But what if your organization doesn’t have a proactive risk culture? Good news: You can change this. And you can do it with a single meeting. The next time a risk event occurs, schedule a post-mortem. Get all the departments who were impacted represented in a room, and break down what happened.
These are the questions you’re going to want to ask:
- What was the risk event? For example: One of our suppliers declared force majeure.
- How did we learn about the risk event? For example: Our supplier notified us.
- When did we learn about the risk event? For example: 3 days after it occurred.
- What were the qualitative effects of the risk event? For example: We didn’t get our goods delivered on time. We had production downtime. We had to put some of our products on backorder.
- What was the quantitative effect of the risk event? For example: We lost $300,000 in revenue.
- And the last, most important question: How could we have avoided this?
Every organization is different, and might have additional pieces of information they want gathered during their risk event post-mortem, but these questions are core, and should form the basis of the discussion. If you need to change your company’s risk culture from reactive to proactive, this meeting is a great way to start, because it makes the negative impact of risk real and concrete to all stakeholders. (Even if you don’t need to change your risk culture, these meetings are absolutely necessary. They help the organization come together to understand what went wrong, and create an opportunity to discuss potential solutions.)