Roads to Resilience

Section 2: Resilience Principle No 1: ‘Risk Radar’

Overview of the ‘Risk Radar’ principle

challenging circumstances are identified, analysed and the potential impacts are evaluated for a wider range of risks, including upside risks. Being aware of emerging risks and able to prevent a crisis from becoming a disaster is a key characteristic identified in the case study organisations. Establishing effective risk radar requires organisations to expand their risk management processes beyond conventional risk mapping approaches to include all networks and stakeholders.

Introduction to ‘Risk Radar’ Quickly identifying emerging issues and risks is crucial to maintaining an influence over events. The first principle of resilience identified in the case study organisations was a highly-developed capability for understanding expected risks and planning the response to unexpected risks – an ‘early-warning’ system. This is referred to as risk radar and it is described in this report as the overarching principle, because it supports both risk management planning and crisis response. Resilient organisations know that when the responsibility for risk is shared, the vigilance of everyone in an organisation is more powerful than relying solely on a risk management department. This section explains risk radar and gives insights into how the case study organisations have built this capability, which enables them to be more aware of a wider range of emerging risk, both in relation to adverse and beneficial developments. Effective risk radar will ensure that an organisation can anticipate and plan responses to developments, including disruptive events and emerging challenges, as well as beneficial changes in the business environment. With good risk radar , organisations have earlier indication of the unexpected. This also results in the number of unexpected developments becoming proportionately smaller and the organisation being in a better position to take advantage of changes. Early indicators of

2.  Constant Vigilance: not only is everyone responsible for guarding against risk, but they do this constantly rather than relying on a periodic review of the risk register. All employees have the time and expertise to be on the look-out for the expected and help respond to the unexpected. For example, at AIG, the organisation strives to ensure that “ everybody is managing all the risks all the time … ” (Chief Risk Officer, AIG). 3.  Avoid Complacency: there is a danger that organisations constantly administering the same business and operational processes can become complacent, over-confident that everything is under control and miss warning signals, including beneficial developments. This can lead to emerging risks being overlooked or under-estimated, as initially they appear inconsequential. Therefore, resilient organisations recognise the threat of complacency and take steps to avoid it. For example, Drax, which runs a major power station, believes that it should never feel at-ease and aims to maintain a “ ‘chronic unease’, so complacency must not set in ” (Generation Manager, Drax). means asking awkward questions. For example, at InterContinental Hotel Group the non-executive directors are trained in risk management issues directly after they are appointed. They are then expected to provide objective and critical feedback. In addition to encouraging employees to ask questions, risk radar depends on applying suitable tools and techniques, as described below. 4.  Challenging Questioning: everyone is encouraged and empowered to raise their concerns, even if this

Understanding ‘Risk Radar’

There are four components associated with this principle of risk radar :

1.  High Involvement: radar involves everyone within an organisation being aware of the need to be on the lookout for emerging risks. This means that the responsibility and commitment to recognise and manage risks resides not only within the risk function. Operations people at every level, for example, can play a key role in providing risk radar , as in the boxed extract from the InterContinental Hotel Group (IHG) case study demonstrates. However, the research demonstrated that risk radar is also important in setting strategy and developing tactics.

26

Section 2: Resilience Principle No 1: ‘Risk Radar’