Consultancy
Risicomanagement Is Schijnzekerheid Zonder ProcesmanagementManaging processes and quality risks effectively is essential for organisations. A common pitfall is that organisations manage these separately, thereby missing a significant opportunity. In fact, one might even question what process management is without risk management, and vice versa. How can you manage quality risks if you do not translate them into what they mean for operational processes? And how can you manage processes if you do not know how and when specific risks arise?
You could say that risk management without process management is like a climber secured to a loose rock. It may seem as though the risks are well controlled, but in practice they are not embedded in the process, that is, in the way of working. Without properly embedding risks in the process, you create a false sense of security. This is the same sense of security that the climber in the example has.
This article demonstrates why process and risk management cannot exist without each other. It also provides practical guidance on how process and risk management can be integrated in a way that strengthens and complements one another.
A process without risk
A business process delivers a product or service that is necessary to achieve the organisation’s objectives. This takes place in an environment that is dynamic and only partly controllable. Managing processes without identifying quality risks within that environment is an impossible task. Disruptions can occur which affect the process and therefore pose a threat to achieving organisational goals (Bakker & Spronk, 2020).
Managing processes without considering the risks that may arise is therefore a form of denial or excessive optimism. It makes the outcome of the process unpredictable. Sound process management therefore always requires the identification and analysis of risks. Depending on the chosen risk strategy, appropriate control measures can then be implemented.
A risk without a process
Managing risks without embedding them in a process is also futile. According to Van Staveren, a risk can be seen as an uncertain event with causes, a likelihood of occurrence, and consequences for objectives (2018). It is precisely these events, with their underlying causes, that influence the course of a process and ultimately the product or service it delivers.
This underlines the importance of always asking, when managing risks, where in the process specific risks may arise and which measures should be taken to reduce them. In horticulture, for example, it is important to minimise the risk of diseases and pests. To achieve this, it is essential not only to analyse the risk but also to link it to the process and implement appropriate preventive measures.
Such measures might include specific hygiene protocols, such as hand washing and changing clothing. Organisations may also choose to have certain tasks performed only by specially trained staff or to build in an additional control step before plants from outside are brought into the greenhouse.
Identify risks in the process
It is therefore important to integrate risk management and process management. To identify process risks, clarity is needed about the desired process performance. What product or service should the process deliver, and what requirements must it meet? Next, consider which events may occur that could prevent the process from achieving this performance.
Determine where in the process, and in which process step, these risks may arise. These risks can then be analysed, for example using an FMEA approach. Based on this analysis, determine which measures are needed to reduce the risks. Depending on the level of risk an organisation is willing and able to accept, you decide which measures should be embedded and at which point in the process.
The illustration below shows how quality risks can be incorporated into a process design. On the one hand, risks can be added to activities, along with additional information about each risk. On the other hand, preventive or corrective activities can be identified within the process design, making clear why an extra step is necessary.
Further development: integrate the quality standard into your process.
From a quality perspective, in addition to risks, quality standards can also be linked to the process. Start by identifying which quality requirements apply to which processes within the organisation. The next step is to determine, for each requirement, which activity within the process fulfils it and in what way.
Within each process step, you can add an explanation indicating which requirement is being addressed. Where necessary, a more detailed description of the working method can be set out in a work instruction to ensure that actions are carried out in line with the standard. In this way, quality standards become visible within the process and you avoid them becoming a separate, paper-based system detached from day-to-day practice.
Integrate process and risk management.
Risk reports are often produced by staff departments and are therefore far removed from day-to-day operations. In the worst case, they become little more than a box-ticking exercise to create the impression that the organisation is ‘in control’. Managing quality risks can no longer be separated from process execution. When risks materialise within a process, they directly lead to a decline in process performance. On the other hand, an excessive number of preventive measures can result in longer lead times and higher costs. Managing risks and processes must therefore be brought together.
Bring risk management back to where the process actually takes place and where risks arise. This means that employees in the primary process must be aware of the risks that may occur at any given moment. This enables them to make sound judgements when faced with unusual situations.
When process and risk management are driven from the shop floor, the risk report no longer stands alone. For example, the risk report can be integrated into a process dashboard. This then shows the actual performance of the process based on defined process indicators, as well as the number of risks or incidents and their impact on operations. This helps in establishing the right control measures within the process.
Improve processes based on identified risks.
Risk reports are often produced by staff departments and are therefore far removed from day-to-day operations. In the worst case, they become little more than a box-ticking exercise to create the impression that the organisation is ‘in control’. Managing quality risks can no longer be separated from process execution. When risks materialise within a process, they directly lead to a decline in process performance. On the other hand, an excessive number of preventive measures can result in longer lead times and higher costs. Managing risks and processes must therefore be brought together.
Bring risk management back to where the process actually takes place and where risks arise. This means that employees in the primary process must be aware of the risks that may occur at any given moment. This enables them to make sound judgements when faced with unusual situations.
When process and risk management are driven from the shop floor, the risk report no longer stands alone. For example, the risk report can be integrated into a process dashboard. This then shows the actual performance of the process based on defined process indicators, as well as the number of risks or incidents and their impact on operations. This helps in establishing the right control measures within the process.
Conclusion
Risk management and process management cannot exist without each other. The challenge lies in making visible where quality risks may occur within the process. This makes risks identifiable and creates awareness among employees of when and which risks may arise. Integrating risks and processes goes beyond process design. It also requires integrating process control and risk control to achieve optimal process improvement. In that case, you are secured to solid rock, making outstanding process performance achievable.
