Talk:WMUK risk discussion

Welcome.

The Risk Register

Most organizations use a system of "weights" on risk, and also mitigation. So, for a financial risk, the mitigation is more income. Usually done with charts and colours. Wondered if the mitigation side of things was worth thinking about now, as well as the effects of the risk? LoopZilla (talk) 14:54, 23 April 2012 (UTC)

Completely agree. This was Jon's initial top half dozen. Though I suggest it remains a simple and manageably short list, I would like to see assessments of impact (not just financial impact but other important measures such as reputation impact), likelihood, the contingency plan and residual risk (i.e. those risks that remain once the counter measure is in place). Ideally I would like to see some real churn as risks get managed and their ranking changes as a result. This way the top 5 risks for review in board meetings with the trustees (a standard part of their duties for the charity) would hopefully keep changing. --Fæ (talk) 15:24, 23 April 2012 (UTC)

I work in the construction industry and some years back the CONDAM (Construction Design and Management) regulations came in demanding that designers record the risks inherent in their projects for the builders and the users. We all went away and produced long schedules of risks - electric shock; falling from heights etc. - which were completely useless since 99% were normal risks which every one already knew about and the 1% of risks which were unique to this project were lost in a massive report that nobody read.

Now the system has changed. Only unusual risks are recorded - the piece of equipment you need an abseiler to get at; the essential machine that must never stop so it has to be maintained while running etc. - and these risks are recorded right there on the drawing where the equipment is detailed.

For WMUK the standard risks are the things you buy insurance and keep reserves for. Record them if you have to but do it in summary at the bottom of the list. The unusual risks are those that don't apply to other charities. Ones that I can think of:

• Open Content being closed off due to legal shenanigans over the interpretation of licenses or otherwise.
• Reduced income due to loss of reputation because of the actions of anonymous strangers (after all the good reputation we have now is mostly due to the actions of anonymous strangers)
• Loss of editors and other volunteer help because we get all serious and aren't fun any more (I rate this quite high).
• Entryism and takeover. The wikimedia properties are valuable. We thought Building Societies were the bedrock of consumer socialism but now they are nearly all gone or turned into immitation banks. Could the wikimedia projects be turned into ad supported internet "properties" and could WMUK do anything about it? Filceolaire (talk) 14:43, 26 April 2012 (UTC)

I rate the loss of editors risk quite high too, but at least it now seems a slow process, & frankly the readership seem even slower to notice it, so the impact on income can probably be considered even slower. Loss of volunteers active in WMUK is probably more serious; really the active members doing things are a small group. Johnbod (talk) 04:21, 27 April 2012 (UTC)

Schisms with the foundation

Of course schism and even forking is a risk for the organisation in various ways, but I'm not sure that the best way to present this is in terms of "Schisms with the foundation" being a separate risk in its own right. My concern is that overly focussing on the risk of that relationship failing could lead to WMUK putting that relationship above others and adopting a strategy of defaulting to support of the Foundation in its many disputes with the movement. Perhaps a better way to express describe this risk would be to simply put that the Wikimedia Foundation's centralisation agenda is a risk to the chapter? WereSpielChequers (talk) 09:14, 24 April 2012 (UTC)

A very diplomatic proposal.

Jon Davies WMUK (talk) 09:47, 24 April 2012 (UTC)

I'm not sure the WMF would see it as diplomatic - I don't think they agree that they have a "centralisation agenda". It's probably best to keep the risks as neutral and uncontroversial as possible (we don't want the risk management to cause the very schism we're trying to avoid!). Perhaps we should just go with something general like "Risk of relationships with the international movement deteriorating"? It would be worth asking the WMF what risk monitoring they have in place with regards to movement relationships. --Tango (talk) 11:56, 24 April 2012 (UTC)

I agree with Tango here, and wonder whether point (iii) and (v) should be put together, with one point being internal fracturing with in the UK and the other being fracturing at an international level, which should not be put simply in terms with WMF but also in terms of any problems which could arise with other chapters.Leutha (talk) 13:35, 24 April 2012 (UTC)

Comments (Johnbod)

I see the main financial risk as being loss of reputation, possibly leading to some WikiLeaks style blockage by PayPal etc. The second of these is very extreme, but the risk of some "scandal" seriously impacting our reputation, rightly or wrongly, and so very directly our fundraising, must be considerable.

Another risk is an alternative project replacing WP; if this was also Open Content, it might be appropriate to switch our support to that of course.

Otherwise a falling-out of some sort with the foundation, or even just them moving the goalposts significantly re fundraising and the use of their trademarks in fundraising, seem the most serious risks, apart from the inevitable risks of running any organization. Unfortunately both of these major risks could materialize very quickly, and the degree to which WMUK can take preventative measures is rather limited. Johnbod (talk) 19:09, 24 April 2012 (UTC)

Reputation

In the past few days, Andres Breivik has been in the news.

http://www.telegraph.co.uk/news/worldnews/europe/norway/9218529/Anders-Behring-Breivik-trial-Six-days-in-the-company-of-a-mass-murderer.html

As for this work, Breivik admitted that “50-60 per cent” was copied from the internet. And what was the principal source for his world view? The killer’s answer to this was emphatic: “Wikipedia,” he said. “The English articles there contained a lot of information.” How had he found out how to make a bomb? “Everything is on the internet,” said Breivik. “Everything. You need to know what you’re looking for, but you can find it.”

The world has always had its Breiviks – in the 19th century, lone anarchists tried to inflict carnage on European capitals. But today, a Breivik need only sit in his bedroom to discover everything he needs to know about killing human beings, while immersing himself in a world of fantasy courtesy of virtual reality computer games – and imbibing his selected facts from Wikipedia.

This is just one example of the misuse of Wikipedia, and could therefore affect WMUK. LoopZilla (talk) 14:44, 25 April 2012 (UTC)

This is a rather general risk, albeit an extremely disturbing and unpleasant one that I really do not want to dwell on. This is a Wikipedia and mainly a WMF communications problem.

More pragmatically, Wikimedia UK is regulated by the Charities Commission and to keep our charity status we need to worry about risks related to:

• how we vet our trustees
• how we manage banking, expenses and ethical investing
• how we handle complaints and legal threats
• how we accept donations and behave ethically during all fundraising
• when we should reject donations or in-kind donations due to appearances of tacit sponsorship
• how we run open procurement processes
• how and why we might pay volunteers compensation for certain activities
• how we manage declarations of interest
• how we make clear what our "partnership" agreements mean when we work with GLAMs, councils, other chapters, commercial organizations

These are all the sources of reputational risk that keep me awake at night as a trustee, though I probably worry too much. --Fæ (talk) 14:57, 25 April 2012 (UTC)

Those are certainly serious risks, but we shouldn't just be thinking about legal risks to the charity's existence. We should also be thinking about risks to open knowledge, even if they don't directly relate to us, which includes things like the Breivik case. --Tango (talk) 21:35, 25 April 2012 (UTC)

Tango, I'm happy for a discussion about risks to open knowledge, I am not going to take part in any further discussion about this current legal case against a mass murderer as if it were a thought experiment. I will take this page off my watch-list if it goes down that disrespectful path. Thanks --Fæ (talk) 22:11, 25 April 2012 (UTC)

I don't see anything disrespectful... I think it goes without saying that the killing lots of people thing is more serious than the comment about Wikipedia, but it's the comment about Wikipedia that is relevant to this discussion. One of the best features of Wikipedia is that it has always been willing to discuss controversial and distressing topics in a neutral and dispassionate way - I think our discussions should be likewise. --Tango (talk) 01:40, 26 April 2012 (UTC)

This is not Wikipedia and though you may not see anything disrespectful about using this current mass murder case as an academic debating point, I can. Would you be prepared to accept my point of view exists and manage to use different and less emotive cases? Otherwise you "win" as Godwin's law applies and I will wash my hands and my memory of this page. Thanks --Fæ (talk) 07:41, 26 April 2012 (UTC)

Fae: Can you agree that there is a real risk to our reputation due to events we have little control over? A risk which is worth discussing here?

Yes, though we already have a suitable contingency plan on responses, and this particular case you seem desperate to discuss is not even a good example. In general other risks are more valuable for us to discuss, where we do not even have a decent contingency plan or a full time member of staff ready to respond. --Fæ (talk) 15:00, 26 April 2012 (UTC)

Private eye's Glenda Slag column has for years satirised the way the UK press switch from praise to blame with little apparent connection between either and reality. At the moment we are in the "Don'cha just love plucky little Wikipedia" phase but "Don'cha just hate those Wikiliars/pornographers/terrorists?" will come soon enough.

What should we do to prepare for it? Filceolaire (talk) 14:53, 26 April 2012 (UTC)

Could you express this as a real risk? Vaguely saying we might get some negative press is not unexpected and Stevie already has plans and a communications review underway. --Fæ (talk) 15:00, 26 April 2012 (UTC)

Negative press attention is a real risk. Just because it's something we know about and already have some procedures in place to deal with doesn't mean it shouldn't feature on our list of risks that we monitor. --Tango (talk) 16:57, 26 April 2012 (UTC)

My understanding is that this is a WMUK risk discussion, not a Wikimedia risk discussion, which would be useful, but elsewhere. Clearly problems on any of the Wikimedia sites could impact WMUK, but I think that they would need to be dealt with in another way, and that while WMUK should support such a discussion, it is quite a distinct discussion from the specific WMUK risks which are being raised here. Having also acted as a Charity Trustee for a number of years, I see Fæ's list as being pretty good. However, from experience I would add that legal issues around employment can cause a significant legal threat: dealing with an employment tribunal can be very time consuming and draining even if the finding is in your favour. Much of the matters around financial probity can be dealt with through a good understanding of SORP as developed by the Charity Commission. However, another point is that having great policies is of limited use if they are not actually implemented. I think we should all appreciate that the Board is carrying the can legally for WMUK, and the rest of us should help support them in this.Leutha (talk) 16:36, 26 April 2012 (UTC)

Wikimedia UK exists to further free and open knowledge. Anything which could impact upon that is a risk that we should be considering. There are risks (such as the legal risks Fae mentions) that could impact upon our ability to work towards that goal, and there are risks that could impact directly on that goal and change what we need to do in order to further it. Both types of risks should feature in our risk management processes. --Tango (talk) 16:57, 26 April 2012 (UTC)

Can I just underline Filceolaire's view that we need to limit the risks to the unusual. We also need to define what we are trying to protect. Our mission does not need WMUK. WMUK does not need Wikipedia to have a diverse base.... which is handy because we have very few editors outside the UK. Are we trying to protect the office?, our 300 members?, our 5,000 contributors?, or WMUK contribution (or damage) to the communities mission? I think its the latter but its important to define what we are trying to protect Victuallers (talk) 22:26, 26 April 2012 (UTC)

Ok, but I see the process of defining what we are trying to protect can be broken down into different aspects:

1. WMUK Risks: Specific risks to Wikimedia UK
2. Wikimedia Risks: Risks to the Wikimedia movement
3. Free and Open Knowledge Risks: Generic risks to the development of free and open knowledge (e.g tighter copyright control, SOPA etc.)

The reasons for separating them out is that they each require different approaches. The first is basically up to WMUK to deal with. The second means entering into a broader discussion with the rest of the movement, while the third involves working with broader coalitions against any threats or to campaign for measures which aid in this goal.Leutha (talk) 23:51, 26 April 2012 (UTC)

Sort of. But we need to consider the potential impact of the second type on WMUK specifically; for example and in particular how we would cope if there was a sudden large drop in our income one day. Johnbod (talk) 04:16, 27 April 2012 (UTC)

I like Leutha's model, it reminds me of fried egg diagrams and would be useful when thinking through the Comms plan. As an alternative I would like to see a stakeholder map showing the level of overlap between communication methods and message types. For example WMUK members and Wikimedians in the UK have massive overlap, while regulating bodies and GLAM ambassadors much less so. --Fæ (talk) 07:03, 27 April 2012 (UTC)

Well any event which had that sort of impact would probably also affect other English speaking countries, particularly the USA, which means that any Risk management strategy would do well to have shared protocols with them. As regards a large drop in income - with a consequent accumulative drop in cash at hand - this would need a suitable reserves policy to ensure that existing commitments could be met while the board assessed the long term impact, making any necessary reductions in running costs, through reducing staff levels, for example. That long-term assessment would also probably need to be made in conjunction with other chapters and the WMF.Leutha (talk) 06:37, 27 April 2012 (UTC)

Stakeholder map

Here's the beginning of a stakeholder / user map I doodled on the train today. I'm hoping that something like this will be developed in the Communications Plan (by Stevie) and would be used as a review tool for risk management. --Fæ (talk) 16:38, 27 April 2012 (UTC)

Wikimedia risks

Risks which affect the wikimedia projects and what measures WMUK should take to reduce the likelihood it will happen and to reduce the impact on WMUK if it does happen.

Wikimedia stops being fun. Editors stop contributing

With increasing emphasis on quality and consistency there is a risk that it will be harder to make a useful contribution to English Wikipedia and editors will choose to contribute elsewhere.

Measures WMUK can take to make this less likely

• Organise Editathons and Wikicircles to help make editting a more social experience, especially for new editors.

What WMUK could do if this happened

• WMUK to have good relations with other free culture organisations, where our editors might move if WP gets stuck, so we can continue to support them there.

How is the above as a model for recording risks? Similar sections would be needed for the other heading listed above. Filceolaire (talk) 13:09, 27 April 2012 (UTC)