Simply developing and adopting a risk policy is not enough to make an organisation one that recognises risk as a key driver influencing decision making. A good risk management process needs to be integrated with other business processes and be one of the factors considered in all the organisation’s decisions. When establishing the risk context, the organisation needs to establish processes to ensure risk management becomes part of business as usual.

For any organisation embarking on risk management, staff commitment will be a big issue. In order to become committed to a new business process, people need to understand:

• The need (why risk management is important)
• What is required
• How it will be implemented
• Benefits and/or gains of the policy.

Why risk management is important

It is important for the organisation to ensure the risk management policy and any resulting management decisions are communicated throughout the organisation. The risk management co-ordinator should develop a timely communication strategy where everyone receives the same message.

Briefing forums for each area of the organisation, led by the senior manager responsible for that area, with all forums following the same script

• Internal newsletter articles about the project
• Meetings with the key risk management teams
• Ongoing one-to-one conversations with key staff to ensure risk remains a regularly discussed topic
• Quarterly reports from the project team to senior management on the risk project, with input coming from all directly involved staff as key activities are completed.
• Celebrating key milestones by sending out regular emails.

What does risk management require?

Individuals need to understand what it is that is required of them. AS/NZS 4360 provides an easily understood risk management framework and is a useful tool for explaining how business will change when risk management is taken.