Best practice risk management

Risk management today – on the edge of change

It is easy to show that traditional risk management approaches are useful to a point (they are much better than no risk management at all) AND also that they are far from the best approach to uncertainty in organisations.   AS/NZS ISO31000 may represent accepted practice but it is certainly not best possible practice, even when applied within a larger Enterprise Risk Management (ERM) approach.

The world we live in is complex and constantly changing.  We also face constant uncertainty simply because people are involved and this means that everything we do is impacted upon by intangible factors such as relationships, agendas, and biases.  Many of these are hidden and unknowable or at best can be inferred from behaviour.   Let’s not leave out risks that are sensitive to talk about because they involve people.  It’s not likely that you will feel free to list the incompetence of your boss as a source of risk in your risk register, despite the huge impact that this could have on your future success!

Traditional forms of risk register are NEVER the whole risk story.  They can’t be, even in an organisation that is working well and succeeding.  This is demonstrated whenever disasters or serious failures are investigated.  In almost every case some or all of the major sources of risk were NOT in the risk register.  If we accept that risk registers are never the whole story and that many risks are hidden, intangible, subtle and inter-related then we have to look beyond current accepted risk management approaches.  They simply are not enough.

Arguably, we should re-frame risk management from first principles.  What is a risk and what is it a risk to?  How can leaders make the best possible decisions when always faced with uncertainty including unknowable unknowns?  How do we find the root causes and leverage points in complex, inter-related organisational issues, factors and sources of risk?  What do we do about risks that are hard to talk about, let alone write down?

Today, right now, what advice and support can risk professionals give to leaders of organisations so that they are able to make the best possible decisions in our uncertain, complex world?   What does best practice risk management really look like?

For some thinking  and practical responses to these questions go to or to    Or simply surf the web looking for people working innovatively on risk and uncertainty.