organizational risk – the high volume of decisions necessary to manage risk – which
undermines the integrity of conventional risk management approaches, i.e. decision tree
methods. Knowledge may help managers better identify risk factors and assess their risk
levels (e.g. the HRI) but it also results in cognitive confusion resulting in a ‘‘clustering effect’’
(see Figure 7). It is not helpful if all risks are rated the same, particularly in high volume risk
decision environments such as EngServ. The consequences could be that significant risks
are ignored simply because decision makers are too busy. The addition of a weighting
based on activity importance (column (a) in Table IV) was helpful in differentiating the risk
scores (see Figure 8) but still resulted in an unacceptable degree of clustering or sameness
about the risk response rating, i.e. intolerable, unacceptable or acceptable (see column (d)
in Table IV).
Managers may use the conceptual model presented in this paper in the following way. Step 1
(see Figure 6) will identify the importance of the risk (risk exposure) and its threat (e.g.
hazard risk index). The use of a weighting based on the importance of the activity reduces
the clustering effect of traditional decision tree methods and also provides decision makers
with organizational context. Step 2 (see Figure 6) provides deeper insight by assessing the
organization’s capacity to manage the risk. While Step 1 simply highlights what might go
wrong, i.e. the unwanted event, Step 2 highlights the nature of the problem and the solution.
In further work with the case study organization, we have developed managerial guidelines
for interpreting the risk ratings by activity and prioritising for action. Activities were color
coded where red is intolerable risk, orange is unacceptable risk, and green is acceptable
risk. The Knowledge and Risk Scores may then be interpreted by looking at the dimensions
of the model that led to this rating. The dimensions help identify why each activity is a risk
and, in this way, provide a platform for action from management. Management could target
specific activities by addressing the issues underlying the risk rating. They can do this by
looking at the scores for each dimension. Which dimension(s) is the lowest? That will identify
the underlying problem. The following guideline is provided.