The process

The practical application of the De-Risk Matrix encompasses four key process steps. Each step demands a thorough understanding of the interplay between goals, risks and actions. It's essential to repeat the process regularly and whenever significant changes occur to ensure ongoing risk management and goal alignment.

As you progress through each step, it's essential to consider the cultural factors that influence how you approach goals, risks, and actions. Cultural nuances can significantly impact how leaders and teams perceive and manage goals, as well as how they identify and mitigate risks. Additionally, cultural differences can shape the way actions are executed and evaluated. Ultimately, integrating cultural awareness into your risk strategy for achieving goals and managing risks not only enhances leadership, communication and teamwork but also drives better results by leveraging the strengths of a diverse team.

  • Step 1 - Choosing Goals

    Businesses and projects set goals to support their overarching vision. While goals help focus efforts, they can also lead to some areas being overlooked. Without goals, it's hard to define risk meaningfully, as risk is the effect of uncertainty on goals (as per ISO 31000 and COSO).

    Goals come with an upper target to aim for and a lower threshold that should not be crossed. All goals should be achieved within the desired risk level and a set timeframe. Businesses typically set quarterly goals and annual targets, while projects have specific end dates or milestones.

    This is typically handled by leadership teams. Each goal is assigned a goal owner who is responsible for overseeing its implementation and management.

  • Step 2 - Finding and analysing Risk states

    Businesses and projects determine the risk state of their goals through forecasting and evaluating the supporting evidence. These forecasts should include the expected impact of risks as much as possible, indicating how they might affect each goal.

    After identifying the risk state of the goals, analyzing their positions and patterns helps determine the optimal risk strategy.

    Each risk is assigned a risk owner who is responsible for managing it. Larger companies and projects might have dedicated resources for generating forecasts, typically a forecasting manager. For example, a safety specialist might forecast potential loss of life from project activities based on risk analyses. The goal owner is ultimately responsible for the risk state of the goal and must ensure its successful achievement.

  • Step 3 - Risk strategy

    The De-Risk Matrix provides recommended key actions based on a goal's risk state. However, these recommendations aren't mandatory, especially if you don't have the resources to implement them all. This is why a risk strategy is essential to prioritize where to focus your efforts for the greatest impact.

    In developing a risk strategy, you need to choose which goals to prioritize: Where should we be risk-averse, risk-neutral, or risk-tolerant?

    Choosing the best risk strategy is usually the job of leadership teams. They rely on analysts' insights to determine the optimal risk strategy for each goal and for the overall set of goals, taking into account their risk states. The implementation of the chosen strategy then falls to the goal owner.

  • Step 4 - Actions

    Actions should be selected and structured according to the risk strategy and the recommended key action from the De-Risk Matrix. When choosing actions or combinations of actions, it's crucial to consider where the business or project has the greatest potential for impact. An action can be time-bound or ongoing.

    Each action should have an action owner responsible for achieving the desired outcomes.