If sports organizations have learned anything from the Covid-19 crisis, it’s the fact that knowing and managing your risks is crucial. And suddenly, clubs start asking themselves:

• How will my club be impacted by cancelled competitions at national and international level?
• What’s the impact on our revenue if we are not allowed to admit spectators for a number of games?
• Is there a risk that fans will turn away if they are not continuously engaged by the club?

Such questions are nothing more than the kick-off for your formal risk assessment. Risks are usually identified in joint workshops with club stakeholders who have relevant experience and knowledge. External consultants or facilitators can support your risk assessment process.

The output of the initial risk identification should be a list of all relevant risks for your club, ideally clustered by risk categories, for instance:

• Strategic risks: e.g. failure to define clear and concise strategic objectives of the club, failure to communicate objectives at appropriate levels or absence of KPIs to evaluate achievement of objectives
• Financial risks: e.g. decreasing revenue, exploding costs, loss of sponsor or marketing partners
• Compliance risks: e.g. failure to comply with national or international legal requirements, FIFA regulations, confederation rules or local association requirements
• Operational risks: e.g. ineffective and inefficient processes, failure to define process outputs, failure to specify process owners and assign responsibilities
• Reputational risks: e.g. negative effects of management public statements/ behavior, negative impact of spectator behavior, inability to adequately respond to trending topics such as racism

After identifying risks and clustering them by categories, the next step is to evaluate and prioritize them. Risks are generally evaluated from two perspectives – probability and impact.

Probability is the determination of the likelihood of a risk occurring. How likely is it that a certain risk will actually materialize?

Impact is the evaluation of the potential damage of a risk if it were to occur. If the risk would occur would it be catastrophic or just a minor inconvenience?

Risk evaluation methods usually utilize a combination of quantitative and qualitative techniques. There are a number of frameworks providing guidance for risk evaluation such as ISO 31000 or COSO II. However, the basic principle is simple. For instance, you can assign a number from 1-5 (low to high) to probability and to impact and multiply these.

Let’s look at the risk that spectators will not be allowed to attend matches until the end of the year. The probability of matches without spectators is rather high under the current conditions in most countries (probability high = 5). The impact on most clubs in terms of lost gate receipts and hospitality income will also be pretty high (impact = 4). Overall, a simple evaluation of this sample risk would result in a product of 5 x 4 =20.

Most clubs are currently on alert, monitoring legal requirements and other regulatory requirements closely. So while Compliance Risks per se tend to have a high impact on clubs if they materialize (impact high = 5), the probability that a club does not follow legal requirements is probably pretty low under current conditions (probability low = 2). The total score for a sample compliance risk would thus be the product of 5 x 2 = 10. With a score of 10, this risk would be ranked lower than the risk that spectators will not be allowed to attend matches until the end of the year which has a score of 20.

Evaluating risk is often done using expert panels and workshops, sometimes facilitated by external specialists. You can also use survey tools to have risks evaluated separately by different experts and then calculate average values based on the experts’ individual assessments.

Why is risk evaluation important?

Evaluating risks helps you prioritize them and focus on risk treatments for critical risks (i.e. how can I address my critical risks?). A club’s resources are limited so they should be put to good use. In an ideal world, you would try to mitigate all risks by implementing adequate controls or other risk treatments. However, this would be costly and time-consuming, so you need to focus on critical risks first.

If you would like to know more about Risk Assessment, please do not hesitate to get in touch with the BALLYMPICS team