What is M_o_R?

No organization is immune to critical situations, uncertainties, and risks. It helps to know what to do when they arise! A deliberate and structured approach to risk management is beneficial and can ultimately increase value creation. M_o_R^® (Management of Risk) provides guidance on this topic in its current version 4.

People and companies face risks every day—whether on their way to work, while driving, or when deciding on a new business strategy. According to the definition (based on the ISO 31000 standard), a risk is an event whose occurrence is uncertain and that could affect the achievement of objectives. It is important to note that such an event can have not only negative but also positive consequences. A risk is assessed based on the probability of the event occurring and its impact on the achievement of objectives.

From an organizational perspective, the topic of risk management (Management of Risk, M_o_R^® a key component of business strategy. Every company must address the issue of risk management in one way or another. This usually does not take place in a transparent and traceable manner. Above all, there is a lack of appropriately defined processes within the framework of risk management.

M_o_R^® Training Sessions

Why is risk management necessary?

The goal of risk management is to provide companies with tools that enable them to better assess their current situation and evaluate potential impacts through a defined series of steps.

Through thoughtful risk management, organizations can ensure better results, experience fewer surprises, deliver more reliable products and services, make optimal use of resources, and identify opportunities for innovation. Above all, risk management supports decision-making at all levels. However, the goal is not necessarily to completely avoid risks and their consequences. It is far more important to accurately assess the situation and take appropriate measures to achieve strategic corporate, program, project, product, or operational goals.

When and where should risk management be applied?

Risk management is recommended wherever critical decisions are made. Aligned with long-term goals, risk management focuses on assessing risks in relation to an organization’s strategic objectives. In most cases, strategic risk management is opportunity management at the highest corporate level.

Even in the medium term, risk management must be an essential component of all planning within the context of projects, programs, or product development. The same applies to safeguarding operational functions. In this area in particular, it is essential to ensure that threats are identified and operations are maintained during day-to-day operations.

Principles of Risk Management

To develop processes for company-wide risk management, various principles must be defined. These should be precise, understandable, and easy to implement. As part of the best-practice approach, M_o_R describes^® The following general principles or requirements:

• Understanding of organizational relationships
• Role and Integration of Stakeholders
• Knowledge of the organization's objectives
• Implementation of M_o_R Methods
• Implementation of Management Information (Reports)
• Definition of Roles and Responsibilities
• Structured Business Processes
• Early Warning Systems
• Review Circles, Quality Assurance
• Identifying and Overcoming Critical Success Factors and Obstacles
• Culture and Organization
• Continuous Improvement Processes (CIP)

These principles can also be viewed as key factors for the successful implementation of risk management.

Like all factors contributing to success, the principles of risk management are constantly evolving and must be adjusted from time to time. Organizations should adapt their strategies to the needs of the market, which includes the ongoing assessment of risks.

Risk Management Methods

Every company uses different approaches in the area of Risk Management. To define these methods and help stakeholders understand them, M_o_R recommends^® the development of relevant documents that outline and disseminate risk management approaches.

In principle, the goal is to raise awareness within the organization of the risks facing the company and to develop appropriate procedures to address them. To this end, the following guidelines are recommended:

• Risk Management Policy: A foundational document that defines risk management guidelines, establishes how risks are handled within the organization, and describes the methods of communication. These guidelines are strategically oriented.
• Risk Management Process Guide: Description of Risk Management Processes, from Identification to Implementation
• Risk Management Approaches: Description of Risk Management Activities for (Specific) Parts of the Organization
• Risk Registers: Identification and summary of all threats and opportunities for each area of the organization
• Issue Registers: Systematic recording of all identified issues, including risks that have already materialized

Awareness of these issues must become an integral part of the organizational culture. To this end, the documents outline tasks, responsibilities, and authorities related to the identification and assessment of risks.

Risk Management Processes

Risk management can be broken down into eight processes:

• Defining the Context and Objectives
• Identifying Opportunities and Threats
• Risk Prioritization
• Assessment of a Combined Risk Profile
• Planning of Measures
• Agreement on Measures
• Monitoring and Reporting on Progress
• Review and Adjustment

The eight processes form a coherent, logical approach to implementing risk management. Without the results of the preceding step, each subsequent step cannot provide useful insights in the context of risk management.