Identify the Sponsor

Given the use of tools such as “anonymous” voting and facilitated discussion, a risk workshop has the appearance of being a democratic process. It is not. It is a consultation and should be conducted under the leadership of a specific decision maker. Therefore, all risk workshops must have an executive sponsor who is ultimately accountable for the scope of the risks under discussion; someone who is “in charge”; someone who ultimately “owns” the risks. This person is not the risk manager. The role of the sponsor for a risk workshop is to set the context for the workshop, provide a view of their tolerance for risk taking, to pass ultimate judgment, on behalf of the broader organization, on the tolerability of risk exposures, and ultimately be able to present the results to those to whom the sponsor is accountable.

As described throughout the following sections, the sponsor will make decisions concerning the planning and design of the workshop, he or she will play a critical role in setting the context and tone of the workshop itself, and he or she will ultimately assume responsibility for the outputs of the workshop and ensuring that agreed-to actions are completed. Although the risk manager will do all the “heavy lifting” in terms of planning and executing the workshop, the sponsor will need to make key decisions before, during, and after the workshop and together these decisions will be the ultimate determinant of the workshop’s success.

Set the Objectives of the Workshop

It is imperative, in designing a risk workshop, that the facilitator gets a clear understanding of the sponsor’s objectives for the workshop, as this will have implications for most other aspects of workshop design. A useful model for understanding these objectives is illustrated in Exhibit 10.2.

The vertical axis of this figure represents the desired discipline of the workshop. Learning Discipline workshops, at the bottom of this scale, place the emphasis on discussion and casual discourse on the subject risk areas, to enhance individual and collective understanding of the risks, rather than driving toward decision making. The process is loosely defined, there is a lot of scheduled “slack” in the agenda, and the facilitator is relatively hands-off in allowing the discussion to follow the apparent interest of the participants. Learning workshops are well suited to new problems and new risk areas, with relatively cohesive management teams and no real imperative for immediate decision making. Because workshops can be excellent team-building forums, they can also be well-suited to new teams, so long as the goals of the workshop do not include driving to immediate decision making on a specified list of risks and issues.

At the opposite extreme of the vertical axis, Decision-Making Discipline workshops are results-oriented. The agenda is highly prescriptive right down to the minute, the process is highly scripted, and the facilitator keeps the process strictly on-topic and on-schedule. Decision-Making workshops are, as the name implies, called for when a management team must make a decision immediately on the significance of risks and the adequacy of controls. A high degree of trust in the facilitator is required, because the facilitator will play a highly intrusive role in keeping the discussions on-topic and on-schedule.

The horizontal axis of Exhibit 10.2 depicts the focus of the workshop. Broad Focus risk workshops explore arrays or groups of risks at the strategic level. The emphasis is on identifying, understanding, and measuring risks, rather than evaluating the adequacy of mitigants, as the high-level depiction of risks may not lend itself to the discrete evaluation of mitigants to the point where a judgment of adequacy is possible. The agenda of these workshops will allow for greater understanding of the risk environment and the interplay of internal and external factors on the risks. Such workshops are useful for executive teams at the start of a strategic planning exercise. They are also useful at the commencement of large projects or programs (the “storming” stage).

At the opposite end of the horizontal scale in Exhibit 10.2, Narrow Focus risk workshops are targeted at risks that are depicted and understood to a high degree of specificity. Such workshops will normally make use of performance or other indicator data, and may require the participation of functional or technical experts. Narrow workshops also allow for a greater emphasis on the evaluation of controls and mitigants for each risk. These workshops are best suited for technical groups and detailed planning exercises, such as annual departmental business planning.

Note that it is not an either-or decision. The facilitator must get an understanding of where among these four extremes the sponsor’s preference lies. This can be gleaned by asking questions such as:

• How essential is it that we get through all of the risks on the agenda?
• Do you expect that decisions will be made in the room?
• What is the level of understanding of the participants of the risks that are on the agenda? How important is it to you that they understand them all?
• Do you need to develop a detailed understanding of specific elements of these risks and how we are mitigating them, or are you looking for more of a high level of understanding of the risks as a suite?
• What is the level of trust and cohesiveness of this group?

Set the Scope

The scope of the risk workshop will consist of three elements: (1) the Organizational Objectives, (2) the Risk Universe, and (3) the Time Horizon.

1. Organizational Objectives. Specifying the organizational objectives is an important activity because it helps define the scope of the session, it will assist in clarifying which risks will be selected for detailed scrutiny during the workshop, and it forms the basis of reference materials to be used by participants in evaluating risk magnitude. What are the stated objectives of the broader organization, and more specifically the objectives or results for which the sponsor is accountable? Depending on the emphasis on formal objective-setting in the organization, these may be readily obtained (for example, from a Balanced Scorecard or some other formal statement of goals) or may need to be articulated as a step in workshop preparation. Objectives might be defined in areas such as financial results, reputation, customer relationship, operational efficiency, corporate stewardship, safety, and so on.
2. Risk Universe. The risks selected for discussion at a workshop should be drawn from a broader “risk universe.” The facilitator should help the sponsor produce the list of risks in the “universe” that are relevant to the sponsor’s organizational objectives and known to be of possible concern. A risk may be selected for discussion because either it is considered to be a serious threat to one or more of the organizational objectives, or because it is the responsibility of the sponsor to mitigate that risk on behalf of the broader organization.
3. Time Horizon. The sponsor and facilitator set a limit for how far into the future the workshop will look in examining risks. Ordinarily, risk workshops will have a horizon of somewhere between three and seven years. The horizon will be a function of the scope of the organization (more senior-level workshops will tend to have longer horizons), the timeline of the organizational objectives (if the objectives are expressed relative to a specific time horizon, that might be a useful reference point), and the volatility of the business (if the business environment is extremely uncertain then looking forward more than a few years may not yield very reliable results).

Assemble Reference Materials

In order to have an efficient workshop, easy-to-use reference materials are important. The following should be assembled prior to the session.

• Risk Magnitude Scale. An essential tool for any risk workshop is a common framework that participants will use to gauge the magnitude of the risk. Risk magnitude should always be expressed in terms of impact on the organizational objectives. Thus, a magnitude scale will consist of a matrix very much like the one depicted in Exhibit 10.3, with the objectives listed down the left-hand column and a range of potential outcomes laid out under a numerical scale that represents varying degrees of “badness.” Experience has shown that a 1–5 scale provides enough gradations for most workshops. See Box 10.1.

• Probability Scale. Participants will also need a reference to allow consistent ratings of probabilities. Again, a 1–5 scale is recommended, with the midpoint representing a 50/50 chance of occurring at least once over the workshop time horizon. An example is shown in Exhibit 10.4.

• Strength of Mitigants Scale. A step in the process is to allow participants to express their degree of confidence in the mitigants and internal controls in place to manage the risk. Once again a 1–5 scale provides a reasonable degree of granularity. A sample Mitigants Strength scale (in this case with a strong emphasis on internal controls) is shown in Exhibit 10.5.

Set the Agenda

Once the objectives for the workshop have been set, the next task is to set the agenda. An obvious question is how much time is available and how many risks can be covered in the available time? There are no hard-and-fast rules, but as general guidelines:

• An entire day of risk discussions can be exhausting, and after working through eight or so risks, the process will start to seem stilted and formulaic to the participants. Allow adequate time for breaks and do not try to extend a risk workshop beyond eight hours in total. Half-day workshops are more likely to yield a positive experience for participants, even if it means breaking up the workshop over two or more days. Remember, a risk workshop should seem to participants like a stimulating and efficient conversation, not drudgery.
• For a workshop with a reasonable balance between learning and decision making, 40 minutes per risk is the minimum time that should be allotted.
• Some extra time should be allowed for the first few risks until the participants get familiar with the workshop process and tools.

The method for choosing (from the Risk Universe) the risks for discussion is another decision that is primarily up to the sponsor. Alternatives include:

• The sponsor chooses the risks alone. Although this approach is simple and quickly done, it does not allow consultation beyond whatever awareness of the risk profile the sponsor has already. This may cause key or emerging risks to go undiscussed.
• Advance polling, using e-mail, interviews, and so on, to involve the participants in choosing the risks from the Risk Universe in advance of the workshop date. This approach has the principal advantage of broad involvement in the process and a sense of ownership in the agenda among participants. However, it can be more costly and requires considerably more lead time.

• The sponsor and facilitator together arrive at a “best-efforts” list of risks and the participants modify and choose from that list as an early item on the workshop agenda. Anonymous voting techniques may be employed to involve the group in the selection of the risks for discussion at the workshop. This approach represents a reasonable compromise between the above approaches.

Decide on Attendees

For most risk workshops, as a general rule, the target number of active participants should range from about 8 to 16. Smaller groups usually do not offer the variety of perspectives or require formalized facilitation of the type described in this chapter. Larger groups can be unwieldy and there are special challenges in controlling group dynamics and giving everyone a sense that they have had a fair amount of “air time.” Large groups can be accommodated but require additional detailed planning and more experienced facilitators; see the section “Tough Spots.”

The decision on who attends will ultimately be left to the sponsor. The list of attendees will depend very much on which risks are on the agenda for discussion, assuming these are known in advance: the attendee list should allow for full exploration of the risks on the agenda, and, if applicable, decision making on the actions to be taken. This means that the workshop should include functional or technical experts and key management stakeholders and decision makers. Another useful rule is to ensure that any person or group that might reasonably be expected to carry an action item out of the workshop is represented.

Other considerations:

• If the workshop concerns the key risks to the success of a department or business unit within an organization, you will want to ensure that all the key groups within that unit are represented.
• If the workshop concerns key risks to a large project, in addition to the technical experts or “leads” for various facets of the project plan, ensure that the project management office or other key project governance roles are represented.
• If a purpose of the workshop is “team building,” this will be a factor in selecting attendees as well; excluding members of the “team” will have negative consequences on team cohesion and compromise “team building.”
• Consider inviting attendees from other organizations or companies, such as partners or service providers, where the objectives or mitigants are shared or jointly resourced.

To facilitate a risk workshop, the author recommends a two-person facilitation “team.” One person, the “facilitator,” will focus on running the meeting and guiding the discussion. The other person, the “record keeper,” will ensure that what is said or decided at the meeting is recorded. Although it is possible for the facilitator to assume both roles, experience has shown that the workshop can be run more efficiently and produce better documented results if there is a separate record keeper assisting the facilitator. Note: The record keeper role is not just a “recording” function. The record keeper must have the ability to listen to and understand the discussion and boil it all down to a few key points to be recorded and simultaneously displayed to participants (i.e., on to a screen by a projector).

Arrange Venue

Normally a U-shaped seating configuration is preferred as it allows for face-to-face contact, simultaneous reading of displayed materials, and a central position from which the facilitator can direct the discussion and keep everyone engaged. The ideal layout for the room will have two computers and two projectors and screens set up at the front of the room where all participants can see them: one screen for displaying context information and/or voting results (assuming anonymous voting is used) and the other screen for recording the key discussion points. It is also worthwhile to have one or more flipcharts for recording “parked items” and other items that may come up, but are not central to the agenda.

Often it can be helpful to hold the workshop away from the normal place of business, to avoid the temptation for people to sneak back to their desks. To further limit interruptions, the author has in the past deliberately chosen workshop venues where blackberry and cellular service is not available.

Facilitate the Workshop

The purpose of this section is to describe the basic elements common to most or all risk workshops, not to provide a detailed explanation of meeting facilitation techniques. More facilitation “tips and tricks” are provided in the next section. (Note: This section assumes the use of anonymous voting, which the author considers an essential tool for efficient risk workshop execution.)

Although the workshop will be customized based on its specific objectives and focus, each risk discussion will have the following components. For each risk:

• Introduce the risk. Ensure all participants have a common understanding of what is meant by the subject risk. An effective way to do this is to ask participants to briefly describe, as a simple scenario, how this risk might come to pass; what triggering event or condition would signify that the risk has occurred; and what might be experienced by the organization as a result. Record the key discussion points and display these using an overhead projector. Have the group brainstorm several of these brief scenarios; record them all.
• Magnitude. Have the participants assign a magnitude to the “worst credible” impact of the risk using the Risk Magnitude Scale. Introduce the vote with an instruction like this: “Review the scenarios that have just been described, and decide in your own mind which of these represents a credible scenario that is the most harmful. Then decide which of the objectives is most threatened by this scenario and find a point on the Risk Magnitude Scale corresponding to that objective that most closely resembles this impact. The risk score associated with that impact will be your vote.”

  The voting is followed by a conversation to explore the rationale behind responses and probe into the reasons behind diversity of opinion. To encourage a complete discussion, the facilitator should ask questions like, “Which objective did you feel was most threatened by this risk?” and “Please describe the mental journey you took in evaluating the risk and deciding how to vote.” The facilitator should record the key perspectives of participants.

  The primary objective of this discussion is not necessarily to “force” consensus on the magnitude of the risk (although this is of course preferable), but to ensure that all perspectives get communicated and are understood by all participants, especially the sponsor.

  This portion of the workshop can involve one or more revotes and rounds of discussion. The facilitator should introduce a revote by saying something like: “Now we have heard a range of perspective and arguments on the potential magnitude of this risk. Let’s see how many of you have changed your minds as a result.” It may take multiple iterations of “vote—discuss—vote—discuss” to complete this part of the agenda. It is important to remember that the role of the facilitator is to get all views on the table and encourage constructive debate.

• Strength of Mitigants. Using the Strength of Mitigants Scale, have participants assign an overall rating to the current and committed mitigants of the risk. This can be introduced by saying, “Consider all the activities that you are aware of to prevent this risk from occurring or hurting our organization. Decide for yourself how complete this set of activities is, relative to the kinds of things described in the voting guide.” Once the vote is complete, the facilitator should then ask participants to list for the rest of the group the mitigants they were considering in their vote, and describe and record the key strengths and gaps/weaknesses in current mitigants. If the discussion is lively and results in significant learning by participants, have a revote following the discussion.
• Probability. Using the Probability Scale, have participants assign a probability of the risk coming to pass with an impact as large as was assigned in the second step above, in light of their view of the likelihood of the initiating events or conditions and their degree of confidence in the mitigants. Discuss the results and accompanying rationale and, if necessary, revote if there was significant deviation on the initial vote.
• Tolerability. At this point the facilitator should summarize the results of the discussion, including the voted scores and the discussion notes. In consultation with participants, the sponsor should then declare whether in their view the current level of risk exposure is tolerable to the organization. If the answer is that the risk is tolerable, no more discussion is required. If the answer is that it is intolerable, then normally the group will review the controls or other options needed and suggested to mitigate the risk down to a tolerable level, and discuss and assign additional actions needed.

  It is important that the discussion on actions not become too detailed, or it will derail the discussion and put the agenda at risk. The author has found it useful to categorize actions into two types:

  • Quick hits, which are relatively simple, well understood actions that can be implemented with minimal resources and planning. Quick hits can be assigned to an individual to ensure they are done by a specific date.
  • Big ideas, which are expressions of potential actions that require more thought and analysis. Big ideas are best assigned to a “Champion,” who will take responsibility for further evaluation and consultation, and bring a more fully formed action plan back to the sponsor or group at a later, specified date for approval.

Record the Results

As mentioned in an earlier section, it is best to have a dedicated record keeper in the room, recording what gets said and displaying it for all to see. This can be most conveniently done by typing key points into a computer and simultaneously projecting them on a screen so all participants can refer to what was said and know that the key points are being properly recorded. The intent is not to record every word that gets said, but the highlights of the discussion in point form. Also any decisions, conclusions, or actions need to be clearly noted. It is recommended that the record keeper prepare a template in advance that follows the workshop agenda (see Exhibit 10.6). Throughout the workshop, the facilitator must keep an eye on the note-taking screen to ensure that the record keeper is able to keep up with the discussion and capture the key aspects of what is said.

Prepare the Final Report

One of the advantages of having a real-time record keeper is that a report of the workshop, showing the risk map and discussion points and actions, can be finalized and distributed to the sponsor and participants as required within a matter of hours. The report should include as a minimum:

• A graphical or tabular summary of the results of the workshop (e.g., a risk map), showing the results of the voting and the conclusions on which risks are tolerable or intolerable with current mitigants.
• A summary of committed actions, in a “who-what-by-when” format.

It is best to schedule a debrief meeting with the sponsor to walk through the highlights of the report and make sure they are clear on the next steps for following up on assigned actions.

“Anonymous” Voting

The author has used so-called “anonymous” voting tools (wireless keypad transmitters and receivers) for more than 200 risk workshops over a nine year period, to great effect. These systems allow the facilitator to pose a question, displayed for the group to see, along with a range of numerical responses (corresponding to the scales described in the previous section) and obtain and feedback to participants a quick, real-time poll of the views of participants. These systems have the following advantages:

• They ensure full participation. Every participant is forced to go through the mental exercise of thinking individually through the question posed by the facilitator and deciding for themselves on an appropriate response. This enables subsequent full participation in the discussion.
• They are efficient. In a matter of seconds the entire room can get feedback on the views of all participants concerning the question being posed, and get an instant read of the degree of consensus or disagreement. If, in the initial round, there is a narrow distribution of votes, indicating that consensus already exists, this is a signal to the facilitator that the discussion can be short and merely focused on quickly obtaining the “reasons why.” This can save time in a tight agenda and leave more time for topics where there is a broader range of views.
• They stimulate discussion. The facilitator can probe for arguments supporting each response. If there is broad disagreement (shown by a broad distribution of votes), the facilitator can immediately probe into the reasons why and stimulate a healthy debate.
• They reduce the opportunity for individuals to dominate the discussion. In the absence of the voting tools, more senior people in the room can (often unwittingly) influence others’ views and dominate the discussion. Several years ago, the author sat in on a two-day workshop where anonymous voting was not employed, and instead participants held up cards indicating their own vote. In this session, other participants fell into a pattern of waiting to see how the “boss” voted before holding up their cards. Obviously, such a dynamic is not conducive to thorough discussion of all critical aspects of an issue on its own merits.

Useful Facilitation Tips

What follows are some useful ideas to help ensure successful, stimulating risk workshops.

• Inquire. Ask open-ended questions, such as “Why?” Ask participants to speak not just on behalf of themselves but what they think others might be thinking. Ask for the contrary view… “What are some of the arguments against this?” Ask for evidence. “How do you know?”
• Restate. Summarize or paraphrase what you have just heard. Summarize the key points and then ask someone to add to them or comment on them or contradict them.
• Provoke. State extreme views that you might have heard or imagined on the subject of discussion. Encourage healthy debate.
• Use silence. After asking a question that gets no immediate response, it is extremely tempting to fill the silence by talking more or restating the question. Don’t. Wait through the silence. If you wait long enough, someone will speak.
• Get out of the way. If a good animated discussion starts to happen that is directly on topic, and there is available time, try to “blend in with the furniture.” Walk to the side of the room or sit down. Let them run with it. Wait for the discussion to peter out or drift off topic before again making your presence felt.
• Don’t over-explain. The author’s experience is that the more participation (and less explanation or lecturing) there is in a workshop agenda, the more engaged the participants will be. Avoid lengthy descriptions of the steps to be taken or the underlying theory. Tell them the bare bones of what they need to do for the next step in the process, and then let them learn by doing.

Tough Spots

• Nonparticipation. It is the author’s opinion that the duty of the facilitator is to create the conditions for an open discussion, and the duty of the attendees at a workshop to actually participate. Therefore, the author does not believe that the facilitator should go to greater lengths (beyond the provision of anonymous voting systems) to ensure that all attendees fulfill their duty to participate. That being said, if an attendee is not participating in the discussion, there are options to encourage that person to speak up, such as making a point of asking them by name what they think, when there is a pause in the discussion. Care must be taken not to intervene in this fashion too often, however, or the facilitator will start to assume the “crutch” role of drawing-out all silent attendees. It is better to make it clear at the start of the workshop that all attendees are expected to contribute to the best of their ability.
• Dominators. If a member is dominating the discussion, say, “Let’s find out what other people think on this. Anyone else?” If the dominator is also the sponsor, the best approach is to call a brief recess and take the sponsor aside and discretely coach them to withhold their views to allow them to gain the benefit of others’ perspectives.
• Large groups. If you are successful in building enthusiasm for risk workshops, you may be asked to try to do something with a much larger group. (Note: The author’s largest group was 800 participants.) Obviously the goals in large group sessions are different than those for smaller groups. It is a practical impossibility to make everyone feel like a full participant in the entire discussion. Instead you may choose to have the discussion in subgroups, and then have each subgroup appoint a spokesperson to summarize the discussion and share it with the larger group. Or, if interactive discussion is not a key objective of the meeting you may use anonymous voting to gather the entire group’s views on the risks or issues and then have “experts” or people in a position of authority stand up and provide commentary on or reactions to the voted results.