Effective Risk Management: A look back at GFR in April 2016.

• Position: Rewind - Government finance review

To sum up the April 2016 issue of GFR, risk management is essential, and you need to figure out how to do it well. Even though we haven't gone as far back into the past as usual--2016 wasn't that long ago--boy, have we seen some risks in those six years.

Your organization already engages in risk management, of course. You buy insurance, you do employee background checks, and you conduct security assessments. You try not to get hacked and held for ransom. The question is whether you've taken the step of formalizing the risk management function. The lead article from the April 2016 issue (1) provides some important initial steps for creating an effective risk management program:

* Choose a risk management framework that has organized and provided easy access to information, publications, and a community of experts regarding processes.

* Gather strategic plans and objectives, which will help provide a solid understanding of the organization's strategic direction.

* Make an inventory of existing risk management activities, which will help you avoid duplication. Consider the entire enterprise, including the IT department, which already handles many risk management functions.

* Figure out the organization's risk appetite, or the amount of risk an entity is prepared to accept when trying to achieve its objectives. This determines the organization's capacity to absorb loss and management's predisposition toward risk taking.

According to the Committee of Sponsoring Organizations of the Treadway Commission (more commonly referred to as COSO, for obvious reasons), the focus of risk assessment "is to gain an understanding of--and agreement on--the organization's top risks and...