The Hidden Risk: When Organizational Knowledge Resides Outside the Organization

Knowledge risk management identifies and reduces threats to critical organizational knowledge, including knowledge created by suppliers and contractors. Clear ownership, regular knowledge transfer, and usable documentation help organizations maintain business continuity, reduce dependence on external parties, and retain knowledge when an engagement ends.

Prefer to Listen? Tune in to the Podcast

Organizational knowledge management aims to ensure that knowledge is available to employees at the place and time it is needed.

On the way to achieving this goal, the organization encounters many challenges, some of which are known as "knowledge risks."

Knowledge risk is a situation in which knowledge vital to the organization's business activity is unavailable, undocumented, may be lost, or not in the organization's possession at all.

When we carry out knowledge-needs mapping processes in an organization, two main knowledge-related risks usually come up.

1. Inaccessible knowledge – results from the lack of a clear methodology for storing and organizing knowledge, difficulty in locating it, or its being scattered across systems. This risk is typically addressed by implementing a document organization and management solution.

2. Undocumented knowledge – knowledge that exists in people's heads. Sometimes it is passed on as an oral tradition; sometimes employees leave, and the knowledge leaves with them. The main risk is the loss of unique knowledge that is difficult, if not impossible, to reconstruct without the employee who holds it. This risk is typically addressed through knowledge retention processes, in which the knowledge is documented and remains within the organization.

However, there is another issue, discussed and addressed less often, but no less "risky" – organizational knowledge that is not in the organization's possession.

This situation occurs when working with external companies and subcontractors, during which a great deal of knowledge is created outside the organization.

The absence of mechanisms for sharing and transferring this knowledge into the organization carries many risks, such as: lack of ownership and rights over the knowledge, dependency on external parties, harm to business continuity, inability to carry out developments and handle faults, leakage of knowledge to competitors, difficulty reusing the knowledge, and even complete loss of the knowledge in the event the engagement ends.

What can be done to reduce the risks?

Here are a few ideas:

Risk	Ways to Reduce / Prevent
Lack of ownership and rights over the knowledge	Anchoring knowledge rights, intellectual property, and access rights in the engagement documents
Dependency on external parties, harm to business continuity	Cultivating internal experts / backup resources alongside the external party's work Defining mandatory knowledge deliverables in the engagement documents, including format and submission schedule Tracking the transfer of the required knowledge deliverables Ongoing absorption of the knowledge created by the supplier, in accordance with the requirements in the engagement documents Making payment contingent on the transfer of the knowledge deliverables
Inability to carry out developments and handle faults	Requiring documentation of faults and solutions Carrying out quality control on the knowledge deliverables
Leakage of knowledge to competitors	Having suppliers sign confidentiality agreements / commitments not to transfer the knowledge Involving information security personnel and providing information security training to stakeholders
Difficulty reusing the knowledge	Defining an organizational standard for documenting and organizing the knowledge Defining the format and method of knowledge transfer Preparing supporting infrastructure (in advance) for absorbing the knowledge Designating a party responsible for absorbing the knowledge and maintaining it within the organizational environment
Complete loss of the knowledge in the event the engagement ends	Contractually anchoring a "termination of engagement" clause in the engagement documents Receiving the knowledge on an ongoing basis, not only at the end of the project Monitoring the transfer and quality of the knowledge deliverables up to the point of termination

In summary:

Knowledge is an organizational asset, even when it is created outside the organization.  This creates a unique risk: vital organizational knowledge that is outside the organization's control or reach.

In a world where working with external parties is integral to business activity, it is important to view knowledge retention and its transfer to the organization as a clear organizational interest.

To this end, the organization must create mechanisms and processes that ensure knowledge is transferred efficiently and with high quality, made accessible to employees, and reusable in the future.

---

Want to learn more about knowledge risk management?

Here are some articles you might find interesting:

• A Practical Guide to Risk Management - Book Review

• Good Strategy - Bad Strategy - Book Review

• PVaR - Book Review