Really enjoyed your post. I hadn’t read Tim’s blog before so thank you for that as well!

For the most part, I do agree with your stance on “Business Risk”. It is indeed continuous and active consideration and planning, and I believe it can be a successful and rewarding as a simple process.
The part that I have to dispute is your point that it does not have to be formal. While I anticipate that you mean it doesn’t have to be a big and expensive undertaking involving outside consultants, it’s worthwhile to say that because it is continuous, active and (hopefully) simple, it most definitely has to be formalized in some way. If we are able to set formal processes and management structures around our risk mitigation efforts, we can better the chances that our planning and preparedness will be effective when needed and that it will command less resources in its planning stages.
Maybe it’s formalizing how you identify and prioritize your risks, or how your company evaluates its response after a loss has occurred. It may even be just setting structure and formalization around how risk management is incorporated as a part of your organization’s culture. What ever way you set about structure, risk management is indeed stronger and more successful with formalization.

Thanks again for a great post and for getting my brain spinning this morning!