The principles of Risk Register and Mitigation Actions are well known to internal auditors and risk managers.
When one tries to digitalize these concepts, one should make sure to link them in some way, in order to describe that Mitigation Action "A" will reduce the Risk "X" either in terms of quality ("a lot", "a little") or in terms of quantity ("by 10.000.000 €").
Both risks and mitigation actions generally impose costs on the business. But is this the only angle from which to view risk management? The answer we give today is "no"! Let's elaborate further:
It is possible for a Risk, when addressed in the right way, to " generate " an Opportunity. When a Risk is mitigated or even in the process of mitigation it does not just improve an "indicator" of the business but frees up resources (human or otherwise), creates new space for business growth and general progress.
In other words, Risk and Opportunity are in many cases two faces of the same coin. In an earlier article, here, we had discussed an important history lesson! We showed how Fuji Photo Film evolved into Fujifilm by recognizing the risk that technological advances in photography brought to its own business, and at the same time discovering new areas of exploitation - opportunities - of its knowledge capital and expertise.
Identifying the Opportunities " hidden beneath" the Risks is as important as the initial identification of the Risks themselves. For example, it is a mistake if you do not recognize the risk that the climate change related to your geographic area poses to you, but it will also be a mistake if you do not recognize the opportunity for easier financing that your local bank offers for related mitigation actions. So, we believe that identifying Opportunities can be part of the general risk management expertise.
Mitigation actions are the "bond" between Risk and Opportunity since an action that reduces the probability of a risk to occur, at the same time increases the positive impact of the opportunity associated with it.
At E-ON we innovated by integrating Opportunity Management into the general cycle of risk assessment & management. Opportunities are documented and linked to the corresponding risks. So the monitoring of analytical actions concerning the risks is a part of an integrated project management.
By initially having a scoring system for both Risks and Opportunities (the so-called Evaluation Model, in terms of, e.g. impact, probability or other parameters), the result of the process is that we not only monitor the course of each risk over time, but also examine the Opportunity in various ways:
· We measure its effectiveness
· We compare it with our initial prediction of its (positive) impact
· We manage it as a project (monitor resources, costs, etc.)
· If it also generates direct revenue, then we also monitor the 'accounting' part of it.
More information on the Risk Management and Internal Audit platform can be found here, while for the Project Management and Accounting capabilities see here.