Governance of risk taking is something needed if you are the leader of a two-person window cleaning business just as much as if you are the CEO of a major banking group. It is also an important part of being the boss of a sub-unit of an organisation, such as a finance team.

In this article ‘governance of risk taking’ is defined as controlling the risk taking aspects of management duties that have been delegated, without being personally involved in each decision. Often that means explaining what we want people to achieve and putting some constraints on how, but otherwise letting them get on with it.

The ‘everyday’ aspect focuses on the impact that we have from day to day, especially our influence on people we work closely with, rather than just through high level rituals conducted at board level in very large companies.

Whether your main concern is that people are reckless or that they are too timid to get things done, here are nine suggestions.

People are risk taking in most of the decisions they make, including planning, problem solving and design choices. If it’s important and there is uncertainty, then it’s risky. Although there are easily identifiable decisions that people make in a formal or systematic way, there are also countless less obvious choices people make. I have looked at many cases of risk mismanagement and it is often the invisible, informal decisions that are the root of problems. Sometimes it is impossible in retrospect even to identify who took the fateful decision that led to disaster. Somewhere in a sequence of meetings, individual choices and circulating documents things went awry without anyone seeming to notice.

In particular, look at all important types of decision, not just decisions about how to respond to perceived risks. Decisions about risk responses tend to be quite narrow, small and infrequent. The important decisions that make most difference to risk levels are bigger and broader, with many considerations.

Though you should think widely about what types of decision to focus on, that does not mean you can or should try to tackle them all with the same focus on governance. Look for types of decisions that carry a lot of risk either because they are individually risky or because the decisions are frequent and important in aggregate. Act when you think people are not responding intelligently to uncertainty.

Delve into most cases of risk mismanagement and you will find that, in addition to some systemic problems, there were individuals who made poor choices. Developing the skills of individuals is vital. On one of the modules that I teach at the University of Southampton’s Business School, we start with an online task involving hypothetical choices in a selection of classic management situations involving uncertainty. This is an opportunity for students to understand better what kind of manager they might be. Typically, older, more experienced students do better in this task.

A lot of your influence is with people you know personally and work with every week. Teach by example and by coaching, especially if you are good at making choices in the face of uncertainty. Obviously you should focus on what is important and helpful with each individual.

In coaching individuals, and whenever explaining how you would like risk taking to be done, it is important to talk about specific types of situation. Situation-specific advice is more likely to be remembered and acted upon.

For example, you might have someone who is responsible for producing management accounting reports but is overly reluctant to innovate with different analyses or methods of presentation for fear of them being rejected, confusing or incorrectly calculated. Coach the person to develop prototypes and choose suitable quality assurance (QA) methods so that new ideas can be tried out safely. Or perhaps you have someone who does not notice or respond to the difference between analyses whose arithmetic can easily be checked and those that cannot. Show them the difference and coach them to think of other ways to check when it is not easy. Or how about someone who does forecasting but never tries to reflect the impact of decisions that might be taken in the future? This is a more advanced technical issue but you could coach them to research the available methods and start developing the necessary skills.

These are all situations where there are smarter ways to deal with the uncertainty inherent in the situation.

While in some cases your main aim may be to reduce reckless behaviour, for example with inexperienced but promising people whose confidence outstrips their competence, usually you will want to go further and avoid paralysing colleagues with doubt.

Encourage them to use techniques that allow challenging things to be done more safely. For example, encourage use of innovative techniques for getting more information, for testing ideas quickly and cheaply, for delivering in an incremental way, and for sequencing work and cutting dependencies. Teach smart ways to make routine work more reliable through earlier QA, automation, and other seemingly slow ways to work that save time in the longer run, on average.

Online tests as part of recruitment processes are quite common now. Often they ask people to choose actions they would take in hypothetical situations. Why not include some situations where risk and uncertainty are important in the job you are recruiting for?

Encourage people to be skilled at dealing with risk and uncertainty in everyday situations, not just when filling in forms or a database to comply with some risk-related bureaucratic ritual. Reward and promote people who deal with uncertainty well. This is easier than it sounds because so much of management involves uncertainty. Really you are just looking for good managers.

So far we have focused on reacting well in different situations and, typically, these are situations where precise quantification is not necessary. However, the difference between good and bad risk taking is inherently a matter of extent. Asking people not to take too much risk is not helpful. Sometimes it is worthwhile devising rules of some kind, often with tools to support them, that quantify governance of risk taking.

To use numbers to govern risk taking you need to identify a specific type of decision, clarify how it is taken and agree an approach with the people who take the decision. People have to remember to follow the rule and it may be helpful to have someone or something checking that they do.

Within that structure it is possible to embed quantitative guidance – usually as weights or limits. With this in place you can have conversations that are quantitatively precise.

If you want to set limits on risk taking, make sure your limits are on an objectively calculated measure. Subjective risk levels and levels calculated from subjective ratings can be subverted – obviously. Better alternatives are limits on time, money and risk levels calculated statistically from past data using a fixed method. At the very least, use judgements by independent people.

If you use a statistical calculation based on past data then changes to this method need to be carefully controlled, just as you would control changes to accounting policies or the definition and calculation of a key performance indicator. There is no such thing as a single objectively correct probability, though there can be objectively correct frequencies.

There is one exception to this. If you are facing certain disaster then doing something unexpected and radical that makes the future less certain may be a good choice. More typically, taking more risk (in the usual sense) is something we should only do in pursuit of something desirable. It’s like spending money: necessary to get things we want but not desirable in itself. Nobody should be encouraged to think that spending money, or taking more risk, is a good thing in itself.

Finally, look for ways to nudge people into doing the right thing through automation and information displays. A lot of what we do at work is driven by what appears on a screen in front of us. That could be showing the results of useful calculations about risk involved, projections and measurements with ranges rather than just a best guess, variations between individuals instead of just averages, or how things have varied in the past so that future unpredictability is understood.

In summary, whether you are the CEO of a huge company or the supervisor of a team of three bookkeepers, your personal influence on risk taking is important. Your example and coaching of others are crucial and, in some cases, it may be useful to be precise and quantitative about some decisions and design methods specifically for them.

Download pdf article:

• Nine steps to take risk well
  Business & Management Magazine, Issue 280, December 2019/January 2020

Full article is available to ICAEW members and students.

Further reading into risk taking for your business is available through the resources below.

These are available to ICAEW members and ACA students.

Online articles

The Library provides access to leading business, finance and management journals. These journals are available to logged-in ICAEW members, ACA students and other entitled users subject to suppliers' terms of use.