Electric cooperatives have faced two “once-in-a-generation” events in the course of a year.  First was the COVID-19 pandemic, and next was the power crisis that gripped Texas and much of the nation.  One important lesson from these unimaginable events is that excellence in risk management is vital to the success of every electric cooperative.  

The ability to withstand such crises requires a conscious effort to incorporate risk issues into every key decision.  Co-ops with a healthy risk culture and a formal process for identifying, assessing, mitigating, and monitoring their risks are more likely to achieve their strategic objectives.  They will make better decisions, reduce unpleasant surprises, become more innovative, and be better prepared to respond when challenges arise.  In short, co-ops with sound risk management programs will be stronger, more agile, and more resilient.

Risk, Risk Management, and Enterprise Risk Management 

We can think of a risk as anything that might interfere with the achievement of a cooperative’s objectives. Such risks can range from a global pandemic to a cyberattack to a wildfire to an injured worker, among many others. Every co-op faces numerous risks. Risk management is the process of identifying key risks, assessing their likelihood and potential consequences, making decisions about how to best address those risks, implementing those decisions, and monitoring the risks. Enterprise Risk Management (ERM) is the modern approach to risk management. Whereas tradition risk management tended to have a very narrow focus on insurable risks or safety risks, ERM takes a holistic view of all the risks facing a cooperative, whether strategic, financial, operational, or hazard risks. 

Do Co-ops Really Need ERM? 

Some leaders may think, “We know our risks and we implicitly incorporate risk-thinking into our decisions, so we don’t need a formal Enterprise Risk Management program.” While it is no doubt true that any good leader thinks about risk, most organizations will still benefit greatly by implementing a formalized risk management program. ERM helps integrate the collective knowledge of everyone in the co-op about the risks the organization is facing and may face in the future, and it helps assure that individual risk decisions made throughout the co-op are appropriate for the co-op’s overall risk appetite and risk profile.

In short, having a formalized ERM program is simply a best practice for electric cooperatives. 

What Does ERM Entail? 

Developing and implementing a robust ERM program at your co-op is straightforward, and the steps are well-established.

Risk Identification 

The first step of any risk management process is identifying the key risks that would keep the cooperative from achieving its goals. A variety of approaches can be used to develop the list of risks. Structured interviews and facilitated discussions with employees and directors are two of the most valuable. A good starting point is to first conduct individual interviews with directors and key leaders from across the co-op to ask them what they see as the primary risks that could hinder the achievement of the co-op’s strategic objectives. This would be followed by a facilitated discussion among a larger group of managers representing all the major functional areas of the co-op, again focusing on identifying risks that could threaten the achievement of objectives. This process will uncover a significant number of risks. The identified risks are then grouped into appropriate categories. At this point, the number of identified risks can sometimes seems overwhelming, so discussion takes place to do some prioritization. The initial ERM focus will be on those risks deemed to be highest priority. Other risks can be added as the process matures. 

Risk Analysis 

Now that the key risks have been identified, the next step is to analyze those risks in an attempt to understand them as deeply as possible. Each risk will be analyzed along two dimensions: likelihood of occurrence and impact on the cooperative. The scales for likelihood and impact need to be carefully designed. Likelihood is usually measured in terms of annual probability of occurrence. Impact is generally measured across several dimensions (e.g., financial impact, reputational impact, impact on operations or members, etc.). For most risks, likelihood and impact cannot be precisely, scientifically measured, so a consensus or voting system is used to determine where risks should be placed on the likelihood-impact scales. 

Risk Registers and Risk Maps 

The results of the risk identification and analysis process are summarized in a Risk Register. The Risk Register will list each key risk along with its description, the target risk level for the risk, the current likelihood and impact scores, and the resulting overall risk rating. Another field will contain planned mitigation measures, and the next will give the projected risk rating after mitigation. Crucially, the Risk Register will also list a co-op employee as the risk owner for each risk. The risk owner has the primary responsibility for designing the implementing risk mitigation plans and monitoring the management of that risk. Finally, a review date for that risk is listed. For critical risks and those with substantial planned mitigation, the review date might be relatively soon, whereas for more stable risks, it would be further out. The Risk Register can then be used to produce a Risk Map, which shows all of the key risks on a single two-dimensional map reflecting likelihood and impact. The Risk Map provides a quick overview of the co-op’s risks and helps guide discussions on risk prioritization, risk mitigation, and allocation of resources toward risks. Risk Maps are especially useful in giving a co-op’s board of directors a high-level overview of the co-op’s major risks. 

Risk Mitigation 

Risk mitigation is where the real action takes place to change the level of risk facing the co-op. In the Risk Register, the target risk rating for a particular risk is compared to the current risk rating. If the current risk level is above the target level, mitigation is required. The nature of the risk mitigation, of course, varies from risk to risk, and its effectiveness is measured by how much it changes the likelihood and/or impact of the risk.

Risk Monitoring

It is important to remember that a co-op is never truly finished with its ERM program. The Risk Register itself makes that clear by listing a review date for each listed risk. But monitoring is much more than just assuring that mitigation techniques are being implemented as planned. Over time, additional risks will need to be added to the Risk Register, some may drop off, and others will move on the Risk Map. At least quarterly, the Risk Register should be reviewed for possible updates. Annually, the entire process of risk identification, analysis, and mitigation planning should be conducted again. Some risks will be stable from year to year, but we live in a dynamic world, so each year will undoubtedly bring new risks and new dimensions to old risks.

The Bottom Line 

Does your cooperative have an ERM process like the one described above? If not, your co-op would benefit substantially from developing one. By implementing such an approach to managing risks, directors, employees, and members will have more confidence in management; strategic plans will be more likely to be fulfilled; operational objectives will have a higher likelihood of being realized; reliability and safety will improve; and numerous missteps will be avoided. 

Most organizations that implement an ERM process find that employees then understand the organization better, both its strengths and its vulnerabilities; they better understand how their roles relate to what others in the organization do; they have a better appreciation for the risk appetite of the organization and how it should influence their own decision-making process. As a result, the organization builds a culture in which everyone is more aware of risk and incorporates risk thinking into their daily work. 

Click here learn more about our approach to risk management for electric cooperatives.  When you are ready to improve your cooperative’s approach to risk management, contact us so we can explore opportunities to work together.  And click here to learn about our Co-op Strategy & Risk Management Collaborative, which will help you quickly improve your skills in strategic planning and risk management, as well as learn from your peers about these vitally important topics!