Opening the black box : what makes risk management pervasive in organisations?

Abstract

This thesis is concerned with what pervasive risk management is, and how it can be achieved in practice. Specifically, it examines the effect of social processes and cultural factors on how risk management can be coordinated across and embedded within business processes and organisational culture. A growing literature addresses what is termed risk management maturity: the capability of an organisation to assess, manage, communicate and govern risk (and opportunity). Notwithstanding its benefits, the emphasis of this literature on risk management benchmarking and standardisation has led, arguably, to a bureaucratisation of risk management process. Research followed a case study strategy and data were gathered through semi-structured interviews. A total of 43 interviews were conducted in one private and one public sector organisation. The findings describe a number of social processes and related cultural factors that significantly affected risk management pervasiveness in the two organisations. (1) Shared experience and respect for experience facilitated flexible coordination between operational and strategic risk management. (2) Informal, lateral communication integrated the knowledge of diverse stakeholders required to manage complex environmental risks. (3) Lack of common understanding of the purpose and function of risk management undermined coordination of risk management practice. These findings progress the debate on the balance between standardisation and informal social process to achieve pervasive risk management, and contribute to a richer description of organisational risk management maturity. The findings are of value to risk managers wishing to embed the adaptive and coordinated risk management required in dynamic and complex environments