Many school governing bodies put unnecessary pressure on school leadership teams to present risk reports that assess all school risks as low (i.e., reports where all risks are usually plotted on the green square in a risk matrix). This type of pressure can result in leadership teams caring more about what a risk report looks like than effectively managing risks and, as this article explains, is not the point of risk management at all.

What are “risk” and “risk management”?

According to AS ISO 31000:2018 Standard - Risk management – Guidelines, “risk” is “the effect of uncertainty on objectives”. Importantly, not all risks, if they materialise, result in a negative outcome. The effect of uncertainty can be positive or negative.

“Risk management” can be defined as a tool which assists organisations to predict future events which may impact (positively or negatively) on their activities. It allows organisations to take appropriate actions to address the likelihood of the event happening and/or the impact of the event should it occur.

Risk management is therefore a tool to help organisations achieve their objectives. Being a tool, it needs to be used effectively and not with a focus solely on how a risk looks when plotted on a risk matrix.

Schools accept risk in order to achieve objectives

It may seem strange to talk about schools taking risks to achieve their objectives, yet school governing bodies need to take on a level of risk in many different areas including, for example, child safety, and workplace health and safety, to operate a school. To have no risk would mean not operating the school at all.

In many cases, schools do not talk about risks when they make strategic decisions, but they should. Adopting any strategy involves risk. This includes the risk of adopting the wrong strategy and the risks that are created by adopting a particular strategy, for example, strategy ‘A’ rather than strategy ‘B’.

The Victorian child safe risks

Although many governing bodies hope to see risk reports that show all school risks in the lowest square in a risk matrix, this is not always realistic.

A great example of this can be seen by considering the requirement for schools in Victoria to develop a child safe risk register that aligns with the Victorian Child Safe Standards. The guidance material that helps schools develop their registers includes the advice that, if schools choose to use a risk matrix as part of their risk register, they should rate the consequences of all their child safe risks at the highest level (usually “severe” or “catastrophic”, depending on the terminology used). This is because evaluating the consequences of child abuse and harm is very difficult. This means that for a standard risk matrix, the child safe risks will never be in a ‘green’ square but will instead reflect the complexity of managing these types of risks to keep children safe.

In fact, the guidance doesn’t even require schools to plot their risks on a risk matrix. Instead, what schools need to do is answer a specific question for each child safe risk: “taken together, are the controls in place sufficient to reduce the risk of harm to an acceptable level?”. This is a great question to ask and serves to highlight that risk management should be about interrogating the effectiveness of risk controls in managing the risk, rather than getting every risk in the green square in a risk matrix.

Schools could also ask a similar question for non-child safety risks, namely: “taken together, are the controls in place sufficient to manage the risk effectively to an acceptable level?”. There are two follow up questions that schools should also ask which are not part of the Victorian guidance, and they are: “if yes, how do you know?” or “if no, what additional controls (usually referred to as ‘risk treatments’) are you going to implement?”.

Conclusion

There is no prize for the best-looking risk register. If boards focus on seeing every risk in the green square of a risk matrix, they will promote an unhelpful risk culture which focuses on how things look, rather than encouraging a culture where there is honest appraisal of individual risks and the effectiveness of risk controls.

Without this honest appraisal, it is impossible to manage risk effectively. It is also equally impossible to decide what level of risk a school is prepared to take on to achieve their objectives, because you can only decide to accept more risk if you have a true picture of what the current level of risk is.

Therefore, instead of pressuring leadership teams to provide them with an attractive report, governing bodies should encourage them to manage risk effectively by understanding what the school’s operational and strategic risks are, evaluating whether these risks are being controlled and making decisions about what level of risk (‘risk appetite’) the school is willing to ‘take on’ or accept to achieve their operational and strategic objectives.