You’ll need to manage a shared risk when
- you depend on the cooperation of others to achieve your objectives
- your efforts to control the risk depends on others or has consequences for them
- achieving your objectives produces consequences for others.
The Victorian Government Risk Management Framework (VGRMF)(opens in a new window) requires organisations to identify and manage shared risks in cooperation with other organisations:
“shared risks are identified and managed through communication, collaboration and/ or coordination by the impacted agencies”
The VGRMF focusses on risks shared between organisations in the Victorian public sector. To fulfil the broader remit to create and protect value, an organisation may need to look at partnerships with organisations in other levels of governments and outside the public sector.
Also, many shared risks have state-significant consequences that are covered in the VGRMF.
Grasping the full effects of uncertainty in a highly connected world
Risk is the effect of uncertainty on our objectives.
Often, a risk is specific to an organisation. It’s a risk to your objectives. Most of our work to create and protect value for Victorians will depend on others and have consequences for them too.
As public service organisations, we also need to bear in mind that, although we may be on the staff of one organisation, we’re implementing the policies of the Victorian Government and creating and protecting value for all Victorians equally.
We’re also working in a sophisticated, interconnected economy, which means when you’re thinking about dependencies and impacts, you may need to look more widely than the Victorian public sector.
It may be better to assume that a risk is shared
Collaborating on the management of shared risk
1. Start by identifying a risk as shared
As part of your risk assessment, you identify risks to your objectives and analyse their source and its causes, factors and likelihood.
That assessment should reveal where you depend on others to control a risk and where potential consequences would affect others.
We recommend you start with the assumption that a risk is shared and ‘prove’ that it’s not by working through your risk assessment.
Analyse your risk to find out if your
- risk has its source in what another organisation is doing
- ability to achieve your objective depends on another organisation doing something differently from before
- achievement of your objectives produces a risk for another organisation
- achievement of your objectives would actually impact another organisation in some way
Based on the risk assessment, look at how to control that risk. Again, look at whether
- your ability to control this risk on your own depends on other organisations
- the only way to control the risk is to cooperate with others.
Having uncovered a shared risk, don’t assume that the other organisations are managing it. Instead, start the conversation. Find out what they’re doing. If they haven’t identified this risk yet, work on getting buy in.
A shared assessment of likelihood and consequences?
Working with other partners and stakeholders to analyse a risk will very likely lead to a better analysis because you build a richer understanding of the consequences and a more accurate estimation of its likelihood.
Does this mean all the organisations must share the same evaluation of a risk?
Not necessarily. During the evaluation stage of the risk assessment, a risk is checked against the organisation’s risk appetite and tolerance—both are specific to an organisation.
So you might share the same analysis of the likelihood and consequences of the risk but differ in your evaluations.
The point is not about you having the same evaluation but your organisations agreeing that it’s significant and warrants shared risk management.
2. Get buy-in
Once you’ve identified a risk as shared and analysed the dependencies and impacts, you’ll need to open discussions with organisations, communities, groups and individuals.
At this point, the quality of the relationships you have with other organisations and their leaders’ willingness to influence their peers and get ‘buy-in’ will often make the difference.
Open the discussion
Use the systems mapping technique(opens in a new window) again to identify all the participants and their influence.
Work out who
- you need to talk to in the other organisations that might be part of this situation of uncertainty
- in your own organisation is best placed to use their influence to get buy-in from others.
Now, apply your risk management skills to
- define the objective of your communications with potential participants
- assess the risks to the success of your communication with other organisations
- plan your opening communications to increase your chances of getting buy-in.
The initial goal of these discussions with other organisations is to understand the amount and type of uncertainty you’re all facing and, potentially, agree to cooperate on a thorough assessment of the risks arising from that.
Talk about our situation of uncertainty rather than your risk
We recommend that when you start your conversations, speak about the uncertainty that has produced this risk for you rather than focus on the risks that it presents for your organisation specifically.
This way you’ll open up the discussion about something that should matter to them, rather than trying to get them to cooperate on something that matters to you. You’ll start to create a common language and a shared understanding of the risk.
Another benefit of this approach is you’ll get a richer picture of the uncertainty that’s producing this risk for you and how the consequences of a potential event could impact others.
It’s unlikely that any single organisation will fully grasp the uncertainty and its implications for their own objectives, let alone another organisation’s objectives, so this is a worthwhile exercise even if it doesn’t result in an agreement to share the management of risks.
It’s also an opportunity to talk frankly about where your interests and objectives diverge, or even conflict. In both cases, the differences will need to be managed.
Find the right level of influence
You don’t need to go straight to the top for your influencer. The system mapping technique(opens in a new window) will help you identify who the best people are to influence potential partners.
Use that influence well by assessing the risks thoroughly: both the shared risk and the risks associated with the initial discussions with potential partners. Go into your meeting with your potential influencer with a strategy and brief them well on your risk assessment and the opportunity to collaborate.
The role of the executive
Executive team members have an important role in using their influence to get buy-in from others on sharing the management of risk.
Tools
Use these guides and templates to help you to identify and manage stakeholders
3. Commit to working together
If, because of your discussions, your organisations agree that they should collaborate to manage shared risk, then the next step is to commit resources to
- a more detailed risk assessment
- options for controlling the risk
- frameworks and processes
- governance.
A crucial decision at this point is to agree on which organisation will lead the partnership.
Every organisation has different frameworks, processes, governance and even language for managing risk, so we recommend that you concentrate on the culture of your collaboration to start with. This way, all the participants remain open to the work of managing the risks that emerge from this situation of uncertainty.
What about frameworks and processes?
Frameworks and processes are vital for risk management because they facilitate the flow of information and formalise responsibility and governance. They are also ‘scalable’ and consistent, which improves accountability and efficiency.
Whatever frameworks and processes you and your partner organisations design, they should help you to collaborate on shared risk
We have topics on designing processes and building frameworks, so we’ll focus here on the design criteria that you’ll need to bear in mind for the various aspects of collaboration on shared risks.
Even when you’ve established relationships, frameworks and processes …
Many of our examples show how important it is to identify a risk as shared and analyse it so that you can start the conversation with potential partners about the work that needs to be done and set up appropriate governance and resources to manage it.
Sometimes risk can fall off the table though, even when a partnership has a long history of working together and well-established practices.
Updated