Turning Risk into Strategic Advantage

RMF

The Risk Management Framework (RMF) is a structured process designed to help organizations identify, assess, and manage risks in a most systematic manner. This approach was originally developed for information systems, like those found in government or military organizations. However, since then, RMF has evolved into a being used as a tool with wider applicability across different organizational domains. Its main objective is to integrate risk management into all aspects of an organization's operations, so that decisions are supported and made based on the clearest possible understanding of risks and their potential impacts.

RMF's approach is fundamentally structured and proactive, as it looks on understanding the context of risks within an organization (Bohmer et al., 2009). Its focus is the importance of grasping the organization's risk tolerance and the specific nature of threats (HBR, 2020). This understanding helps one to identify, assess, and respond to risks. It is also the main reason the RMF's iterative nature allows for continuous adjustments in response to the evolving risk landscape. This adaptability is at the core of the RMF approach. It is what supports risk management strategies and keeps them relevant and effective over time.

Bohmer et al. (2009) show that RMF's approach to risk management can be seen in the strategy of managing claims and legal defense for the Controlled Risk Insurance Company (CRICO), a professional liability insurer owned by and serving the Harvard Medical Institutions (HMIs). RMF's proactive stance is seen in its investment in programs that focus on reducing malpractice risk at its member institutions. This is not a common practice for a liability insurer, and this fact shows that RMF's commitment is both to managing and actively reducing risk. Prevention is a big part of its strategy.

Thus, one of the key strategies employed by RMF is the analysis of malpractice claims against insured physicians to identify factors contributing to medical errors (Bohmer et al., 2009). This represents a data-driven approach that lets RMF design targeted risk management programs, such as the publication of best practices, standard treatment protocols, simulation trainings for high-risk medical procedures, and strategic retreats for hospital leadership. On top of this, Bohmer et al. (2009) note that the increase in malpractice claims originating from satellite facilities of HMIs also represent a new challenge. RMF recognizes that the expansion of the HMI network's geographic footprint brings about new liabilities and risks, which is why this situation prompted RMF to consider whether the systems and processes used at the hospitals were being effectively extended to these satellite facilities. This ultimately shows that RMF's awareness of risk management strategies must change in response to the changing operational landscape of the organizations it serves.

Plus, the RMF's principles also focus on broader business strategies, such as how to manage risks by altering supply chains, changing contractual terms, or improving information quality for better decision-making (Girotra & Netessine, 2011). This perspective aligns with RMF's emphasis on a comprehensive understanding of risk. Girotra and Netessine (2011) show how businesses can create value by redesigning their models to reduce or even assume more risks, provided they are well-placed to manage them: "In thinking through changes to the business model, therefore, it is essential to examine the major sources of risk to the model and how the model will handle them" (Girotra & Netessine, 2011, p. 102). Indeed, it is one of RMF's core principles that integrating risk management into organizational processes should be a must-have.