Risk has always been a reality for Aboriginal and Torres Strait Islander organisations operating in a context where funding is irregular, activities and operations often in remote and dangerous locations, resources and sufficient training on procedures are scarce, the retention of corporate knowledge and succession of talent is always difficult to maintain, and the risk of fraud and corporate theft always at hand.

The recent COVID-19 pandemic was an unprecedented, catastrophic event that shut down travel, put at risk vulnerable Indigenous Elders, and in some cases closed operations for several weeks.

What if it or another more likely or more catastrophic event happened again?

While COVID-19 may have awoken many Indigenous organisations into the reality of severe consequences brought about by a risk-event taking place, most of these organisations already live with the potential of many risk-events like those above.

It is time to be prepared by having an effective Risk Management Plan.

The COVID-19 pandemic is a good example of how a well-prepared organisation with other disaster-management strategies already in place may have dealt with the consequences of the pandemic better than another organisation that had no preparations whatsoever and had to make up actions as it developed.

To be fair, nobody could have predicted an international pandemic or how it developed in Australia and what it led to.

Within a matter of a few short days, we went from plans to go to the footy to developing social-distancing and self-isolation. In a few short weeks, there were travel restrictions imposed and borders closed.

The health risks, particularly in vulnerable Aboriginal and Torres Strait Islander communities where most Indigenous organisations operate, meant potentially fatal consequences of transmission of the virus.

With almost no warning organisations had to defer or even cease operations, close offices and send workers to work from home, and sharply reduce income sources.

How many organisations found the "simple" task of getting workers to work from home a mountain to climb?

Did they have resources? Laptops? Broadband? How did they communicate?

However, organisations who had prepared Risk Management Plans with strategies to deal with major disasters such as bush fires may well have had strategies in place that planned for the shut down of operations and taking office work remotely.

They would have been able to adapt those strategies to deal with COVID-19. They would have put into place their existing contingency plans to stand down workers, arrange work-from-home procedures, and implemented their prepared communications protocols.

The conclusion is very clear.

All Indigenous organisations need to prepare Risk Management Plans to identify and mitigate the risks that face their organisation.

Risk Management Planning is the process of:

• Identifying the risks that your organisation faces,
• Analysing and assessing those risks,
• And then developing strategies to manage those risks.

A Risk Management Plan ensures operational continuity when events threaten part of or the whole of your organisation.

By understanding what these risks are, and what the risk-events mean to your organisation, you can find ways to reduce their impact before they happen.

While the risks can vary from organisation to organisation and even within organisations from activity to activity, the process of preparing a Risk Management Plan is an easy logical step-by-step process that anyone can follow.

There are six steps in the Risk Management Planning process:

Step 1: Identify the risks

In this first step, you identify all the risks that your organisation might face.

Review your operational model - what are your key systems? What are your critical resources and supplies? What would you miss if it stopped working?

Types of risks include strategic risks, compliance risks, operational risks, financial risks and reputational risks.

Step 2: Assess the risks

Taking each identified risk, and in turn, assess its likelihood and its consequences.

A very unlikely risk that will have very little consequences is obviously a low risk. On the other hand, something that is very likely to happen and where its effects could be catastrophic is an extreme level risk.

Remember that there may be different types of consequences like those affecting health and safety, quality of service, operational sustainability, finances, efficiency and reputation.

Step 3: Map the risks into a Risk Matrix

A risk matrix looks like this:

It is a one-page picture of the risks you have identified, and the level of their risk to your organisation from the extreme in the red to the low in the green.

This is done because no organisation can implement all of its Risk Management Strategies at once. We need a way to prioritise risk and therefore prioritise the urgency of strategies.

Step 4: Create strategies to manage the risks

Using the risk levels identified by the Risk Matrix, you can now prepare appropriate strategies to manage or mitigate the risks.

You can write Immediate Action strategies for extreme level risks, Rigorously Manage & Monitor strategies for high risks, Manage & Monitor strategies for medium risks, and Accept BUT Monitor strategies for low-level risks.

Your strategies should either reduce likelihood of happening or reduce the consequences if they happen or both.

The strategies may involve avoiding, reducing, transferring or accepting the risk.

Step 5: Manage the Risk Management Plan

Like all plans, the Risk Management Plan should not sit on a shelf.

You should plan and organise to actively manage the plan.

This means you should schedule tests, drills and rehearsals where possible, and discuss the results if different scenarios where a physical test is not possible.

These can feedback into regular and appropriately frequent Monitoring and Evaluation meetings.

You will also need to know who has overall responsibility for the coordination of the plan and its strategies as well as for sufficiently regular updates.

Step 6: Monitoring and evaluation

What will make the plan a reality is the monitoring and evaluation process that you implement.

At regular meetings, you can discuss any changes brought about by outside influences or as a result of your strategies. You can discuss feedback and learnings from tests and drills as well as from actual events that happened.

You can use the results to improve on the plan and make changes.

So, time to get ready.

At OTS Management, we have used our 30+ years of experience to prepare a recorded online program to help you prepare your own Risk Management Plan.

It is a complete package called Risk Management Planning for Indigenous Organisations. ou will be provided with a modular lesson by lesson approach where you are shown each element of the Risk Management Plan and then provided with downloadable worksheets at each stage to prepare your own Risk Management Plan.

You can click here to learn more about the program.

We hope you try it out and be prepared for the next risk-event that takes place!