Risk Management 

That was a basic example of risk management that you’re likely already comfortable with on a regular basis.

Leaders must also be comfortable with the formula used to manage the risk so it can be duplicated before and during an event that may be even more consequential than a broken glass of wine.

Let’s break it down:

• The glass of wine is our critical asset
• A wagging dog’s tail is a threat to the glass of wine
• The broken glass and spilled wine are the hazards
• Carpet that is not stain-resistant is the vulnerability
• The stained carpet and cut finger is the consequence or impact
• Analyzing all of the factors combined describes the risk analysis
• Moving the glass or removing the dog are contingency plans or risk treatments that are intended to reduce the likelihood of occurrence and the severity of impact (mitigation).  

[Other contingency plans to reduce risk and lessen any impact could consist of not drinking wine in the living room (avoidance), asking someone else to hold the wine glass (assignment) or enjoy the dog and the wine and just get another glass (redundancy) if accidents happen (acceptance).]

Leaders use the above formula to analyze and evaluate the risk of a decision before an incident, during the incident, and in any improvement planning after an incident.

Now, let’s look at a larger scale scenario:

• ACME Corp defines their customer service center as a critical asset
• Hurricanes and accompanying power outages are a threat and a hazard
• The lack of back-up power to the customer service center makes it vulnerable
• Not having a consistent power supply to operate the customer service center impacts ACME’s operations and is consequential to the ability to retain customers
• The risk is deemed great enough that specific contingency plans are needed to manage it
• Accepting the risk and creating a remote work policy and mitigating some of the risks by adding redundant systems like power generators, off-site locations allows ACME to keep serving customers even if the primary center fails due to a hurricane.  
• They also had the option to assign the customer service center to a vendor or avoid the risk altogether by closing the facility.

Whatever risk treatment is used, leaders also monitor the applied solution to ensure it continues to solve the problem.

• Example:  routing traffic from Main Street to Elm Street due to flooding is a solution unless Elm Street starts to flood too.  Vigilant monitoring is required.

In the public sector:

Organizations that are recipients of federal grant money are usually required to perform and share their risk profile as a pre-requisite.  The risk analysis method the government requires is called THIRA (Threat and Hazard Identification and Risk Assessment).  

In the private sector:

Enterprise Risk refers to the strategic activities of the organization - like the risk of entering into the VHS videotape market.  Sometimes called “top-down” risk analysis.

Operational Risk refers to the functional activities of the organization - like the risk of sending people home during an ice storm instead of before the ice storm.  Sometimes called “bottom-up” risk analysis.

By defining and understanding

1. what we want to protect
2. what out there could hurt us
3. what can we do about it

And then by doing it, leaders are better able to predict the consequences so they can usually also prevent the consequences.

If you’re playing along at home and want to use this format to improve your own risk analysis, download the simplified, free Risk Analysis Worksheet below.

Also available as a free, direct download is a Pre-Event Planning Matrix for an established method to incorporate other stakeholders into your plan.