have the 5 steps of the risk maturity model. What level is your team at now? What level is your organisation? We don’t all have to be level 5, but what level do you want to get to?
If you’d like to read more about this topic, then please head to the CBB website where you will be able to find an article I wrote on this topic.
From this video, what stands out as the one or two things you most need to improve? What can you do about that today?
Related video to watch next: all other videos in our Risk Management series.