Risk management involves 'identifying risks' (i.e. detecting an event of significance), and then 'mitigating the risk' (i.e. responding appropriately).

Risk management has increasingly become recognised as an integral part of good practice M&E.  But in the international aid industry we still have a lot to learn about risk management.  The realisation of risks can be seen as a 'failure', but it represents a clear opportunity to learn.  One of my favourite quotes is from Gharajedaghi, J. (1999):

"Learning results from being surprised: detecting a mismatch between what was expected to happen and what actually did happen.  If one understands why the mismatch occurred (diagnosis) and is able to do things in a way that avoids a mismatch in the future (prescription), one has learned."

One of the problems I frequently observe with risk management in the aid industry is that it is too blunt an instrument to be of much value.  Rarely do we apply a 'typology' of risks to make sense of them.  So a consequence is that we end up with an ocean of un-interpretable risks...very little value!

One way to help with this is to ground the risks in the human reality of social change.  What I mean by this is to assign a 'human face' to risk...i.e. ask 'risk to whom?'

The theory of change implicit in most international aid projects can be conceived as a temporal sequence of relationships between a series of human actors: i) the implementing team --> ii) the direct beneficiaries/partner organisations/boundary partners --> iii) the ulitimate beneficiares.  (NB this temporal sequence of human relationships also corresponds to the Outputs, Outcomes and Impact in most project designs).

Risks can then be conceived as inhibitors of the overall 'theory of change' by appreciating who is most directly affected.  Following from above, there are then three classes of risk that correspond to the three classes of human actor implicit in the theory of change.  Risks may cause the overall theory of change to fail by directly affecting the i) implementing team, ii) direct beneficiaries/partners or iii) the ulitmate beneficiaries.  For example:

• Managment Risk: events that directly affect the ability of the implementing team to deliver on the terms of the project management plan (e.g. unforeseen flooding means that a particular training event in a target village cannot be conducted by the implementing team).
• Intervention Risk: events that affect the direct beneficiaries/partners' ability to realise intermediate changes despite successful work by the implementing team (e.g. government extension workers trained in extension methodologies by the implementing team are unable to implement their new skills because they are not allocted sufficient resources for travel and field work by their department).
• Development Risk: events that affect the ulimtate beneficiares of projects despite successful project management and the realisation of intermediate changes (e.g. smallholder famers do not adopt improved agronomic practices promoted by extension staff because of deep cultural beliefs).

The value of applying a rational 'risk typology' such as the one briefly outlined above is that risk information can be of greater practical value.  One construct that can help us consider the role of risk identification is consider how it can help us to be:

• Reactive
• Proactive
• Predictive

These three forms of risk mitigation correspond to the three classes of risk outlined above.  Identifying 'management risks' can help us be reactive to issues that have emergend that will affect the delivery of project Outputs.  Identifying 'intervention risks' can help us to be proactive about emerging risks that may affect the success of the project design in fostering Outcomes.  Identifying possible 'development risks' can help us to predict likely factors that may affect the longterm Impact and sustainability of the whole project.

So there's the challenge with risk management: be reactive, proactive and predictive!