Risk Management for Dummies?

[hellkat]

Does someone here - I vaguely remember - perhaps deal with risk management?

(could be another forum, possibly unrelated to motorcycling, admittedly where the risk-management people hang out, LOL)

I've been asked by my boss get to grips with our "risk register" system - to provide extra resilience in case with our Head of Assurance gets sick [or whatevs].

So although I am happy to take notes whilst I listen to her explain how it works, what she does, etc, I need to get a much firmer grip of just what the hell I need to understand.
Therefore, extra reading matter after hours.

I've sat in on a few online seminars for NEDs, as well as following the journey (when I've been taking minutes) of our own hospital whilst the HoA was overhauling ours in the last couple of years - although a lot of it went right over my head at the time, I do grasp the general idea - but I need to understand more about it, without the intensity of an MBA-level course I'm about to plough into the NHS England website but not tonight, I don't have the fortitude - or the pay packet - to do it at this time of night.

Any suggestions for some light bedtime reading?
____________________
Not nearly as interesting in real life.

[hellkat]

Meanwhile, google has been my friend and sent me some nice simple slides The Five Ts of Risk Management, The Five Ws for the win, etc ad nauseum.

Am so NOT reading any of that tonight!
When I have a fresh brain ...
____________________
Not nearly as interesting in real life.

[stinkwheel]

I circumvent a lot of it by saying to anyone who asks that no two situations I encounter are the same so I perform a dynamic risk assessment for every task. "dynamic risk assessment" sounds so wonderfully buzz-wordy that they usually swallow it.

When I get students in, I give them a health and safety briefing which goes as follows: "Do not do anything you think may be dangerous. If you see someone else doing something you think may be dangerous, tell them to stop. If they don't, tell me.". And that is H&S in a nutshell.

I also give them a fire briefing. "In the case of fire, raise the alarm by setting off the alarm and/or shouting "Fire! Fire!", Leave the building by the nearest exit. Assemble in the carpark. Dial 999 as soon as it is safe to do so.".

I believe someone else gives them a huge folder of shite to read through and sign to say they've read it. Which they wont actually read or absorb in any way. I suspect the production of this is what they want you to do?

I did do a bit on Hazard Analysis and Critical Control Points (HACCP) at one time, but it's very dry and I concluded it's also useless because people are people and you need to keep things simple. They spend more time finding ways to skip forwards through online training videos and cheat on the test than they do actually doing the online training. They brought in online training at my work and i don't think a single person actually watched it all, they just left the player running in the background on mute while they got on with something else.

The fire safety officer when I was doing basic training in the TA had the right idea. He sat everyone down and showed an unredacted film of the Bradford stadium fire (which is scarily only about 10 minutes long). Then said "This concludes your first lesson on fire safety. Dismissed". The following lessons were given the classes full attention.
____________________
“Rule one: Always stick around for one more drink. That's when things happen. That's when you find out everything you want to know.”
I did the 2010 Round Britain Rally on my 350 Bullet. 89 landmarks, 3 months, 9,500 miles.

[hellkat]

This is more like ALL the risks in ALL the directorates and departments ALL at once - its like a series of individual risk registers all amalgamated into one big one, and which then has to be aligned with the risk register/s of another (much much larger) hospital at some point in the very near future.

Luckily I don't expect to have to be involved in that aspect of it, I'm only apparently learning this so that if she gets ROBaB then there is still someone (i.e., me) who can pick it up and do the daily whatevs.

I'm not sure I'm the right person for the task but it gives me a bit of a challenge and some extra experience I'd not have had otherwise
____________________
Not nearly as interesting in real life.

[hellkat]

I suspect there may be a lot of spreadsheet wrangling of which I am not a fan.

I've only just managed to get the hang of Excel enough to run a short monthly report of which clinical guidelines or corporate policies are outstanding.
____________________
Not nearly as interesting in real life.

[hellkat]

[Islander]

Risk management is fairly straightforward.

1. Identify the risk and make sure it IS a risk.
2. Identify any threats that may affect the risk.
3. Assess the likelihood of the threat impacting the risk (usually on a scale of 1-5)
4. Assess the likely impact of a threat against that risk (again 1-5)
5. Multiply the likelihood with the impact and that's the risk score.

Depending on your organisation's risk appetite you can treat the risk one of several ways.

1. Accept the risk (retention)
2. Transfer the risk usually insurance or contracts.
3. Reduce the risk by applying a control that reduces likelihood, impact, or both.
4. Avoid the risk by not doing whatever it is that causes it.
5. Share the risk by distributing it among other organisations/services.

Once you've treated the risk whatever remains is called the residual risk.

Rinse and repeat. The aim is to reduce your risk profile through iteration which is why risk register entries are usually a permanent fixture on the agenda of senior management meetings.

[c_dug]

Hey HK, I don't expect it's me you're thinking of but I'm a qualified H&S nerd, got my diploma and all the boring stuff.

I've also been involved in some organisational level risk management planning at a fairly high level, which is more the general operational risks rather than the specific H&S side of things (e.g. "What if there was a giant fire which makes HQ unoccupiable for months?") which is probably more relevant.

Worth noting I don't do it as a job per se, but if you have any questions or need some pointers I'd be happy to help. Anything in particular?
____________________
I am a bellend, I am a man of constant sorrow, I am a gummy bear, I am a rock.

[Robby]

Seeing as risk is a whole collection of professions in its own right, I'd start off by getting clear on what they want you to do. When they start rabbit holing, drag them back to what they want you to do.

My best guess is that your job would be to wrangle the spreadsheet of spreadsheets. Get the assorted inputs from across the business, and put the ones with big scary numbers into one spreadsheet.

Hand that spreadsheet over to a board, or someone senior enough to make decisions.

Repeat the process every month or so.

[hellkat]

I knew someone knew something about it in here
(interestingly there was someone on the other forum who knew something about it, but not in this much detail)

[hellkat]

[hellkat]

[MCN]

[Robby]

Generally you only show the seniors what they need to see, and in a simple format. This generally means primary colours and short words.

When you're being shown how to do it, make sure to differentiate between what you need to know to do this job, and wider risk management stuff. Be prepared to interrupt, and to say when you don't get it. People like this have a tendency to dump too much information on you, a lot of which you don't really need.

Also be clear on what is your responsibility, and what is not. The bulk of it will not be yours. I expect a lot of the work is chasing people to provide their numbers for this month.

[hellkat]

[hellkat]