The recent blockage of the Suez Canal was a rare event that pointed up the need for companies to undertake a certain vital activity every single day: risk management. In today’s post, we’ll define Operational Risk Management and explain why it’s important to make it part of the culture at your organization.
Related on MHA Consulting: Everything You Always Wanted to Know About Managing Risk but Were Afraid to Ask
The blockage for six days last month of the Suez Canal sent a shudder through supply chains around the world. The canal had been closed previously by geopolitical events, but its sudden obstruction by a single grounded ship was unprecedented.
Even before the ship was freed, many people sought to draw lessons from the incident in terms of international shipping and the global supply chain.
One obvious lesson one might draw is: add the possible closure of the Suez and Panama canals to your threat and risk assessments.
That’s not a bad idea for organizations that depend directly or through their vendors on goods that pass through those chokepoints.
But to me the canal blockage underscored the importance of making operational risk management an everyday part of life at every company. Trouble can come from just about anywhere at anytime, and in ways ranging way from the predictable to the borderline unimaginable. That’s why it’s so important to manage risk every day.
Operational risk management (ORM) is the term we use to define the process of identifying and mitigating risks to an organization’s functioning, finances, and reputation. It also involves accepting a degree of risk in the case of threats that are beyond the reach of mitigation, for whatever reason.
ORM looks at the risk to three aspects of the business: people, processes, and technology.
There are four main strategies for mitigating risk: avoiding it, limiting it, transferring it, or accepting it.
ORM is not about eliminating risk completely. It’s about managing it consciously and intelligently.
The ultimate goal of ORM is to protect the organization and its stakeholders.
I’ve written a lot about risk management in the past. To read some of those posts, check out the links at the bottom or go here, here, or here.
The point I want to emphasize today is how important it is to make risk management an everyday activity at your organization. Risk management should be part of your company’s culture.
Work happens every day, issues come up every day, and risk management should be going on every day.
Risk management is not a one-and-done activity. Nor does it qualify as risk management when a company does an assessment of its risks then puts the assessment in a drawer and forgets about it.
Active, intelligent risk management means constantly being on the lookout for risks and constantly taking steps to mitigate them. (See this post from MHA Consulting CEO Michael Herrera on the “The Top 7 Risk Mitigation Controls, in Order.”)
If you have responsibilities for managing risk at your company, as part of a risk management team or business continuity office, you should be helping and guiding your organization to look at risk every single day. This is true whether that risk comes from workers not wearing hearing protection or the possible blockage of a geopolitically important shipping canal.
The recent blockage of the Suez Canal was a reminder that trouble can come at our organizations in many forms, from the predictable to the almost inconceivable. That’s why it’s so important to make operational risk management an everyday part of life at every company.
People involved in risk management and business continuity should work to make risk management a part of the culture at their organizations. By doing so, they’ll help ensure their company is prepared to ride out the next negative event it faces, whether that event springs from an incident that makes headlines around the world or is confined to its own facilities.
For more information on operational risk management and other hot topics in BC and IT/disaster recovery, check out these recent posts from MHA Consulting and BCMMETRICS: