The Complete Guide to Risk and Issue Management

Thank you for reading our new white paper, on risk and issue management. We have produced this paper for two simple reasons:

1. Managing risk is important, but often under-appreciated;

2. Managing risk is difficult, and often poorly done.

We begin with a series of articles that develop your understanding of what risk is, of how best to organise a strategy to deal with it, and of how to perfect a risk management approach for your needs. We then look at risk management for the events industry, looking at how an event organiser can tackle uncertainty, and what can be learned more generally for any organisation in any industry.

Finally, we take a quick look at risk management software in WeTrack, and leave you with a helpful risk register template for you to manage your risks.

We hope you enjoy reading this paper and learn a lot. If you have any questions about anything you read, please contact info@wetrack.com - we'd be happy to hear from you.

Managing risk is one of the most important things you can do in your planning. To do it successfully, it is vital to have an understanding of the different types of uncertainty that you will be faced with and the strategies you can employ to deal with them.

Below you'll see an example of a risk, issue and opportunity in relation to an overall uncertainty: will you encounter bad weather at your outdoor show?

As seen, a key difference between risks, issues and opportunities is the strategy you deploy to address each type of item.

• Mitigate: a mitigation plan is a series of actions that you take in advance of a potential event that reduces the probability and / or impact of that event.
• Contingency: a contingency plan will identify the likely actions needed to resolve a potential issue, including who is responsible for enacting them. The plan will be actioned if the issue does actually occur.
• Exploit: opportunities arise when you have the chance to benefit from an uncertainty. It is therefore wise to pursue a strategy that allows you to make the most of the opportunity for your positive gain.
• Avoid: this involves removing the risk entirely, in taking some action that results in the uncertainty no longer posing the same threat to your project(s) or event(s) that it previously did.
• Insure: this strategy might apply when you are able to take out some sort of insurance that eases the impact of the risk becoming an issue. It allows you to pass the risk onto a third party.
• Share: this lets you spread the risk or opportunity amongst a supply chain, taking actions that acknowledge that this is a risk that is not solely up to you to deal with and that is not solely yours to be harmed by.
• Accept: a risk can be accepted after all other viable strategies such as mitigation or insurance have been enacted; the risk still exists, but there is an acceptance that no more action can be taken to manage it.

The key to dealing with uncertainty in your programme and event management is to meet it head-on.

The later issues and incidents are dealt with, the more expensive they become; audits and regulations might not be met satisfactorily; and you might not have confidence in the safety and security of your operations.

That is why you need good practices. The first practice is to define an organisational risk management approach, to ensure coherence and collaboration in how you approach risk. Define what the risk tolerances and thresholds are, how risk impact and likelihood is measured, how risk review is built into your organisational governance, and set out clear responsibilities.

Only 36% of organisations have a formal enterprise risk management programme, and only 6% of directors believe their organisation's board is effective at managing risk

(Quantivate, Why GRC Matters, April 2019)

The second practice is to hold an initial risk workshop at the outset of your risk planning - and don't constrain your thinking. Record all possible uncertainties, and the risks and opportunities that result. Then you can categorise by impact and likelihood, and prioritise actions, getting your mitigation steps and contingency plans in place.

The correct psychology of risk management: be open, transparent and accepting. Plan for uncertainties, because nothing ever goes 100% to plan. Regularly look at your risk profile and scrutinise where gaps exist. And don't get caught flat-footed and manage risk 'on the hoof'!

No matter how well we plan, everyone has to manage risk - in good times and in bad. Building risk management into your day-to-day planning will benefit you greatly when things don't go as expected.

1. Track your risks and issues

This may sound obvious, but many professionals fail to track and manage risks in any meaningful way. With our focus normally on delivery and problem-solving, we often don't spend enough time thinking about potential risks to our projects. Equally, by not considering uncertainties we can also be caught flat-footed when an opportunity arises that we can't capitalise on.

2. Know the difference between a risk, an issue and an opportunity

We hope you enjoyed our fuller article on this earlier in the white paper, so we won't dwell on this again here!

3. Get the basics in order

An effective risk management framework needs two key components: a risk management approach, and a risk register.

It is important to define who in your organisation is responsible for recording, managing and reporting on risks, who is responsible for making decisions on risk, and who is responsible for carrying out the actions. For larger organisations, these roles can vary depending on the severity of the risk being managed: some risks need to be dealt with right at the very top.

So how do you categorise risk? A good risk approach should set guidelines for impact and likelihood scales so that classification is consistent across all risks. For financial risks, as an example, it makes sense to set thresholds for each impact level based on the overall project budget. A financial impact of £0-£1,000 could be classified as 1, whereas a financial impact of £100,000+ could be a 5, with appropriate thresholds in between.

4. Record your risks effectively

Being clear and concise when you record your risks goes a long way to ensuring you manage them effectively. All risk registers will have a place to capture a title and description as minimum. Make sure you include the basics of uncertainty, event, and outcome in your title to make it clear what the risk or opportunity is.

An example of a poor risk capture might be 'heavy rain'. This title does not tell us anything about the potential issues this might cause. Instead, be more descriptive, with something like 'possibility of heavy rain, leading to local flooding, resulting in the course becoming unusable'. Anyone reviewing the risk register will know exactly what the risk is at a glance, with more detail going into the description.

It's also important to only capture the risks that may have a material impact on your project. Don't waste time discussing and resolving risks that would have little to no impact if they were to come to pass.

5. Plan your steps, and act on them

Once you have identified your risks, you need to act on them. See our earlier article on risk strategy for the possible steps you could take here. It's important to be open-minded about the different ways that you could approach an uncertainty.

6. Uncertainty is not just about risk, it's also about opportunity

Again, we hope this message has become clear throughout the start of this white paper. There is a tendency in risk planning to only focus on preventing negative outcomes, but uncertainties can also create positive possibilities - but only if we are ready to act when an opportunity arises.

7. Be open, transparent and accepting about risk

This attitude is vital. Risk management is about looking into the future and planning for uncertainties. It is not about apportioning blame where planning has not been up to scratch. The identification of risks is important to project management and should be encouraged by all levels of management. No project or event, big or small, can ever go 100% to plan.

By regularly looking at your risk profile and assessing where gaps may exist, you will improve the overall delivery of your work and be better prepared when issues do occur. By building strategic responses, the ability of your organisation to respond will be strengthened. You won't be able to plan for every eventuality - but you will be able to better respond by putting your plans into action.

1. COVID-19

There's obviously never been a more likely and more impactful uncertainty to threaten the very existence of your event. Respond to it with scenario planning: what happens if your event is not allowed to take place? Or behind closed doors, or virtually, or with 25% capacity? Take mitigating actions like taking out insurance, and make contingency plans such as a back-up date later in the year.

2. Weather

If you're an outdoor event, you're certain to be worrying about the uncertainty of the weather. Think about how you could adapt your event if there's heavy rain on event day, to still provide an enjoyable day to your visitors. And think about opportunity planning too - how could you make a bit of rain work to your benefit?

3. Budget

This is the sword of Damocles hanging over every event operator, whether your event is local or international. The risk that you might run out of budget during the event organising stage is obviously something to be managed very carefully, as you never know when something will cost much more than expected. It's a case of using your experience to plan sensibly and understand possible dangers ahead.

4. Transport, Traffic and Travel

This is a frustrating uncertainty to plan for as it is usually completely out of your control. If a major road is closed or key train line blocked, what can you do? Here you might want to make contingency plans - is there flexibility to slightly delay your event if attendees are delayed in arriving? Could the risk be mitigated by you sharing multiple transport routes with your attendees?

5. Spectator Safety

As an event manager you bear a lot of responsibility for the safety of your visitors. A lot of potential issues here will be covered as you deal with other risks, so it is really something to always bear in mind as you plan for uncertainty - what could happen at my event that could harm my attendees?

6. Maintenance / Physical Site

This type of issue might be difficult to predict, so focus on contingency planning. Have a maintenance team in place with clear communication channels, so that if something requires urgent repair, you have the team and the knowledge to fix it quickly.

Venues and stadia might remain empty or at reduced capacity for a while longer, but plenty of risks could harm your event before you've even opened doors.

7. Drunk and Disorderly Behaviour

This is a common issue at live events, and a lot depends on how well your staff are equipped to deal with drunken behaviour. Train them on how to spot the signs of someone who has drunk too much, acting proactively before the issue results in violence and / or abuse.

8. Fire and Evacuation Procedures

An absolute essential - for your whole staff to know what to do if an emergency evacuation is required. Put in place clear signage, train staff on processes, set up evacuation points - these are the vital steps that can be put in place before the event, so that everyone knows what to do if an evacuation is necessary.

9. Staff / Volunteers

Not in the right place, not knowing what to do, not having enough staff in the first place, etc! Your staff are tasked with preventing or tackling issues on the ground, and they rely on you to fully prepare them. Involve them fully in contingency planning, considering what they need to deal with every uncertainty that you plan for.

10. Finally - remember Murphy's Law

Anything that can go wrong, will go wrong! You need to be ready for when risks become live issues. That should be at the centre of all of your uncertainty planning.

The key to risk management lies in creative thinking. You can't predict exactly what will go wrong, so you need to cover the obvious uncertainties, and build and execute plans that alleviate risks and maximise opportunities. That way, you'll feel somewhat comfortable that you're ready for any issue!

Here, our Managing Director, Peter Ward, uses his experience gained at London 2012 and subsequently directing WeTrack, to share his ideas on the process of risk management for events, and the role of tech within it.

Identify

There are plenty of sources through which to identify risks, and tech can play an integral role:

• Prior experience (lessons learned aided by tech). Why trawl through old emails, files and notes when you can just refer to your previous system data?
• Self-assessment (internal departments and contractors)
• Consultants and risk experts. The most serious risks can threaten to derail your event altogether, so don't skimp on what's necessary.
• Desktops and simulations / readiness exercises, to the scale of your event.

Categorise

Keep it simple - by risk type, and by severity on a risks matrix. Tags etc can be loaded on top where useful.

Record

Everything, all of the time!

Track

Here's where tech can make your life much, much easier. It can be everything you need to manage identified risks. It provides real-time updates, notifications, the ability to collaborate and record, and a full, indelible audit trail that can be reviewed after the event for any planning (or legal) considerations.

Close

Closing risks in an online environment gives you the security of an indelible audit trail, as you can see what actions were taken to deal with this uncertainty.

Learn

What role could Machine Learning play in your risk and issue management?

• Identify trends which humans would miss
• Predict hotspots in future events
• New development for events sector

So how can tech be used to enhance your risk management? We have six take-home points:

• The nature of risks doesn't change with tech
• You don't need to use technology to record and manage risk - but you'd have to work harder to ensure good practices
• Tech tools can be good for driving consistency, transparency and collaboration
• Align your risk register with your project plan for full visibility on how your risks affect your projects and tasks
• Tech is more useful the larger / more complex the event
• Be open to leveraging machine learning and AI!

Small scale events naturally tend to have a reduced workforce, an inflexible budget and a lack of infrastructure. Event organisers can overlook risks because of this, but this is dangerous - when a risk becomes an issue, it can derail your event.

I have attended events where the audio-visual equipment has stopped working and we have had to wait for a technician to fix it. The event was delayed and the schedule disrupted. Such issues can negatively affect attendee experience and determine whether they return to the following event.

Risk assessments need to be prioritised and should be highlighted to all volunteers. Certain aspects should be conveyed to the public too. As a volunteer at several small events, risks are often forgotten. Most of the time we are only shown an emergency plan and organisers seem to think that is enough. Generally, volunteers are not told what their roles would be if a particular issue did occur, which can put individuals in a vulnerable position.

Communication is easy! Event organisers could minimise costs if they disclose risks to all stakeholders in the first place. Taking the time to prepare for a possible risk or a major issue could save expenses that would otherwise be spent on health and safety mitigations, clean-up and damages. This means that any other financials associated with risks could be utilised elsewhere in your already tight event budget, such as hiring better and more reliable equipment. Spend a little money before, rather than a lot after.

There are other ways event managers working on small events can mitigate risk and effectively budget their events. Create emergency plans; obtain permits; consider data protection; address fire hazards; ensure disabled access is available; and provide staff with any necessary safety equipment. Many of these are legally required to stage an event, so by ensuring you have these necessities, you are already on your way to minimising any potential hazards.

The key to a successful event is the way we plan for and communicate risks. For small events there is a clear need for completing risk assessments and preparing properly for potential issues. Whether it is something as simple as not selling enough tickets, clashing with another event or having disengaged staff members, having mitigation steps in place can significantly reduce any negative impacts that could damage your event, harm people or property, or tarnish your event's reputation.

Peter discusses his experiences of risk and issue management at London 2012, from making sure risks were correctly logged and monitored, to taking action to mitigate them.

How were risks identified at London 2012?

Risks and issues were identified by the various functional area and venue teams. Most risk and issue management is similar across industries, and London 2012 was no different. Standard practice is to:

• Measure the impact and likelihood of each risk to get an overall rating;
• Keep a log of all risks and their ratings which is constantly updated according to project progress and developments;
• Sort out the red risks first (those with high potential impact and a high likelihood of happening)!

A weekly report of risk and issue status was then circulated to teams - this was obviously restricted according to the seniority and viewing permissions of each recipient.

According to a McKinsey study in 2017, 70% of senior managers said they were moving towards managing risk digitally. There's no reason why our sector shouldn't be doing likewise.

Sounds like a lot of admin! Who was responsible for logging and monitoring?

There was a dedicated Risks and Issues team within the Project Delivery Office who acted as the central team to sense-check the items being raised, and to report on them. Ultimately, however, risks and issues are always the responsibility of the teams that might be impacted by them.

Were there any instances when risks or issues were missed?

In a project that size, almost certainly! The organisational structure at LOCOG was amazing, and there were plenty of project managers, support staff and secondees, so most of what might have been missed in another organisation was caught and dealt with. Having said that, the systems we were using did not help things, especially with regards to the aforementioned level of admin. I think we could have really reduced head count if the risks and issues portal was more intuitive, more automated and a little more sexy!

Peter was Deputy Park Manager (Park Operations Centre) and Readiness Tracker at London 2012.

• Save costs by identifying risks early
• Understand and commit to proper risk management
• Automate reporting and drive decision-making with data
• Prevent dislocation between project plans and risk registers
• Get required training and consultation on best practices

"WeTrack's software developed better synergies between departments and increased efficiency in project management." 

Peter Bayer, Secretary General Sport, FIA

Our risk, issue and opportunity management module allows events, venues and organisations to manage risk in a way that suits the scale and nature of their operations.

That means combining a simple interface with depth in functionality, so that all users can simply update essential risk and action step information, while also able to make full use of functionality such as insurance policies, opportunity management, and a customisable impact and likelihood matrix.

We want our clients to save costs by doing risk management properly: identifying risks early, integrating them with the rest of their planning, and following events industry and risk management best practices. Here is a fuller list of functionality within the module:

• Risk, issue and opportunity management
• Customisable impact, likelihood and overall risk rating scale to fit how your organisation manages risk
• Automatically align to projects, tasks, milestones, departments and users
• Create action steps and track them to completion
• Strategy options including mitigation, contingency and exploiting
• Automated bespoke reporting function
• Control confidentiality and user permissions, with draft limits for those without full risk manager roles
• Insurance policies to track coverage
• Two-click editing to keep vital information up-to-date instantly

Interested? Get in touch to learn more.

We have developed a risk register template based on our clients' experience and using a template available from the WeTrack system as the basis.

Not every field will be useful to every risk manager, but each provides valuable information in tracking uncertainty. The key is to be consistent so that you and anyone else managing risk for your organisation or event can understand all of the information in the risk register.

You'll also find some introductory pieces on risks, issues and opportunities, and the strategies for dealing with these uncertainties. There is also an impact, likelihood and overall rating matrix for you to customise to ensure that you have a clear organisational methodology for measuring the severity of a risk.

Just click on the button to download the template in Excel - no form required. Thanks!

Risk management is something to be done with purpose, identifying possible uncertainties and managing them in an integrated way with your other project and milestone planning. We hope that this white paper has given you some more tools and impetus to do this well.

It can be scary, but it's worth the pain. If your event, venue or organisation manages risk in a formal and integrated way, you'll avoid serious trouble further down the line.

Thank you for reading and please feel free to get in touch if you'd like to discuss any of these areas further.