How to … Revitalise risk management

The Oxford English Dictionary defines the noun vitality as follows: "The state of being strong and active, the power giving continuance of life, present in all living things." In my view, this embodies the central role of risk management in achieving corporate objectives and the way in which risk should be embedded in an organisation's systems and culture.

The Housing Corporation's circular on internal controls and the drift of risk management towards a stale, box-ticking exercise, has led many associations to recognise that it's time for a rethink. Here's what Newcastle-under-Lyme Housing did to revitalise risk and control.

Risk panel structure
At NULH we set up a risk panel tasked with brainstorming and monitoring strategic risks and overseeing the risk management process. The panel is supported by diverse risk groups to ensure that all the organisation's key risks are covered. Each group has only a small number of risks to monitor.

Staff involvement
In order to ensure that all risks are considered and to assist in thoroughly embedding risk management, it's important to select groups carefully. Our risk panel comprises the executive team and a number of senior managers.

Using staff on risk groups who were not previously part of the process has had a revitalising effect while raising the consciousness of risk in the whole organisation. It's also an excellent staff development opportunity.

The right tool for the job
We used an IT model bought from a joint venture between two housing associations. Staff found two aspects of this model appealing. First, the model produces instant visual representation of the risks and their scores on a risk map. Second, real-life language of "oh well", "oh dear" and so on, is used to describe the impact. The view of our deputy chief executive was: "It says in two words what we had probably failed to say in 20."

Audit department role
It's a recognised dilemma that the audit department possesses skills and knowledge beneficial to the risk management process, but that to use them might jeopardise audit independence. At Newcastle, the audit department was involved in kick-starting the revised risk management process and running risk mapping sessions, but the primary responsibility for risk management rested with line managers.

The audit department has also been involved in instigating a system of reporting internal control failures, (known internally as "wonky wheels", following the theme of "real" language) and in providing the training on internal control necessary to ensure that this system is effective.

To make managers more formally accountable for its responsibilities with regard to internal control, our executive team and senior managers made statements on internal controls in their areas for the period ended 31 March 2001.

Choose your own system
Try and obtain some views about how other associations are going about this but at the same time ensure that whatever you do will suit the culture of your particular organisation. A networking group such as the Housing Association Internal Audit Forum is an excellent opportunity for this. Our approach was influenced both by formal presentations given to the forum and discussion with other auditors.