In a recent exchange of e-mail about preparations and readiness for emergency response and business continuity, an IFMA FMCC colleague, who instructs in the FMP (Facility Management Professional) program, remarked, with respect to being introduced to risk as an FM concept, “…students seem so enthralled with the risk matrix concept, having mostly never seen it before.” He refers to the idea that severity of consequences and likelihood of an event taking place, which are separate factors, combine to form risk.
This works for any problem that an FM can identify that might occur. A matrix of severities and likelihoods handily presents risks as combinations of likelihood and consequence, should the hazard become an event up ahead. Severe impacts that are also likely mark large vulnerabilities and warrant attention to reduce severity, likelihood, or both. On the other hand, small, unlikely events might receive attention only coincidently, when it is convenient and economical. Many risks are somewhere in between. Risks may be considered alone or combined. Certain combinations of identified risks can reasonably occur together. The combinations themselves have severity and likelihood and can be treated together for purposes of planning and mitigation.
Let’s identify, examine, and compile risks to get them in view. Risks are in good supply against any project of program.
They can be
- social & political,
Is that cleaning service sound financially? How likely are we to have an assault in the parking garage, or an active shooter? What if the CAFM becomes corrupt or unavailable? Talk with people and write down all that come up. Keep adding to the list. You can’t mitigate everything, but you don’t want to miss a big one that you could have anticipated. Begin by ranking likelihood 1-5 in a somewhat subjective way. Rank severity of consequences the same way. Multiply likelihood x severity for each, to derive a score between 1 and 25. To get this far requires small and steady investments of time and effort, and yields large awareness and understanding.
Your organization will have its own risk profile. Now comes the part where detailed knowledge matters. Another colleague offers a convincing example of large differences in risk for almost the same event. One leads to minor inconvenience. The other leads to business failure after an agonizing interval in a way that, in retrospect, is painfully obvious. A damaged small diameter water connection to a refrigerator ice maker leaks onto the floor on a weekend when no one is present. Water trickles along the floor and through a pipe feed into unused basement space below. On the next work day, maintenance personnel repair the tubing in a few minutes and set up fans to dry the basement. (They stop the vertical opening around the pipe too, to limit spread of fire.)
A similar leak on a weekend in a kitchenette, on the floor over a back office operations center of a different tenant, ruins equipment and destroys data and records, stopping operations. Replacement equipment can be found and configured, but software reconstruction will be complicated and backup data status uncertain. The business briefly operates, but some customers have already found other providers. Those remaining experience problems. The business closes. The devil was in the details.
Coming up: Risky Business, Livening Up a Risk Register. Sound like a snore? Stay tuned.