Risk Management

by Peter Parkes

Organising a risk workshop

Initially, we may wish to write down all the risks we can think of ourselves. Unless we work in complete isolation, however, we will be affected by those around us – both causing risk to them and being affected by risk generated by them. Even if this is not the case, then those around us are likely to have complementary experiences and different viewpoints to help identify risk, estimate it, and think of things to do about it. Hence, for any significant operation or project, you should always seek to organise a risk workshop to initiate your map of the risks in your world.

As with any workshop, it is usually best to get someone independent to manage the process and arbitrate.

  • Some organisations have a post of risk manager, whose role is to manage and communicate the risk process.
  • Some organisations have internal trained facilitators.
  • Others buy-in trained consultants when required for these purposes.

Get as wide a representation as possible – representatives from different departments, people with different outlooks, old and young, and junior and senior grades.

In terms of The process of risk management, the risk workshop is of crucial importance in Step 1: Identifying risks. As with any other workshop, however, a side benefit is that it is a good way of getting everyone else to buy-in to the process – much better than sending people a completed risk register and asking them to update their actions accordingly.

Before the workshop

Ask around to discover who could usefully contribute to the workshop. Ideally, you should meet your nominees to tell them your purpose: say, to identify risks in the new production process, and what the process and durations will be. You should at least send people this information so that they have some background and expectations before arriving at the workshop.

The first session

For risk identification, brainstorming is an excellent starting point, and the usual rule applies: no evaluation. At this point we want to capture everything, and we can argue if items are risks or issues, impossible or certain, in hand or out of control, later.

Whoever is facilitating may be comfortable using other Tools for risk management to help identify potential causes of risk. Systems and processes lend themselves to logical tools from the TQM (Total Quality Management) stable of fault analysis.


Once you/the facilitator feels that a good proportion of risks have been gathered – for example, just before input has slowed to a standstill – it is time to move to the next stage of the process. It is good practice to break to write up your results from risk identification, rationalise them, and share them back to the group for review. This could be over a tea break or organised as a follow-up session.

Part of the off-line review after the first session will be to apply some logic to the output from brainstorming to capture the results. You will have captured a good mix of risks, causes, consequences, issues – and hobby horses. Now, they need to be put into a logical order in the risk register.

Sample risk register in MS Excel format.

Second session

The aim of the next session will be to come to some agreement over the likelihood and impact of risks, Someone with good facilitation skills will be required to help everyone to come to a consensus. The normal practice is for people to work within percentage bands, but don’t get too hung up about this – the important thing is what you do about the risks rather than whether the probability of their occurring is 45 per cent or 55 per cent.

Having assessed the risks, you will now move on down the process to agree what should be done about them and decide who should be responsible for doing it.

At this point, you will be getting into resource issues and you may need to involve a different group of stakeholders, but remember to share the output from any workshop with those who have participated or contributed.