Risk management simulation: how leaders practise managing risk

Risk is the price of progress, NASA

Risk management is hard to learn from a slide deck, and expensive to learn on the job. This article is for learning and development managers and senior leaders who want their people to practise managing risk before the real thing arrives, and explains how a risk management simulation makes that possible.

Why leaders cannot avoid risk

There are two reasons a risk-free path does not exist in business.

The first is well understood: risk and reward travel together. The level of risk is usually proportional to the reward on offer if it pays off. If we avoid every risk, we will probably earn low or zero rewards, which is not acceptable to the stakeholders of any enterprise, department, or project.

The second is less well understood. Even if we follow a path that looks entirely safe, we are still exposed to risk. It is simply the risk we did not identify or fully consider in advance. If you think you have found a risk-free path, you probably have not done your risk assessment properly.

A rollercoaster example

Imagine you are on a rollercoaster with a possible break in the track between here and the final station. The obvious mitigation is to jump off early, but that carries its own risk of injury. Staying on and hoping for the best is the path of least resistance, and it is seductively appealing.

Experience shows that passive or default paths are rarely the best option when risk is real. The decision is a trade-off, and that is what makes it a dilemma.

Most risk decisions are dilemmas

The hardest risk decisions involve a trade-off between two or more outcomes. In the short term, there is no pain-free compromise. In the rollercoaster example, the trade-off is between a high likelihood of minor injury and a low likelihood of serious harm.

You can read more about spotting and handling these trade-offs in ten dilemmas you must master to become a top business leader.

Likelihood and impact are different things

The example also shows two separate characteristics of any risk:

• Likelihood, which is how probable the risk is
• Impact, which is how much it matters if it happens

Keeping these apart is a key part of effective risk analysis. Conflating them is one of the most common mistakes teams make.

Elective risk and reactive risk

There are two types of risk. Elective risk is the risk you choose to take. Reactive risk is the risk that arrives whether you chose it or not.

Elective risk leads into corporate governance. Weak governance can mean betting the organisation's future on the hoped-for outcome of a single decision. For current thinking on governance, risk, and compliance (GRC), OCEG is a non-profit think tank that publishes free resources on the subject. OCEG describes four components of GRC:

1. Learn about the organisation's context, culture, and key stakeholders to inform objectives, strategy, and actions
2. Align strategy with objectives, and actions with strategy, through decision-making that addresses values, opportunities, threats, and requirements
3. Perform actions that promote and reward what is desirable, prevent and remediate what is undesirable, and detect problems as early as possible
4. Review the design and operating effectiveness of strategy and actions, and whether the objectives are still appropriate

A simple risk management process

Reactive risk leads into risk management. Good practice has four connected steps:

1. Risk identification
2. Risk analysis
3. Risk mitigation
4. Risk review

Risk identification

What could happen that would harm your upcoming project or decision? List every risk you can think of before judging any of them.

Risk analysis

For each risk, rate the likelihood of it happening, and the impact if it did, as low, medium, or high. Many teams show this as a 3x3 matrix of likelihood and impact.

Our free risk analysis tool lets you build a map like this for your own project.

Risk mitigation

For your top priority risks, such as those rated medium or high on both likelihood and impact, decide what you can do. You can reduce the chance of the risk happening, or build resilience so its impact is smaller if it does.

Risk review

Put the mitigations in place, then cycle back through steps one to three regularly. Risks change, so your identification, analysis, and mitigations need to stay current.

Why a simulation beats learning on the job

Learning risk management on the job is a high-risk strategy. It is like an airline pilot learning on a real aeroplane, with a live crew and fare-paying passengers.

An immersive simulation gives teams a safe place to make poor risk decisions and see the consequences, without the cost. Risk management is also a team activity, so it is usually best practised as a team, with real-time feedback on the choices each person makes.

The closer the scenario is to the risks your managers will actually face, the better the learning transfers. You would not train a Boeing 747 pilot in a Spitfire simulator.

Choose the right risk management simulation

The right simulation depends on the kind of risk your people need to handle.

Project risk: Spread

The Spread project management simulation helps participants handle project risks around deadlines, budgets, and unexpected events. It is fully configurable, and a typical set-up looks like this:

1. Set up a project over an agreed period, such as 12 weeks or 12 months
2. Configure a list of project activities for participants to choose from, including good, non-optimum, and undesirable options, so they can learn from poor choices
3. Make activities once-off or repeatable, and link them with hard dependencies, which block a task, or soft dependencies, which let it run with degraded performance
4. Design a schedule of risk events, each with a trigger time unless it is mitigated first
5. Link activities to the risks they mitigate, fully or partly, and let some mitigations expire so they must be repeated
6. Require more than one activity to mitigate a single risk where that is realistic, as it is in real projects

If the right mitigating activities have not been chosen before a risk event is reached, the risk occurs and participants see what it means for the project. Teams that want to practise leading the people side of a fast-moving project can also look at Crew.

Business risk: Acumen and Acuity

For enterprise-level risk, Acumen and Acuity ask teams to identify and prioritise risks, then mitigate them through their simulation decisions. Mitigation works through risk reduction and through building resilience.

For teams practising the trade-offs at the heart of risk decisions, Dilemma is a good fit. All three sit within our strategic thinking challenge.

Risks specific to your business

If your risks are particular to your industry, products, or data, an off-the-shelf scenario may not fit. We can build a tailor-made simulation around your own risk register and terminology.

Talk to us about risk management learning

Risk management and governance are not skills you can get right first time or learn on the job. If you would like to build them in your leaders or project teams, get in touch and we will help you choose between Spread, Acumen, Acuity, Dilemma, or a bespoke build.