Thomas M. Bragg on Business Risk Management

As I’ve written previously, there are three basic steps in risk management. The first step is “Identify the risks”. Easy enough, right? Not if you don’t know what to look for. What is a risk? Where do they come from? How do I find them? Let’s take a look…

.

What is a “Risk”?

Risk is defined as “someone or something that creates or suggests a hazard” or in mathematical terms “the unwanted subset of a set of uncertain outcomes”. Basically, risks are potentially bad things to be avoided. A key word here is “potentially”. The cool thing about risks is that they haven’t happened yet, which means you can still influence them or at least plan for them. A risk that has happened has another name like: crisis, problem, issue, disaster or complication.

.

Where Do Risks Come From?

In the context of business, almost every risk comes from assumptions. Some of the assumptions are conscious (e.g. I assume that we will sell 500 widgets this week, I assume that my website will see 5,000 hits with a 1% conversion rate). The conscious assumptions are the easiest risks to identify because you’ve already done some thinking about them.

.

But be aware, there are other risks out there that are harder to identify. These are the unconscious assumptions. Some examples of unconscious assumptions are: I assume that my computer will not crash; I assume that my building will not burn down; I assume my line of credit will not be revoked; I assume that I won’t get sued by a customer who falls on my sidewalk. Unconscious assumptions are about events that generally occur as surprises…events that just aren’t anticipated. As you can imagine, there are a lot of unconscious assumptions in every business. Unconscious assumptions also cause more stress than the conscious variety.

.

How do I Find my Risks?

The easiest place to start is to list all of the conscious assumptions you can think of. In a spreadsheet financial model, every input value is a conscious assumption. In a strategic plan, every trade-off you considered resulted in a conscious assumption. In a IT security plan, many settings (e.g. firewall, encryption) are based on conscious assumptions. Start writing the assumptions down, or better yet, start typing them into a column of a spreadsheet (you will thank me later.).

.

The unconscious assumptions are harder to come by. In my experience, this is an ideal brainstorming opportunity. Get a group together and brainstorm on all the unconscious assumptions. A good place to start is with your insurance policies. Insurance covers many unconscious assumptions. Start listing the obvious assumptions and then move into the less obvious. You’re probably making assumptions related to the economy, right? How about available or accepted technologies? Are you assuming market acceptance of your service or product? What are you assuming about your customer service level?

.

Don’t fret about capturing all of your risks in one sitting – it won’t happen. You will find that your list of risks is a living document so keep it handy. Once you start thinking about your risks, you’ll be amazed at how many you’ll think of over time. As you think of them, enter them into your list.

.

Another word of caution. Don’t exclude risks from the list because you consider them very unlikely to occur. We will evaluate the probability of the risk and its potential impact later. For now, capture every risk you can think of. Risk management is an ongoing process and things change. Some of your “very unlikely” risks may become “likely” in the future. Keep them on the list so you don’t get surprised later. [Disclaimer: Use some judgment here. Adding the risk "Being struck by a meteorite" may not helpful because it is so unlikely.]

.

Identifying your risks is the first step. What are you making conscious assumptions about? What unconscious assumptions are you making. I know, this seems overwhelming. It’s not. Keep your expectations in check. Do the best you can. We’ll be fine.

.

How do you feel so far? Do you understand where where we’re going? Let me know if you don’t.