Many types of risk concerns have emerged more into our thinking in recent years, including the biggest one of all – the impact of the Covid-19 pandemic, which has affected every society around the world. We are much more aware and concerned about the risks to ourselves, our organization and our community. Reflecting this, risk management will be treated as a much more important business activity in future. And good PR risk management will play a larger role.
Generally, the following five risk categories are considered to be the main types of broad business risks:
- Strategic risks in the business and political environment
- Compliance risks – complying with rules and regulations
- Operating risks – events that severely disrupt operations, such as natural disasters, power supply, management complaisance or incompetence, cyber security attack, etc
- Financial risks – relating to the money flowing in and out of the business
- Reputation risks – a ‘soft’ term, but with major business implications.
Business risk is the chance of something happening that will have an impact on business objectives. For a company, this can possibly lead to reduced profits or even bankruptcy. For other types of organizations such as government and non-profit entities, operational risk may involve loss of reputation and loss of funding
Business risk is measured in terms of likelihood and impact. Some people think public relations practice doesn’t involve much risk, which they think is more about operational matters such as safety and security. A good risk strategy can mean survival.
Cyber risk is a recent, growing form of business risk. More specifically, McKinsey states that it is the potential for business losses of all kinds in the digital domain—financial, reputational, operational, productivity related, and regulatory related. While cyber risk originates from threats in the digital realm, it can also cause losses in the physical world, such as damage to operational equipment.
In addition to the potential risks in public relations activities, risks are prevalent in all areas of corporate life. We should be alert to these because communication may be needed to address internal and external corporate and operational risks.
Source: World Economic Forum, Global Risks Perception Survey, 2022-23
Scenario planning helps organizations to understand uncertainty
Done properly, scenario planning prompts business leaders to convert abstract hypotheses about uncertainties into narratives about realistic visions of the future. Good scenario planning can help decision makers experience new realities in ways that are intellectual and sensory, as well as rational and emotional, according to McKinsey. Scenarios have four main features that can help organizations navigate uncertain times.
- Scenarios expand your thinking.By developing a range of possible outcomes, each backed with a sequence of events that could lead to them, it’s possible to broaden our thinking. This helps us become ready for the range of possibilities the future might hold—and accept the possibility that change might come more quickly than we expect.
- Scenarios uncover inevitable or likely futures. A broad scenario-building effort can also point to powerful drivers of change, which can help to predict potential outcomes. In other words, by illuminating critical events from the past, scenario building can point to outcomes that are very likely to happen in the future.
- Scenarios protect against groupthink. In some large corporations, employees can feel unsafe if offering contrarian points of view for fear that they’ll be penalized by management. Scenarios can help companies break out of this trap by providing a ‘safe haven’ for opinions that differ from those of senior leaders and that may run counter to established strategy.
- Scenarios allow people to challenge conventional wisdom. In large corporations in particular, there’s frequently a strong bias toward the status quo. Scenarios are a non-threatening way to outline alternative futures in which assumptions underpinning today’s strategy can be challenged.
Risk management comprises the culture, processes and structures that are directed towards the effective management of potential opportunities and adverse effects. The role of risk management is to identify potential risks and take action to reduce the chances of those risks becoming reality and to reduce the magnitude of incidents if risks do turn into reality. Note also that the risk management process can identify potential opportunities from risk, just as issues and crises can create opportunities as well as problems.
Key benefits from risk management
- It reduces the likelihood of unpleasant and costly surprises.
- It provides better information for strategic planning and decision-making.
- It leads to more realistic allocation of resources, especially financial resources.
- It generates better results from communication programs and projects.
- It creates better compliance with regulatory requirements.
- It helps to more accurately define the scope of required insurance cover, which can lower insurance costs.
Good PR/communication management of reputation risks
However, there is an element of risk in all public relations activity. Think of the risks to the organization inherent in a bad reputation, in controversial public issues, corporate crises, sponsorships turning bad, poor counsel to senior management, hyped product claims in marketing communication, use of celebrities in marketing, and in corporate events that go wrong. Many risk management experts believe that reputational risk is one of the most important – a PR risk that has major dollar value.
International political changes are obvious examples of business risks. The UK decision to leave the European Union, terrorism activity, and incoming US administration in 2016 all represent sudden, unforeseen risks creating potential disaster. And who would have foreseen the US President being a frequent liar making self-serving decisions? Obviously Covid-19 has created unforeseen business risks globally.
You can read further information about corporate reputation in my article, “How your corporate reputation may be your biggest financial asset.”
The communicator’s role in risk analysis and management
There is an element of risk in all public relations activity. Think of the risks inherent in a bad reputation, in controversial public issues, corporate crises, sponsorships turning bad, poor counsel to senior management, hyped product claims in marketing communication, and in corporate events that go wrong. Many risk management experts believe that reputational risk is the most important of all—a PR risk that has dollar value.
In addition to the potential risks in public relations practice, risks are prevalent in all areas of corporate life. PR practitioners should be alert to these because communication may be needed to address internal and external corporate and operational risks.
Security and risk management concerns are part of organizational life these days. This is not just about the imminent dangers of climate change and the remote prospect of terrorist acts, but a greater concern about risks stemming from the internet and corruption of various kinds. You should keep up with the implications of adequate risk management in your communication planning:
- The extent and nature of risks associated with communication activities need to be taken into account in your annual plan. Examples of such activities include issue management, crisis planning, stakeholder relations, and sponsorship. You need to develop a procedure to identify all relevant risks associated with significant communication activities, to evaluate and quantify the risks, and to develop risk reduction actions where considered appropriate. Consultation with risk management experts will equip you with tools to conduct risk assessment of communication activities yourself.
- When your organization is working through the annual planning and decision-making process, you need to insist on being included in the process as much as possible. This will facilitate the inclusion of communication elements within risk management activities. Indeed, communication could be central to risk management actions, eg dealing with ‘fake news’ about your organization. The risks may relate to corporate reputation and to relationships with key stakeholders such as employees, major customers and government decision-makers. The act of communicating may well be the risk mitigation action, eg when management communicates with staff about prudent actions they should take to reduce the possibility of hackers wrecking databases. In a sense, risk management is really another form of issue reduction and crisis prevention.
It is important for you to become familiar with risk management techniques developed in support of communication plans so the techniques can be applied knowledgeably and effectively where appropriate.
Effective communication can play a significant part in minimizing most of the risks facing any organization, even with operational risks. It should be essential for each risk area to have an integrated communication plan showing how the communication would reduce the chances of the risk occurring, and if the risk were to become a reality, of reducing the impact. This is an outstanding opportunity for you to become proficient in applying the new technique and demonstrating how communication can play a key role in improving operational performance.
Risk management planning
Risk management planning should be a continuing process that includes a contribution from the communication function in all of its stages. In addition, risk management should be a part of the planning of all significant communication and public relations programs and projects, especially when planning new activities.
Broad components of risk management plans
In a 2023 article, McKinsey consultants note that a dynamic risk management plan can be broken down into three broad components:
- Detect potential new risks and weaknesses in existing risk controls.
- Determine the organization’s appetite for risk taking.
- Decide on the appropriate risk management approach.
Risk management steps
The 7 risk management steps below incorporate the three components outlined above:
- Establish the context
- Identify the risks
- Analyze the risks
- Evaluate the risks
- Treat the risks
- Monitor and review
- Communicate and consult.
1. Establish the context.
The rigor of any risk management actions in public relations practice will reflect the corporate culture and risk management policy. Context includes the objectives of the public relations team’s approach to risk management activities. The team’s criteria for accepting and treating risks need to be established. The step of establishing the context involves identifying the key stakeholders. Risk management activities are more likely to be successful when stakeholders understand each other’s perspectives and are actively involved in decision making.
2. Identify the risks
Potential risks can be identified in various ways:
- Consult manuals
- Brainstorm with staff and/or organizing committee members to list potential causes and scenarios
- Check records of previous similar activities
- Initiate process flow mapping of the parts of an activity
- Conduct risk audits
- Ask suppliers and subcontractors, many of whom have direct experience of dealing with risk
- Perform stakeholder analysis—many risks arise from the requirements of stakeholders.
3. Analyze the risks
Analyzing a risk is about developing an understanding of the risk. Through understanding a risk and any existing means to minimise its impact, the probability and impact of a risk can be estimated, allowing a level of risk to be determined. The likelihood, possible impact and levels of potential risks can be evaluated using tables or matrices that show likelihood against impact. Impact of an event or situation could be a loss, injury disadvantage or gain. The adequacy of existing risk management strategies, if any, should be reviewed in this step.
Here is an example of risk analysis for a sponsored bike race:
4. Evaluate the risks
The purpose of risk evaluation is to make decisions based on the outcomes of the risk analysis, about which risks need treatment. The list of possible risks can be set in priority order according to their rating, in a similar way to the ratings calculated in the above table. Also, the risks can be assessed in other ways. For instance, risks could be prioritised according to the cost of mitigation, the chance of occurrence, or the ease of action. Some of these approaches are obviously more rigorous than others and need to be developed within the corporate risk policy and criteria of acceptable PR risks.
5. Treat the risks
Risk treatment involves identifying the range of options for treating risk, assessing these options, and preparing and implementing treatment plans. Potential risks can be treated and controlled to:
- Reduce the likelihood
- Reduce the impact
- Transfer the risk, for example, through insurance
- Accept the risk
- Avoid the risk.
6. Monitor and review
Few risks remain static—changing circumstances require close awareness. Potential risks can be monitored and reviewed through:
- Risk reviews
- Checking the records for any past or present claims against the organization
- Internal and external audit reporting
- Progress of the risk management plan.
7, Communicate and consult
Communication and consultation should be involved in every step because of the value that results from being aware of stakeholders’ points of view. This ensures stakeholders are adequately informed and have the opportunity for input into the risk management plan and can act on their part to treat aspects of the risk applicable to them.
My article, “Why your organization should follow risk management principles for continued success,” provides further helpful insights into the field of risk management.
Also, if you want to find out more about how to deliver successful communication campaigns, you are welcome to buy my helpful ebook, Communication Campaign Plans: How to write a winning communication plan, which explains how to plan, analyze, implement and measure outcomes for maximum results.