Assessing and Establishing Your Risk Management Policy

Whether you are in the early stages and developing your organization’s risk management policy, or you are assessing the performance of your current risk management policy, it is a prudent practice to evaluate the administration of your risk management policy. This article reviews the key success factors to administrating an effective and efficient risk management policy.

Risk Management Takes a Top Down, Bottom Up Approach

Hands down, the most critical aspect of a successful risk management policy is senior management commitment to the program. Just behind this in a close second place, is commitment from the organizations employees. To have a successful risk management policy, a top down, bottom up approach is required.

When this approach is put in place, you will recognize the following characteristics or key success factors within your risk management policy.

1. The Board

There is visible commitment from the board and a clear strategic direction has been set for establishing a risk management policy within the organization. The board has actively taken a role in setting and communication the risk management process. Further, there is clear commitment from the CEO and the other members of the executive management.

The following check list can assist you in assessing the board’s level of commitment to the risk management policy for your organization:

• A risk management sponsor has been established (could be the entire board, an executive group, or a non-executive committee that reports to the board).
• The level of acceptable downside risk has been established.
• Risk and threats to the organization have been identified and the board is aware of said risks.
• A policy for how unacceptable risk should be handled has been set forth.
• The organization’s ability to reduce the probability and impact of risks on the business has been assessed.
• An understanding of a cost and benefit of controlling risks has been established.
• The board has an understanding of the risks associated with its decisions.

2. Employees

Roles and responsibilities have been defined throughout the organization and employees understand their obligation to adhere to the risk management policy.

The following check list can assist you in assessing employee’s level of understanding and commitment to the risk management policy for your organization:

• Employees understand their responsibility of managing risk on a day-to-day basis.
• Risk management awareness is promoted by department and business unit level managers.
• Risk management policy and procedures is present in normal business operations and meetings.
• Risk management policies and procedures are present in all stages of project lifecycles.

3. Resources and Training

Resources for training and the development of risk management policy awareness have been allocated. Adhering to and understanding the risk management policy is essential to a successful policy. It is vital that risk management is considered normal business activities by all employees within the organization.

The following check list can assist you in assessing employee’s level of understanding and commitment to the risk management policy for your organization:

• The risk management policy is present in the organizational manual.
• Awareness training occurs at regular intervals.
• Incidents and nonconformities (if complying with an international standard) are reported by employees.
• Controls are followed and understood by all employees.

The above items should be considered a minimal for a successful risk management policy. By assessing your organization’s risk management policy, or utilizing this checklist as a starting point for your risk management policy, you are taking the first steps in ensuring an effective and efficient risk management policy.