International Enterprise Risk Management

Includes avoid, accept, reduce, or share/transfer

Everyone is different and each organization is different in their approach to risk This should be based on your individual judgement, willingness to accept potential consequences, organizational culture, and operating style. Some might be more “risk adverse” while others by necessity or choice might be more “risk-taking.” (Some of our individual clients and groups could not do the work they are doing if they were “risk adverse.”)

Sharing risk might mean

• Insurance(s) or outsourcing based on the decision to share risk through insurance, hiring professional services, and other forms of contracting.
• Internal financing of risk is accomplished through the organization’s (or families) own financial resources, e.g., various forms of self-funded health plans, insurance deductibles or using your savings/reserves/credit.
• Many risks are financed internally, but many are not understood or identified beforehand.
  You retain all of the risk (financial and otherwise) until you do something to address them. Unplanned retention of risk is not “risk management.”
• Insurance that protects the enterprise or family from catastrophic events is often inexpensive relative to the potential loss, and the decision to transfer risk via insurance is usually common sense. Who wants to explain to a board or your supporters/donors that a $5 million loss could have been insured for $2,000? Or that a liability policy, costing a couple hundred dollars, could have covered a scam lawsuit that is now risking your entire work in a particular country and costing your hundreds of hours and bribes and hiring/dealing with local laws and legal representation?

QUESTIONS:

• Is it reasonable to avoid some of the risks (and still accomplish your goals)?
• What risks are you prepared to accept?
• What risks can be reduced by behavior/location/preparedness?
• What risks can be shared/transferred to an insurance carrier?
• Are there risks are you unwilling to address/face at this time?

Risk assessment follows identification and precedes risk response. Its purpose is to help you consider how big the risks are, both individually and collectively, in order to focus attention on the most critical threats and opportunities (and/or likelihood, as well as impact) and allow you to consider the right risk response. Risk assessment is all about measuring and prioritizing risks so that you can make decisions as an organization or family that you can live with. (Rather than either being ignorant of risks, or taking risks without being properly prepared.)

Use qualitative terms (frequent, likely, possible, unlikely, rare) to define risk.

However, as we all know, bad things happen to good people. Unlikely events occur all too often, and many likely events don’t come to pass. Worse, unlikely events often occur with astonishing speed. Likelihood and impact alone do not paint the whole picture.
To answer questions like how fast could the risk arise, how fast could you respond or recover, and how much downtime could you tolerate, you need to gauge vulnerability and how fast you might be impacted. By gauging how vulnerable you are to an event, you develop a picture of your needs.

Refers to the extent to which a risk event might affect your family or whole organization/purpose.

Could a lawsuit cause your organization to shut down? Huge unexpected bills cause you to have to return home? A self-funded health plan may not be prepared to handle a long-term illness, such as a ”million-dollar baby” or dealing with a second crisis while already managing a large long-term crisis. Some risks may impact the enterprise financially while other risks may have a greater impact on your reputation, or the health and safety of your workers/family.

Vulnerability refers to the addition factor of risk due to your location(s), preparedness, local support/care networks, etc. A real option is to consider using insurance (to transfer risk) to protect your finances,reputation, and future.