The thing about grocery shopping, exercising, laundry, cleaning, or risk management is that you’re never done. You never get to a point where you say, “Well, I did it. I finished shopping for ever. Glad that’s done!” Managing risk in business is an iterative process. Think of it as your albatross, or, if you are an optimist and would like to stay in business, your chance to minimize threat and maximize opportunity.

Accenture’s 2009 Global Risk Management Study highlighted some deficiencies in how businesses approach risk management. It should be noted, though, that the research also revealed a strong interest in and motivation to improve in this critical area.

Back to the results, though:

• Most risk managers spend only 20 percent of their time advising business units.
• Most risk managers spend 60 percent of their time on data cleansing, data management, and compliance.
• Half of the companies felt they were unprepared to handle economic turmoil.
• Only half felt confident in handling future risks.
• On a scale of 1 (low) to 5 (high), 42 percent said their preparedness level was 3; 58 percent had lower scores.

Handling risk is a differentiating factor for companies, and it tends to be concentrated at the initial stages of a project. But it is important to recognize that a risk management document is living; it’s not static, and it shouldn’t be sitting on your top shelf, gathering dust. How do you keep your risk management strategy from getting stale?

• As risks emerge, talk about them as a project team. The team leader then takes the risks to the executive sponsors and steering committee.
• Focus on the most imminent, prominent threats. What danger are we facing right now?
• Look beyond today. What is coming that will impact the project in 30, 60, or 90 days? Who is taking vacation? When? Is anyone retiring? Taking leave? Being promoted? What do you know today that will help you deal with tomorrow?
• Discuss these risks and plan mitigation strategies. Revisit them and nail down specifics as needed.
• Keep minor risks from snowballing; what do we see coming that we can change or divert before they become critical issues?

You don’t have to write a new risk document every time someone sneezes and it looks like a cold is coming on. What you can do, though, is continually add, subtract, modify, and revisit risks. Keep it current; it’s alive, so make sure to feed it.