What is risk? How does risk management work? How is risk incorporated into business decision-making?

“What’s the risk?” is often interpreted as what can go wrong? The answer to that question is a scenario. However, a definition of risk as something going wrong limits our ability to manage risk.

Risk is the probability and impact of a result differing from a target outcome. The difference between realized outcomes and target outcomes can occur across multiple dimensions. The impact of risk on business outcomes is that we may not have plans to adjust to outcomes that significantly differ from the target. Not having a plan puts leaders in the difficult situation of having to react to an emerging set of circumstances. Moving slow while gathering evidence to support decision-making may not be an option. The anticipated benefit may not be realized. The investment may not pay off.

Let’s look at an example. My daughter, Emma, is a food science major at Utah State University. Prior to entering college Emma started her own business, Lemon Glass Blues. Emma etches glass objects and sells them. Let’s consider one aspect of risk in Emma’s business. Emma prepares forty etched bottles for Valentine’s Day. Emma hopes to sell all her bottles. What are Emma’s risks? There may not be enough customers who want to buy the etchings. There is a plethora of reasons for a dearth of customers. But what if eighty customers want to buy the etched bottles? That’s a good thing, right? Emma sells everything and makes her money.

In the scenario where there are too few bottles, the impact of the risk is lost revenue potential and possibly lost customers. The impact of risk occurs when the result obtained differs from the result that was planned for.

This concept of upside risk and downside risk is embodied in the Strengths-Weakness-Opportunities-Threats (SWOT) exercise. Opportunities are upside risks and threats are downside risks.

Can we just solve this by avoiding risk? Risk accompanies all business decision-making. There are no situations where there is no chance the target outcome could not be realized. There is always risk.

Rather than guess what might go wrong leaders can consider some fundamental questions. What is my target outcome? Are all the constraints accompanying the target outcome clear? What might cause target outcomes to be missed? This kind of critical thinking focuses on the outcome, not all the scenarios are associated with how the outcome is obtained. Using the target outcome and constraints as a reference point creates a context that allows leaders to determine which risks are worth considering in risk management.

Risks can be managed in different ways. One way of managing risk is to accept it. Leaders accept risks with every decision. The effort to mitigate every risk will succeed only in driving the resource side of the value equation higher. Some decisions, such as aircraft design and medication approval require more risk management resources.

Risks can also be monitored. There may be situations where a decision to expend resource is only made after a predetermined threshold is crossed. This is often used when the monitored risk factor is beyond a leader’s control. For example, a project may look good as long as the cost of money is below a certain threshold. A rise in the cost of money may trigger a reassessment of the situation and possibly result in an expenditure of resource.

Risks can be mitigated. Risk mitigation occurs when resources are allocated against one or more risk factors. The cost of risk mitigation must be considered in the total outcome investment. Leaders should avoid being overly optimistic in assessing risk. Budgeting resource for risk management encourages team members accountable for the outcome to consider risk. Having no resource for risk mitigation tells the team not to bother with risk management.

Finally, risk can be realized. Risk is realized when the target outcome is not obtained within the constraints set by leaders. If the payoff to investment ratio was high enough, the business case may still be positive in favor of the investment. However if the resource expenditure associated with realizing the risk is high, the investment may result in a negative return.

So how does your team manage the risk in your organization? What behaviors do you personally practice to ensure outcomes are obtained? You have to ask yourself, what risk am I willing to take?

Joe Thompson