What is Risk Management?
Risk management is the process of identifying what could prevent an organisation meeting its objectives, assessing how likely and how damaging each of those things is, and deciding deliberately what to do about them.
The decision is not always to reduce the risk. Accepting a risk knowingly is a legitimate outcome, and the discipline exists to make that acceptance conscious rather than accidental.
Key Takeaways
- Accepting a risk deliberately is a valid treatment; failing to notice it is not.
- Likelihood and impact must both be assessed; either alone misleads.
- The severe risks are usually rare and large, which is what makes them easy to discount.
- A risk register nobody reviews is documentation, not management.
Understanding Risk Management
The cycle runs from identification through assessment to treatment and monitoring. Treatment options are conventionally grouped as avoid, reduce, transfer and accept: stop doing the activity, lower the likelihood or impact, move the consequence to someone else through insurance or contract, or carry it knowingly. Choosing among these is a commercial judgement about cost against exposure.
Assessment is where the discipline is hardest. People estimate frequent, familiar risks reasonably well and rare severe ones badly, tending to treat anything that has not happened as though it will not. Because the rare severe events are the ones that end businesses, this bias is precisely the wrong way round.
The other structural weakness is correlation. Risks are usually assessed one at a time, while real failures arrive together: the supplier fails during the demand spike while the key person is unavailable. Registers that score risks individually systematically understate the combined case.
Real-World Example
A business insures its premises, holds redundant servers and carries key-person cover, and treats itself as well protected. All three were assessed separately. A single event, a fire during the peak trading week while the operations director was abroad, engages all three at once, and the recovery plans assume the others are functioning. The individual assessments were sound and the portfolio view was missing.
Importance in Business or Economics
Organisations fail from risks they had identified and not treated far more often than from risks nobody could have foreseen. Formal risk management is largely a mechanism for forcing attention onto low-probability outcomes that are easy to postpone, and for recording who decided to accept them.
Types or Variations
- Strategic risk: Threats to the business model itself, such as substitution or regulatory change.
- Operational risk: Failures of process, systems or people in day-to-day running.
- Financial risk: Exposure through credit, liquidity, currency or interest rates.
- Compliance risk: Consequences of failing to meet legal or regulatory obligations.
- Reputational risk: Damage to standing with customers, staff, investors or regulators.
Related Terms
- Strategic Planning
- Supply Chain Management (SCM)
- Data Governance
- Corporate Social Responsibility
- Performance Management
- Public Relations (PR)
Quick Reference
- Cycle: Identify, assess, treat, monitor
- Treatments: Avoid, reduce, transfer, accept
- Assessment axes: Likelihood and impact
- Systematic blind spot: Rare, severe and correlated events
Frequently Asked Questions
What are the four ways to treat a risk?
Avoid it by not undertaking the activity, reduce its likelihood or impact, transfer the consequence through insurance or contract, or accept it deliberately. Acceptance is legitimate provided it is a decision rather than an oversight.
What is the difference between a risk and an issue?
A risk is something that might happen and can still be influenced. An issue has already happened and is being managed. Risk registers lose value when they fill up with issues, because the two need different responses.
Why do organisations underestimate rare risks?
Because absence of occurrence is read as evidence of improbability, and because the cost of mitigation is immediate while the benefit is hypothetical. This is the reverse of what the severity of those events warrants.