Every activity and situation carries risks. Whether you are launching a new project, providing ongoing services or heading a strategy for widespread organisational change, thorough and effective management of the risks involved is essential to ensure long-term success.

The M_o_R (Management of Risk) methodology, owned by the OGC and administered as a qualification by the APMG, provides a set of principles and generic processes for identifying, analysing and managing the risks that may occur in a business context. This framework is aligned to the other management methodologies associated with the OGC (notable PRINCE2 and MSP), but is design to be used in an organisation or business context.

A risk can be defined as an outcome that is uncertain, and that (were it to occur) would affect the aims or outcome of the organisation. Despite popular usage, therefore, a risk does not have to be negative. It is imperative that a risk manager (or, indeed, any kind of manager) knows how to manage both positive and negative risks to the greatest benefit of the organisation.

Risks affect every level of activity within an organisation. The M_o_R framework draws attention to four key levels (or ‘perspectives’), each of which requires a tailored approach to risk management.

M_o_R: Strategic perspective

Within M_o_R, the ‘strategic’ perspective encompasses long-term decisions related to the overall direction of the organisation. These risks may not be immediately apparent, and can lie dormant for some time after a decision has been made.

For example, a local council might decide to provide a more equal education for all primary school students in its district. This strategy may involve clear long-term benefits in terms of individual, institutional and local academic achievement. It may also involve long-term risks, such as reducing additional opportunities for students at the highest end of the academic spectrum. This may not become apparent for a number of years.

The managers responsible for evaluating the council’s strategy must analyse the probability and potential impact of any such risks in order to enable the most effective approach to risk management.

M_o_R: Programme Management perspective

Medium-term goals are achieved through the programme management perspective. This is the level at which strategy is transformed into a workable change programme. Risk management at the programme level concerns the decisions that are made about the way that the strategy will be fulfilled, and the risks that are implicit in each of those decisions.

For example, the local council may decide that the primary school curriculum needs to be standardised and aligned to that of the local secondary school. This might bring important benefits, such as the adequate preparation of all primary school students in core subject areas. It may also increase parent confidence and force under-performing schools to improve basic standards. However, the programme might also reduce the individuality of the primary school curriculum. There is a risk that the schools and children thriving on a less-structured curriculum might begin to perform badly under the new strictures.

In order to effectively manage risks at a programme level, the risk manager must evaluate the likelihood and importance of the risk against the projected benefits of the change.

M_o_R: Project perspective

Project management is concerned with delivering a set of outputs (or ‘products’) according to a pre-defined scope, budget, schedule and quality specification. Risk management at the level of a project is concerned with the possible incidents or issues that would affect the project output.

For example, the local council may decide to create a standard examination for primary schools, to ensure that all students are adequately prepared in the core subject areas. This project will involve collating a body of knowledge recognised as ‘core’ for primary school students, preparing an acceptable system for examining students, and implementing this new examination system across the local primary schools.

Both the goals and the risks of this project will be more immediate than those involved at the Strategic and Programme perspective. Project risks might include: disputation over material recognised as ‘core’; resistance on the part of teachers and/or parents; failure of the examinations to accurately assess the students’ understanding of the material.

The project risk manager needs to consider how each of these risks may be most effectively managed to ensure delivery of the project outcome to the desired scope and specification.

M_o_R: Operational perspective

Risks are more immediate at ground level, and operational risk management requires a high level of forethought and independent, structured response to convert the project output into real benefits.

Operational risks to the primary school examination scenario considered above might include logistical difficulties organising and processing examinations, or inadequate preparation of the students in coping with exam situations. Those responsible for implementing the new exams must be prepared to deal with issues that may arise during the operation. This preparation comes through identification of risks and thorough analysis of the affect that such risks may have on the concrete outcomes and benefit of the council’s educational strategy.

Summary

Understanding perspective is central to understanding the M_o_R approach to risk management within an organisational environment. Individuals at every level need to be aware of standard processes, techniques and challenges involved in managing the risks associated with their activities and responsibilities.