It is not surprising that the Australian affiliate (IIA-A) of the Institute of Internal Auditors is far ahead of the global headquarters in their expressed understanding of risk management. In general, risk management practices and guidance in Australia are among the best.
The IIA-A has just released a new White Paper, Agile Risk Management. While it mentions the Agile methodology, it is really focused far more on agility, which I commend.
The IIA-A has a lot of good thinking to share. Are they all the way there? Not yet, but this is clearly good progress, and I will come back to this later. But first, the good stuff.
I like the contrast they draw between traditional and agile risk management:
Traditional risk management – built from the risk management common body of knowledge using traditional methods but over-engineered, slow to react and not dynamic.
Agile risk management – adopting new ways of working for risk management practitioners to foster stakeholder engagement and collaboration through use of dynamic methods.
They explain that:
Getting people interested in the concept of risk management is difficult, partly because it is not seen as core business and so does not get the attention it should. And also because in most cases it is:
- Not dynamic.
- Slow to adapt.
- Not showing the up to the minute risk…
