Internal Audit Indonesia's

Juli 14, 2010

Risk Assessment Process – Facilitation Tips

Filed under: Artikel seputar Internal Audit — internalauditindonesia @ 12:00 am
This guide provides tips and tricks to be used when facilitating a risk assessment workshop. These tips are organized to guide you through the high-level phases of a risk assessment discussion and provide insight into the facilitator’s role for this process.

I. Preparation & Introduction of Risk

  • Invite people to sit at the front of the room (rather than letting them sit at the back).
  • Keep the time schedule in mind and avoid taking too much time for one item.
  • Make sure you take a short break periodically to revitalize the group.
  • Avoid judging participant comments.
  • Manage expectations by directly addressing the expectation(s) that cannot be met.
  • When presenting the concepts of risk management, take your time. It is probably the first time that most participants are hearing about the concepts.
  • When presenting the risk assessment process, spend a few minutes to give people an overview of the whole process before starting with Step 1.

II. Identification of Risk

  • To avoid getting a long list of risks from participants, ask everyone to state one risk. After one round, ask if there are additional key risks concerning the objectives.
  • Be as specific as possible when defining the risk. For example, describe a risk as “Loss of top two key suppliers, Company ABC & XYZ” rather than “Loss of key suppliers.”
  • Avoid documenting current issues since these are the things they should be managing. Ask “Is this an issue?” If so explain that, “an issue is a certainty and a risk is an uncertainty. So what is the risk (uncertainty)?”
  • Ensure that there is a verb included in the risk definition. For example, state that “Employee turnover increases beyond 15%” rather than “The risk of employee turnover.”
  • To speed up the risk definition process, put a temporary definition on screen first and then work with participants to fine tune it.
  • Ask participants how they would formulate a risk definition instead of trying to formulate it yourself.
  • When summarizing, use their words rather than your words. This will increase the feeling that it is an assessment of their risks.
  • To regain focus after a long discussion, summarize the discussions (or ask someone to do that for you) and move on to the next topic.
  • Ensure that the participants are focused on the facilitator by agreeing upfront that the assistant waits for the facilitator to verbally summarize the definition before documenting the risk definition.
  • To gain clarity from participants on risk definitions, ask for feedback. For example, “Is this definition clear for everyone?”
  • Avoid conversations that entail judging the scale of the risk before voting (discussion should concern the definition).
  • When identifying risks, ensure internal risks are also addressed. People can sometimes focus too much on the external risks during the risk assessment process.
  • When explaining risk definitions, make sure people do not give opinions on how they would rank the risk. The voting process comes later in the session.

III. Prioritisation of Risk

  • When there is no consensus on the priority of a risk, ask participants, “Would someone like to say why you might vote high/low on this risk?” Summarize the high and low arguments and ask if people would like to re-vote.
  • Only re-vote when participants say they want to re-vote on the risk significance. Ask participants, “Based on the arguments you just heard, who feels they need to change their vote?”
  • As a facilitator, avoid being drawn into the discussion content by reflecting any content questions back to the group. Focus on the process of the risk assessment and not interjecting your opinion into the process.
  • Keep up the tempo during the voting process by summarizing and managing long discussions.
  • When voting on risk impact, keep repeating “If this risk has happened, what is the impact?”

IV. Risk Sourcing & Action Planning

  • Ensure that a risk owner is assigned prior to starting the sourcing exercise. This helps to ensure that there is buy-in for the risk actions.
  • Avoid spending time on unimportant causes/consequences by performing a quick brainstorm to find the main causes. Cluster the first level of causes, where applicable. Then ask the group which are the most important causes and consequences, of those identified. Only then, drill down the chosen causes/consequences.
  • To get the right level of detail, a rule of thumb is to have three layers of causes for the most important (main) causes. Do this by asking “why” three times.
  • Ask for suggestions in formulation instead of making suggestions in your own words.
  • Type the participants’ suggestions into the risk assessment program as quickly as possible and fine tune it after you have something workable on screen.
  • Wait for the assistant to finish typing before moving onto the next cause/consequence.
  • Formulate the cause/consequence as concisely as possible, bearing in mind that all discussions documented should be understandable after a few months for other people to read.
  • Ensure that there is an adjective/verb included in each formulated cause or consequence. For example, you would document that “customer awareness increases” rather than “customer awareness.”
  • For external risks, focus on the consequences; for internal risks, focus on the causes.
  • Add one action per root cause.
  • Ensure that you only list the actions which are new or actions which need to be reviewed, thus avoiding generating a list of actions already being taken.
  • Add the due date and, if applicable, an action owner to create extra buy-in and a need for urgency.
  • Emphasize that risk action planning is part of future, normal management practice.

V. Content of Risk

  • Point out the consequences of important items in order to create maximum awareness of their relevance to participants’ daily work. If possible, mention specific actions to be taken by people.
  • Make sure that the general point of the risk is understood before getting into the details of a specific problem or question.
  • Ask for feedback such as “Is this point clear to everyone?” If you have doubts that the point is understood, ask someone to summarize it or give a practical example.
  • Ensure you only go into the items/actions that are new or need to be reviewed.

VI. Keeping the Process Going

  • Keep up the tempo of the training session by summarizing and managing long discussions.
  • Keep the time schedule in mind and avoid taking too much time for one item.
  • To regain focus after a long discussion, summarize the discussion (or ask someone to do that for you).

VII. Relevance & Importance of Risk

  • If participants are not convinced of the importance of a specific topic, take a moment to discuss the possible negative business impact of not adhering to the rules (or the benefits of adhering to them).
  • Emphasize that the new procedures are part of future normal working practice.
  • When discussing an especially important item, point out that people may want to make a note of it.

Tinggalkan sebuah Komentar »

Belum ada komentar.

RSS feed for comments on this post. TrackBack URI

Tinggalkan Balasan

Isikan data di bawah atau klik salah satu ikon untuk log in:


You are commenting using your account. Logout /  Ubah )

Foto Google+

You are commenting using your Google+ account. Logout /  Ubah )

Gambar Twitter

You are commenting using your Twitter account. Logout /  Ubah )

Foto Facebook

You are commenting using your Facebook account. Logout /  Ubah )


Connecting to %s

Blog di

%d blogger menyukai ini: