Thomas M. Bragg on Business Risk Management

Let’s take a step back for a minute. Step one of the risk management process is “Identify your risks”. Three little words so it must be pretty easy, right? Not really.

.

A risk management plan is only as good as the risks you identify. They need to be specific. They need to be the ‘root risks’ or the root causes of those potential hazards (or opportunities, remember) facing your business. As you start drilling down into all of your assumptions you’ll find that it is hard to get deep enough. It’s hard to go far enough down into the details without getting derailed on meaningless tangents.

.

To help out the process, I’ve developed a technique I call the “5 Coulds”. I can’t claim this technique as original work. It’s based on a root cause analysis technique called the “5 Whys” that is used in process improvement and the Toyota Production System.

.

Here’s how the 5 Coulds technique works. Start with an assumption you have made about your business. For our example, let’s use the assumption that we will hit our budgeted sales levels. Obviously there are a lot of different risks that could cause us to miss our budget. Now start asking the question “What could cause..?” and keep going until you get to an answer that is beyond your control. In my experience, five levels will usually suffice – sometimes less, sometimes more.

.

Here’s a simple example for finding a ‘root risk’:

Assumption: We will hit budgeted sales
1) What could cause falling short on budgeted sales – a loss of customers
2) What could cause loss of customers – a lower priced alternative is available
3) What could cause lower priced alternative – a lack of perceived value of our product by customers
4) What could cause lack of perceived value – poor product packaging
5) What could cause poor packaging – lack of good taste

If we took the questioning down one more level – What could cause a lack of good taste? – you find that the answer is beyond your control, right? Taste either exists or it doesn’t. So the lack of taste is the “root risk”. It is very specific and it’s actionable. If you need to address the risk you can hire someone – with good taste – to design your packaging. Very specific risks generally present very obvious options for how to avoid or minimize their consequences.

.

Even better, very specific opportunities generally present very obvious options for how to exploit them. You can use the same technique by just tweaking the questions. For our example, change question 1) to “What could cause exceeding our budgeted sales?”.

.

As you use the technique, you’ll find that each questioning level may have multiple answers leading to other potential risks for a single assumption. That’s ok. You’ll also find that some assumptions will share root risks. That’s ok, too. If you did the technique graphically – like on a whiteboard - you’ll see that the end result looks like a tree structure with multiple branches coming off of each assumption. (The technique can also be done with word processing software – contact me for details.)

.

The 5 Coulds technique is pretty informal, but I find it to be effective and simple…and that’s the goal for an ideal business risk management process, right? I’m sure there are other methods out there, but I haven’t been exposed to them.

.

What techniques do you use for identifying specific risks? Please share.

.

P.S. Take a look at the De-Risk blog post Extreme Risk Management – Mountaineers and Project Management for a story about how keeping risks specific applies to climbing a mountain, too.

.

P.S.S. I’m putting together a step-by-step example of creating a risk management plan – from brainstorming risks all the way through planning for them. I haven’t quite decided how to best present the results, but I’ll get it out to you somehow.