"Risk Registers" in Progressive Organizations

SGLocky
Written by in Practices
- 0 min read

Hello Everyone,

an organization I am working with is really pushing its senior people to populate and manage a traditional risk register. There is something about this practice that seems to be the antithesis of a progressive approach to management. It is creating a culture where everyone is constantly asking what might go wrong. I'm observing that this then translates into defensiveness and fear of taking actual risks.

But then a corporate risk register is standard practice.

Has anyone any views on this tension?

Thanks, Stephen

| 0 | Flag

leave a reply

Replies (7)

Pim

Pim

Hi Stephen,

Sounds pretty traditional indeed.

Is it 'needed' because of external regulation, or internal processes?

| | 0 | Flag
SGLocky

SGLocky

I don't think it has anything to do with external regulation. It is a cultural thing that seems to have bubbled up. I really can't figure out why.

There always was a risk register, but making it a top feature of every senior meeting is new. It seems to give some people a feeling of control I guess.

| | 0 | Flag
Joost

Joost

Sounds pretty traditional to me as well.
If no other option, why not using a very much simplified risk register that only takes a few minutes to fill in?

| | 1 | Flag
Alexandre Philippe

Alexandre Philippe

The "risk register" is a well known practice of the Project Management Professional certification.

So it might seem very traditionally focused indeed.

However, it has also appeared in the agile version (PMI-ACP - Agile Certified Professional).

In agile, it is used as one of the metrics to prioritize tasks. For example, a task can have moderate value to the customer, and at the same time be really risky because we don't know yet the technology to build it.

Then, it would be prioritized on the top of the tasks.

| | 0 | Flag
Jay

Jay

Risk Management is not a threat and is about considering both positive and negative possible outcomes. The defensiveness and fear described here maybe goes deeper than a Risk Register. The change that I would suggest is that risk planning, like all planning, is more effective if it involves more than just the “senior people”.
“The real reason we need to do risk management is not to avoid risks, but to enable aggressive risk-taking” - Tom DeMarco

| | 0 | Flag
Chris

Chris

I guess it depends on how your organisation is set up. For more traditional organisations where products/services are repeatable and less complicated I would expect to see simple risk registers that aim to highlight areas of concern that deviate from the norm. I would expect those risks to be well managed and to see less diversity across the total number of risks . In organisations that find themselves in increasingly more complex environments I would say it's almost impossible to 'manage' a risk register due to the dynamic, ever-evolving nature of the work. If teams/seniors are working in more progressive frameworks risks should be dealt with through retrospectives, reviews, relentless continuous improvement underpinned by Empiricism (Transparency, Inspection and Adaptation). Just my thoughts...

| | 0 | Flag
Hanna

Hanna

One things we've tried to do working with risk-averse/worried businesses is turn a Risk & Issues log into a live "Decisions" list on our planning board. This forces us to think about the risks as decisions we need to make and then move the various activities flowing out from them into a backlog. As others have said, simple things like changing words helps us reframe the thing itself!

Failing that, something simple (like a list of worries) on a digital tool (Planner, Trello, Jira) or visual board can help.

| | 0 | Flag
Flags are private, only visible to forum moderators. Be specific: "It's spam/off-topic/inappropriate because..."
submit

Leave a reply

This field is required. Only use letters, digits, spaces and minus characters.
This field is required.
This field is required.
We only use your email for spam detection purposes.