If you think Risk Management is concerned solely with minimising risk, you will not be alone, but I believe that you are wrong, and that such a wrong understanding could be preventing your business being as successful as it could be.
I have had the experience of being consulted by managers about certain proposals, to which I responded by asking a series of questions about the risks involved and the control measures in place or to be introduced. All too often the response has been to regard my advice as “negative” and for the plans to be put on hold, or else for the project to go ahead without conducting the sort of exercise I recommended, depending on how popular the idea was with senior management.
Why do I disagree with the idea that Risk Management means minimising all risks?
Firstly, there is the matter of Balance. It is important to recognise that one risk often affects another, so that to reduce one may mean increasing another. Increased security could reduce the risk of theft but could also increase the risk of damaging your reputation or even losing customers, depending on how reasonable the measures were perceived to be. If a corner shop had security like an airport it would not retain many of its customers, whereas if an airport had security like a typical corner shop, it would soon become victim to terrorism or crime. Risk Management is about balance: balancing one risk against another and balancing the effectiveness of control measures against their cost.
Secondly, there is the concept of “positive risk”. What this means is that an opportunity can be considered as a risk, but one with more benefits than costs. Whilst I take issue with the terminology, as we all talk of the risk of losing a lot of money but not the risk of making a lot of money, I agree with the concept.
People may be afraid to do something which could be profitable, such as develop a new product or service, or change the way things are done, because the change involves risks.
The advice a good risk manager should give in such circumstances is:
1. identify all the risks including the potential gains,
2. evaluate the probability and the potential cost of each outcome,
3. examine possible control measures for each risk,
4. make a decision in the light of all these considerations.
A likely result of this process is to go ahead with the desired project, but only with the appropriate control measures in place. This is usually preferable to either taking risks blindly or being unable to change anything for fear of the risks.
It is important to look out for “positive risks” or risky opportunities to see if they can be managed so as to enable you to make a profit, as well as looking at the negative risks to see how they can be controlled.
Perhaps your business is being held back by undue fear of taking risks.